{ "Event": { "published": true, "date": "2023-06-14", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-06-14", "timestamp": 1686787381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "dd8a82a3-3902-412a-8008-10282e3d10d4", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fb0a11-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728249, "uuid": "38d96b56-7686-490a-ab99-2f3f1b4982c4", "comment": "Malware payload (Quakbot)", "value": "c5eecdc2f845c04afcdc56e52645c408", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728249, "uuid": "9b702b63-2bef-49f0-bdfc-785563a7f988", "comment": "Malware payload (Quakbot)", "value": "001630641e12868fff408b994d5fe3de803100bf276fa26db76e831654bce2ae", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728249, "uuid": "d8697f4b-cbf1-4a21-9599-865ba3a8d306", "comment": "Malware payload (Quakbot)", "value": "3f1559592dba03c471e5e7ca39d97b535e6a5655", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728249, "uuid": "2a27bf0a-5a7e-486b-b1e9-a11a698bc046", "comment": "Malware payload (Quakbot)", "value": "653ee848f6cb2d30d8c75f15d9a803271463dcb724e04ccf18312b2a856b97c5d7d42459b5addfab14fb4e19c679ab8d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728249, "uuid": "0cca7b8f-1b57-4a6d-944f-cf4ac95bea19", "value": "T1C77443856A45E0F19237B33BDA578410FAA71F5B10848972B97C505D2F3D8287EBBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728249, "uuid": "f2c8c337-1eec-4c39-b7dd-2f26b0e3d0a7", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbE3YgZPnqjlhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728249, "uuid": "870a96b9-f248-44dc-825f-43441c0d9d9d", "value": 338544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728249, "uuid": "043bb7e9-343a-4953-bd7c-fa6bcbe95aec", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728249, "uuid": "372bff86-16ec-4396-bf85-0b7998b0f82d", "value": "aOEkRE2A2Uyx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a290ac32-0af1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686774342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774342, "uuid": "98086f73-9167-458a-9670-ed6fe5a27c9b", "comment": "Malware payload (Gafgyt)", "value": "7c295800d703eb3dd41fa5c3adb70b6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774342, "uuid": "68ca3507-4a23-40ac-a1c9-d0faa48e2ad0", "comment": "Malware payload (Gafgyt)", "value": "005017953e814a1adcb3f319f6a3693dc765e1a083e8a50f0d3d8c2b15129b7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774342, "uuid": "f19e1b51-4f55-41df-a42f-e4b1d188a7b9", "comment": "Malware payload (Gafgyt)", "value": "1eee857436dbbe0bd7611fe5788e79abd4fd733b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774342, "uuid": "54d7d720-4e0e-4e72-9450-68d386ab183f", "comment": "Malware payload (Gafgyt)", "value": "b8d22717b973d80e8b570521e82e01311babe345d744a2446d5ff57175ea4b01b2711472565252a64375db5cc292d044", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774342, "uuid": "183b6beb-4c91-4716-89a6-e443ddb8b4b8", "value": "T13EA35B8AD743C2B3CC530AB2124BA66A4621FD3B092EAF49F7197DB09F374C97125B51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774342, "uuid": "96ea2a16-6f99-491d-86ad-e8f76c2b2467", "value": "3072:4WCjQrLpnr85EdT9Oa8vqbVr7q/CEgmqAgcVyZIcBI:4f5EdTbpr7qWmqAgcVyZIcBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686774342, "uuid": "f0b46388-3594-4f02-8785-34558e66d06e", "value": 99084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686774342, "uuid": "4d6cad4e-d3d9-4f56-b59a-77c9948f2e93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774342, "uuid": "eeaf3d3f-b45e-4b27-a634-f9ed94ca0451", "value": "7c295800d703eb3dd41fa5c3adb70b6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c325f5-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686725814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725814, "uuid": "cf01d759-98cf-4b39-a079-06177ff65e46", "comment": "Malware payload", "value": "67560da69c001acfb3d853c0aebeabbf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725814, "uuid": "61a8a3ee-9b21-458b-a596-1a967a2c2927", "comment": "Malware payload", "value": "012d1532c189a10effbeccb33cf7525b79dabc14d760e1c42a956c6edb4454b2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725814, "uuid": "71f3d56b-e89a-4810-9ca6-9033785af06b", "comment": "Malware payload", "value": "8de1dee33ae0797df56a890a35602d57375fa3b4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725814, "uuid": "3ecb5650-acbe-4965-869b-cea63d003c04", "comment": "Malware payload", "value": "ffc8ca8e6bd1869af51f2a2054081788d8a85a362824c4cc120459e5f42fd7552bb449019ab85b5da2f4f53837b342fd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725814, "uuid": "02db16e6-ccd1-4fba-827d-1ac93396bffd", "value": "T1496432496A45E0F18237F33BCE174410FAAB0E5B11858962B93C50596F3D86DBEB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725814, "uuid": "685dd781-f3c7-4029-a6dc-bb1ba333656c", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb+wObABmNRfhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725814, "uuid": "d3004bbd-02a9-423f-8c1c-805bb35cb731", "value": 328226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725814, "uuid": "a06e3c6d-bf41-42c2-b4f3-2fd170209af8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725814, "uuid": "e4566f94-12c2-4e64-b597-2ab949302a14", "value": "jcB8CHUuA3SeM.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5065de1-0af1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686774346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774346, "uuid": "dc72613b-ba7e-4159-bb16-cdcd745aa6b3", "comment": "Malware payload (Mirai)", "value": "9bfaf994ef3be8ba3f7840fdd3590866", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774346, "uuid": "936d484a-a3f0-4c87-b54a-31b0983dc7f1", "comment": "Malware payload (Mirai)", "value": "0335ae9848c11a90afaf5830f2cdd4c3692a8189cc54adea9ef3d5d96f02d4e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774346, "uuid": "fe8140e3-de6f-4058-a237-d59b0af61650", "comment": "Malware payload (Mirai)", "value": "4ce0dda43309c29db58557e7be5c722074299bde", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774346, "uuid": "18231b4b-a22a-4b96-8617-e0a54209a798", "comment": "Malware payload (Mirai)", "value": "9a7f882134956f8b10cfb063fd0f35de0e39392426b03a78951eed33b6a11b0af14242c8fb240f8934d049b91540eeaf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774346, "uuid": "59d4a051-3323-4218-8a64-0329e470cb3b", "value": "T18BE32B56EA408B13C0D61779B6DF42453333ABA493DB73069928BFB43F8679B4E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774346, "uuid": "24c35100-dabb-4219-8e8b-a623848a0b89", "value": "3072:CJLce3pC5mK7/abHbz4NpaIJ8VIJ1FaUXkkTM/9cHMY:CJLcem/abHbz4NUIJxHaUXkYM/9gMY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686774346, "uuid": "185c6168-3d73-471b-8403-7101ebb71e25", "value": 150594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686774346, "uuid": "d06338ff-a383-4b5e-8b79-099b1dfe80a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774346, "uuid": "331aed25-368d-4ff2-b737-c553d7566ae5", "value": "9bfaf994ef3be8ba3f7840fdd3590866", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "152002d9-0a95-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686734591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734591, "uuid": "ef2265bc-fbbe-40df-8c53-57a5be580660", "comment": "Malware payload (Formbook)", "value": "1c466dc3a2468e2a7946ada1a20dfcac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734591, "uuid": "66c4ba5c-7f9b-4159-9969-b948d9670bc6", "comment": "Malware payload (Formbook)", "value": "0335bef9440cae7dd60e617e31258a490b9598e3dfa1325bf79ca9eca5c4c720", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734591, "uuid": "a32b145f-0076-483c-a6d9-7e452d610d87", "comment": "Malware payload (Formbook)", "value": "648353375cc7d337ab9686443da26bd83f927fab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734591, "uuid": "69e86e5b-d23d-44d9-a73c-3ca0f5e7d903", "comment": "Malware payload (Formbook)", "value": "ba1ca64926642c6a98db5c80f52843ab9e75b9aa8ee4811f8d7dd9fca7d284facd5990bcb81f0e84d5a92e206802c738", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734591, "uuid": "1be5e196-ffa3-4622-a6dc-4f04ed1eacd0", "value": "T160050280DAED4717D9FB27F8E06441700BB2B45E697AD35E1E81B0DA9A23F114B12F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734591, "uuid": "8e897ae4-05a5-4a66-82bb-2bbc9f03a45d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734591, "uuid": "74e73507-f3ca-450c-b139-d1b49a043a7b", "value": "24576:UzNbsfcpvm3HAgfr2syoydz1EhdS4qXdV:aZRm3dr2oiz6HS4qX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686734591, "uuid": "bea7fada-2bf5-4ae1-8e29-61902c9c1ca9", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686734591, "uuid": "710efb26-60e8-4e98-a4cd-56b920e77aaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734591, "uuid": "92ff304b-43d4-45f3-8f8c-b6eaeea79859", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25076563-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728175, "uuid": "55dd6b5d-91bc-4c34-9eda-8f5fa77e303f", "comment": "Malware payload (Quakbot)", "value": "82a1209e2ddcdc7e7e440118ee5693df", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728175, "uuid": "747a8fd1-1c9b-4676-9850-0011dce8f472", "comment": "Malware payload (Quakbot)", "value": "0421037bf8c72cea0d5d21c7ec0f9f227fcba9064c67c688f774a110943abfe5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728175, "uuid": "b5bd43da-2ef2-4b6a-a146-977b39955cdd", "comment": "Malware payload (Quakbot)", "value": "0d8ae8899d2e55f7378473cf15cf9254e96f38ed", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728175, "uuid": "544c7477-7e01-430f-b1de-9d4b6f8acc02", "comment": "Malware payload (Quakbot)", "value": "ed9ce01f69eeba17a6bbebbe9f410b6ff938dc419b0efc7b8e03183d1ba6d58078cd49304c50b0d2433362abf3e3bcd1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728175, "uuid": "61555670-6dc1-4c6d-9b46-61f5176f91ea", "value": "T19F6452886A55E0F18137F33BCA1B9414FA671F5B11848972B93C50592F3D829BAB7FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728175, "uuid": "783026c0-19a0-4ba4-a47b-b0707cc78244", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb3V/i5VyhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728175, "uuid": "81c67004-20eb-4a57-bf4a-96a4f9d416df", "value": 312298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728175, "uuid": "c58c8a7e-ea53-4141-a27f-816845e84bfd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728175, "uuid": "accbbdcb-d435-491e-bdba-2deef468c88b", "value": "cW0i4FvDUQOMc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dadfc046-0a8f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686732346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732346, "uuid": "f69a4af0-0f34-4f4b-85b3-24fa640ad16a", "comment": "Malware payload (Amadey)", "value": "43ae2d2679cd6a9735887050d9ec5e21", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732346, "uuid": "e2993f50-015d-4ad2-9265-f6f335513a57", "comment": "Malware payload (Amadey)", "value": "042703d29701d4561a4646dde342cc75c00b4f43380e59af8b773b0928650924", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732346, "uuid": "554d29fd-0aed-4f0d-b10a-45da6c9808a6", "comment": "Malware payload (Amadey)", "value": "2b33b4a4e7d9e4d91f5dfff8e33e2075f59be2f2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732346, "uuid": "6b27378a-b5a1-4b9f-a324-ca982ce01319", "comment": "Malware payload (Amadey)", "value": "68e67f2aefb6aefb493a9e946fa6b00417a6ebf8eccdb6851f3ae08f2d5221f11bbba0680f6d040bac6a5d48cb125b67", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732346, "uuid": "953b77ce-0e40-412c-92b9-202b2629d7f4", "value": "T124F42353A6DC8033D4B52B7009FA17C30A36FCA16935876A37A6894E5D736C0A5733B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732346, "uuid": "aa605c1d-08d0-4b32-86e6-60e053e75f78", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732346, "uuid": "62a0d509-0370-41a0-babc-9fe0b05dc95c", "value": "12288:GMrty90QwxJHqgoNLiyRegZ8RAm0NeY6KD3ha6XYMJEjuTEN9+Ha1N4Jcj8FEO:LyUDoRiyR/ZsAyY6a3Y6IMyj7maN+cj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686732346, "uuid": "a634a6d7-3adf-49e7-9562-a93f145264c8", "value": 765440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686732346, "uuid": "c03491e0-e5e3-40ac-a420-43f057a3cfdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732346, "uuid": "8d26c105-1b55-4827-baa5-2fab1bf25615", "value": "042703d29701d4561a4646dde342cc75c00b4f43380e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1133adbf-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686750476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750476, "uuid": "ce9a7bed-c783-4b35-9684-1dfea0c85b2f", "comment": "Malware payload (Mirai)", "value": "97b7bfbe3c40537333711d3e960a6319", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750476, "uuid": "b02fbc9e-585b-4558-82f9-a2880c7eb410", "comment": "Malware payload (Mirai)", "value": "042d6c47e8035d85d17c315e5586ffd86d13b3e3f872d3cb4ecd13f9f12546aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750476, "uuid": "72849092-1e6a-4526-9699-1c34ffef5839", "comment": "Malware payload (Mirai)", "value": "e14589acf655a154e0090f002d6760fb21ee4c04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750476, "uuid": "820ec388-ae3a-4e85-9f19-7dff3e7f824d", "comment": "Malware payload (Mirai)", "value": "0849e00dbd9f8a783bde1f5d19cfa51612ab2cc3351dfbe59ce19ca329ed79a8fc70a6aa01ca18f0580f6abdfc910d0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750476, "uuid": "08bd7b10-dfe3-45ba-9dd1-4dad24144c65", "value": "T13CA32B05F9114763C2C327BAF68F474D3B2267A957DB3302A6357EB02FC27991E25A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750476, "uuid": "1c7bf8de-d7c7-464e-8a20-1181004881a3", "value": "3072:IG8es2aOtH5haG4uKtvmCyrQ0Knm4XnTe:oeKOtH5h6uKBmCyrQ0Knm4XnTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750476, "uuid": "a95931f5-d54b-4db4-8957-0a20c96ad44e", "value": 103742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750476, "uuid": "87e0f8ed-c255-4a10-9aba-1aa453c61331", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750476, "uuid": "e56609d3-f4e5-4f46-90c6-f1c1c2153596", "value": "97b7bfbe3c40537333711d3e960a6319", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc69fdfb-0af3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686775298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686775298, "uuid": "507fa8dd-cafa-41a2-bdf3-c238e8344a28", "comment": "Malware payload (RedLineStealer)", "value": "1ba92202232219a454c392200e06a8d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686775298, "uuid": "31867f87-885d-450e-a0f8-be5aa428bee3", "comment": "Malware payload (RedLineStealer)", "value": "04703b08c8723f130ed1566dba883c46153b7fb3342c4fff3043e77b36892bdc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686775298, "uuid": "07184093-2be5-4472-9a43-a11b710c2ffe", "comment": "Malware payload (RedLineStealer)", "value": "a530f6d6ed34942b7f04417722cda86ea372439f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686775298, "uuid": "c3fa7e54-f4ee-47aa-8555-ebad650b175f", "comment": "Malware payload (RedLineStealer)", "value": "21c9af0cc2c700b0b30e91a57c37e80b963f4c3c8091570ca5d97a314b2cf86e1c28e571e425958479f3671e01918c26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686775298, "uuid": "40366c15-12f1-4cda-af8a-49deb0513e7c", "value": "T10F442920A795DF2BF14180F2EC2774D68367FAA68B1E0093D781B7202D589D9E9E3735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686775298, "uuid": "63b5405c-5633-49af-8e06-738897985d07", "value": "af455355974e9f87f1b4e5df199340d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686775298, "uuid": "3a012187-e59e-4e64-9151-b0f1469f31a5", "value": "3072:ZrvznVfxBbyFZb081CvKg1H/n7m+Ns4VdbN5AXd9bADIsJjOcj/6:pbnVZQb1CJJm+a4TzAAEuix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686775298, "uuid": "13121c96-e732-4616-bede-8980655c39c3", "value": 272312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686775298, "uuid": "d44ea4c7-15fd-4adb-924a-a93eef2e8c8c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686775298, "uuid": "2f9b33ab-6613-4280-9999-2c2df6af179f", "value": "1ba92202232219a454c392200e06a8d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca32ce84-0a6a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686716427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686716427, "uuid": "23b015c6-799d-44e8-a5c6-5106a103c232", "comment": "Malware payload (Amadey)", "value": "fca8dcc65bd33be7adb42c935320e00d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686716427, "uuid": "44dfd527-b591-428c-8d5f-1832227a7f03", "comment": "Malware payload (Amadey)", "value": "0484f64319255ae85abdf651326d516e0409a4b366b0a6ec80a1d3b6a6a10365", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686716427, "uuid": "6434ef66-ff9e-48cf-8554-95ba447e4e92", "comment": "Malware payload (Amadey)", "value": "2134444510a5c5665cc9b2758e9292aa56a68837", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686716427, "uuid": "49cef48e-5bc2-43bb-8cb9-87b995cd47c7", "comment": "Malware payload (Amadey)", "value": "91d9fe3eea55b583a10bb0bfefbb5e1a26a03bfbf203480cb0741a2c92b00b9f612c570bd31e67686a71ac83a2433e62", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686716427, "uuid": "0f1dbdc0-0f68-48f8-bd6b-b7cab27ec258", "value": "T17C052343AAD89173EDB827B198F707D30A37BCB1AD74531B2342669B09727C1693136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686716427, "uuid": "a40ad795-92f0-46a8-9b8f-a5088ff8c90b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686716427, "uuid": "612e7d30-2d1b-44fc-8e3f-2be63bc71b76", "value": "12288:IMrYy90ajsZsdL/W03yN0OAuJLABEEAJG6pUEZqY/s3EG4Q7tm2xze1ZTKc:QyXjsk+GRSXEAMel/wEGt7tm2xC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686716427, "uuid": "91a4f6dd-dd11-4a22-a1e6-9382d8cb875c", "value": 795648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686716427, "uuid": "2a49f1d7-7a89-42e1-8332-48d9cd9722ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686716427, "uuid": "207dc503-505f-447f-a9c9-5ecbb85481eb", "value": "fca8dcc65bd33be7adb42c935320e00d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be15fea-0abf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686752802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752802, "uuid": "f1ecfb40-0ebe-4fb0-b979-9104afb161ae", "comment": "Malware payload (SnakeKeylogger)", "value": "f8b0ebdf806916967926539638ccd218", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752802, "uuid": "13a44593-cf43-474d-88a7-0de281e3bbcf", "comment": "Malware payload (SnakeKeylogger)", "value": "051a0bbef441c7b7201d75212fe5bc6a71f051f95397adf1f401634b451151c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752802, "uuid": "87ef61e9-c409-4277-b2cc-e74a2de944ef", "comment": "Malware payload (SnakeKeylogger)", "value": "ccf356b608acfbe32c344a15623e4dc60f8854b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752802, "uuid": "6c32fd60-1b93-4d0f-a628-00264957b87f", "comment": "Malware payload (SnakeKeylogger)", "value": "08c2a887d261345281a6d830c5efa0dfaee115a9ad88c8132749dbf875f19d49045c81432dc7110951b461b3530b4902", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752802, "uuid": "e53a125c-d9f5-49bd-aa26-e03e17ddda80", "value": "T13FF40140E2EDCB0AC8BB23F4546485340BB2B55F6576E39E1E02B1DA6A63F15CB11F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752802, "uuid": "0378d964-2f0e-48a6-9647-49bb67811639", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752802, "uuid": "ebcac45b-9bdb-466a-b24c-5e70a7a79479", "value": "12288:McucZKRzNl632ae6xqWXu6G2zNGfZWNGXT0++SuBK3EXqXdV:Mtc4RBI/e6fXTG2zQfZWNYTl+S4Y4qXj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752802, "uuid": "70260ceb-7214-4b34-9b7c-dc9e39d3a4c1", "value": 744960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752802, "uuid": "a5fc8a86-49bf-47fe-8599-544e1148b231", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752802, "uuid": "e6a9bba6-ddfb-4315-b197-ebd5f96f1fd7", "value": "re3Yoh9WduOS9hO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e6aa6a-0a8e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686731853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731853, "uuid": "d960a6ac-23dc-4686-8224-975b48906717", "comment": "Malware payload (Gafgyt)", "value": "fcdb341b01b52c8ac4699f81e2bc3bbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731853, "uuid": "efe56592-88e6-40c2-ab32-ecbc54e718ae", "comment": "Malware payload (Gafgyt)", "value": "0524a146f9eb978032be7dd5106025360c3463540eedf3b66f867a75802dbcf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731853, "uuid": "977f4736-4c83-4d2f-b8bd-20036bf4df32", "comment": "Malware payload (Gafgyt)", "value": "79304580a16228c2609ca7cb8dad1a8f751abd62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731853, "uuid": "1c3bf4df-8d16-4ec7-84c9-60cde3ca9e9f", "comment": "Malware payload (Gafgyt)", "value": "b0a80513f379d6f142d0984c475026ebc07f0ac152a4203461757fbd63940e0bdd58fbefd7decfd64ac6dd7f486ae5ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731853, "uuid": "7b861acc-8eeb-4e9f-a0cd-502f655b5f90", "value": "T152B3C517AB618FB7C85FCE3306AA850120CDA55612E97B6FB2B4D92CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731853, "uuid": "cee1c769-07c8-46f2-a56d-a9991dae2349", "value": "1536:ZLeTikthhSMOCMQS+ZjN4pjuIxreg2ODN2eDo/TUmkiSFxfC7xbXe:ZhHC3S+dUreyNTDiTUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686731853, "uuid": "02d67afc-ed5d-4a48-aa11-e87030e0d3df", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686731853, "uuid": "3770de69-147a-4152-8b1a-b1debb4fd039", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731853, "uuid": "8ea68e12-ec47-43bf-bae2-3500e75a6038", "value": "fcdb341b01b52c8ac4699f81e2bc3bbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83aa841c-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686750668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750668, "uuid": "06e47a08-e6e5-4879-a8f3-730b11c00e53", "comment": "Malware payload (Amadey)", "value": "0934c0700f7dacb1ef4e8140c5ea192c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750668, "uuid": "879888d1-5c71-4c85-b234-7b58d453dca3", "comment": "Malware payload (Amadey)", "value": "0537d9408ebb248234d0600fa2875254eb2cf8f9de9d69bf0386243364db6670", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750668, "uuid": "f879af9e-cb16-4237-9ba6-dd3ff41aeedf", "comment": "Malware payload (Amadey)", "value": "eb3a465f0e09691016e0d98da2270d1f32723654", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750668, "uuid": "a3acc1dd-028e-481d-bd6f-6746453c837d", "comment": "Malware payload (Amadey)", "value": "cf5643e250596b7322d5549581b26b7dd7c0c1e07a4e09fe1bec72a22068de0e6968b951a9a3aae8e5ffb986f6e4f2d7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750668, "uuid": "d8a2a608-eda2-4a99-be0b-38c0eef97645", "value": "T1D1D41242BAD88162D8742BB05CF603DB0A37BCE19AB5871F37165C6E1DB3188A5317B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750668, "uuid": "9be2411c-7f5b-4bff-8b02-6b03627571b5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750668, "uuid": "18ffa8f3-76f9-4321-9cc0-8ed44922caba", "value": "12288:ZMrKy90bgDFVSZRecYmtferXZx6necxkdKmsftRTweBxDEdIoQKp1R0:fynD3OJBkdKms3MkjoHp1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750668, "uuid": "60f376b5-3297-4adf-b3cf-d8c03b2b498c", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750668, "uuid": "bdfe267e-30a2-4322-a36f-5a238e8fb828", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750668, "uuid": "039dcd70-fd88-4105-9333-d1bcc714d8e5", "value": "0934c0700f7dacb1ef4e8140c5ea192c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0b0fe27-0a8f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686732356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732356, "uuid": "cdea89bc-d968-4498-bf88-ddf92de96512", "comment": "Malware payload (AveMariaRAT)", "value": "1743f977e8e23cfcb7df23afce42bad7", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732356, "uuid": "6b58b438-8a43-4696-8230-1373983b5545", "comment": "Malware payload (AveMariaRAT)", "value": "053e871d08a725e608386b1a4e41099a2b1f39de6c345b4615a27cc8a8ace113", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732356, "uuid": "403652ad-c57b-4fff-bc1b-464286c6ff62", "comment": "Malware payload (AveMariaRAT)", "value": "877e9804408184b0241bea0aa8300e1be55baf96", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732356, "uuid": "fb320d97-f207-4697-9d49-92baae70c3e7", "comment": "Malware payload (AveMariaRAT)", "value": "5ae1833faf3d250b21223c5414494479e979d3fe8aad8021a6ee29555c552d2c823973b1b81d4ef6f3e04ee9982f0e10", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732356, "uuid": "cf911908-542f-45f5-ad23-04c9714228f2", "value": "T107F423E2E9A4C8F3D1C183722C3B827D9FEFCA5A0C986A161F591F693650D86DB54331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732356, "uuid": "704a6d65-caba-43ab-bf5b-344affab84eb", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732356, "uuid": "1c5c94a6-b260-4b69-9de6-8acf7465e251", "value": "12288:GbM9t4Gz/2fe93ljW+Dy96fw4QJ3n0QpfSKSFLHhQYJwPztmKgFFoSeQ23t2LLdk:r9PD7EOfM3zfSKsBQYJJrq2LLvm8c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686732356, "uuid": "255dd788-1e27-45d8-b8e0-8cce26e99aa1", "value": 766428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686732356, "uuid": "bd1dc8a5-f4f1-434f-9156-fa0214ce8932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732356, "uuid": "737dfbe6-bc17-4260-a0e3-5da84c9121d6", "value": "UPL0087372REV1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa692922-0a8e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686731969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731969, "uuid": "e7b08317-d0b2-48a3-978a-161700e0f757", "comment": "Malware payload (AgentTesla)", "value": "bfe2de8eba236fb0eb346c2f86c3bf26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731969, "uuid": "ac398510-852e-44f9-befe-bbdffdefba09", "comment": "Malware payload (AgentTesla)", "value": "05b9b2ba7cef56b08f7d979f09119528e4de33b6165599c5f550b8c3c7a3f9d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731969, "uuid": "4cce2f13-512f-4574-a347-1bac5768d472", "comment": "Malware payload (AgentTesla)", "value": "b33ac69d327091b970ba05b3b24451d32607ac24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731969, "uuid": "309c195e-4cb8-4888-8541-b18a57aeef68", "comment": "Malware payload (AgentTesla)", "value": "3910fbcfc7eb1947f36cd02e69cb55e40f111f9e5669538a031c1b82d99ccd3c205a8801a0f54794b2783eb5540c7508", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731969, "uuid": "c713dbe5-8315-4c30-a78d-b9ecc9e35af4", "value": "T17735913E1CBE523B95B4C6AACFD58827F440E5B731226D39A4D353864356E8239C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731969, "uuid": "d410972e-8f1a-4d30-8cd1-eee6c387a752", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731969, "uuid": "c577d87f-b7ea-491f-ba94-00d5fc8ff6d2", "value": "12288:qqr+rZVvLJPXmkZ3qlFFr0lJYJwOXGkhzPeXpRP+sv:qrrtX58FF5wOXGkFCpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686731969, "uuid": "e94db6bb-f66a-43b4-a9ba-faec6bc17a80", "value": 1095168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686731969, "uuid": "a1ae2b17-b038-4e57-952c-abeafdc125c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731969, "uuid": "4c8e2fdc-40b3-4211-905d-3255e77b9af7", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9d0da1-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728779, "uuid": "53135590-0693-473c-b4fc-997cab577f4f", "comment": "Malware payload (Quakbot)", "value": "1d7ef90d80e264c33ea1d0ea9add2a34", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728779, "uuid": "629e2204-b15e-4c37-ae78-06177dc078c0", "comment": "Malware payload (Quakbot)", "value": "0610f6a98f5ca3eea7e2191cdbc2d05220e03cab6dc5d80709eb7b16cbe7d09a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728779, "uuid": "097c4446-61fd-4bc9-a9d5-d5f8a0b13dbb", "comment": "Malware payload (Quakbot)", "value": "632dbd36da4b93f71d889a2b203885baa574da50", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728779, "uuid": "ef79cf37-2762-4bcd-83e6-69b34562270f", "comment": "Malware payload (Quakbot)", "value": "fa2ac2681bd2aa2b4e56ffb5f4d5fb852b5a793676a752fe22b04ec8b7a3342f6984bd33ea63c802d91883fb7ed2e9c4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728779, "uuid": "f94d313e-bd7c-4b2e-a8d6-57abdc6421b7", "value": "T1E37432896A55E0F19237F33BCA174410F9AB1E5B2084C972B97C50592F3D8297EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728779, "uuid": "34a9e32f-7bec-4ea5-9ed7-6be0a5841503", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbTM9XWmRhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728779, "uuid": "c5a7cf65-5365-41cb-b165-85627ea3ef70", "value": 337902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728779, "uuid": "348c396a-37f0-4d0d-b796-af71f0521d26", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728779, "uuid": "0d08fb3e-f513-4483-9dd8-e85599a0cff1", "value": "Pahb6lN1MFX5.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b77675d-0a73-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686719999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719999, "uuid": "5b563f0a-42d5-4532-a6be-36b7e4728dad", "comment": "Malware payload", "value": "42383ecb24626a5a37ac625c1e46bd32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719999, "uuid": "2b0c2206-dfaa-4167-8e8c-2f161db95256", "comment": "Malware payload", "value": "06dc6394565b70ac8efd2cc98225cf3ec9b5f7711e036189b186340c591e4f67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719999, "uuid": "bf1c7204-ce6f-4d53-b0f2-7363796ccc6c", "comment": "Malware payload", "value": "5af5323d0a8c5a6d684962dacc267d131a7eefac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719999, "uuid": "349ecbfe-651e-4b5c-8909-20f2f57708bb", "comment": "Malware payload", "value": "21332ee37e0be4b34400768d3510c55dd6a7d5b2ddeef6c39efb4e2917ee5b5e2845021264c1f6b01a6fc053cbdb65f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719999, "uuid": "49ce2807-b1ac-4809-a1e6-567254c1fded", "value": "T17A15B3807054E510E9AC32F65C39D4D0136ABF6A2C00D346B8F9BBEEAC75617CE5726E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719999, "uuid": "93bdeae3-6296-4221-9ac7-1d1ca934f04c", "value": "12288:rSMpcpxyaS9WsrePCC1e/fSBWJz3Q3mBnJPyX:rJzA32yX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686719999, "uuid": "1f6a7564-94fc-46e6-ad3d-6a9a67bedfb3", "value": 879104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686719999, "uuid": "e645d597-3ab6-41ff-9cc4-3887cc00ff00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719999, "uuid": "4aea4b27-d8bd-4c6d-af9c-2bbb1a8d543a", "value": "42383ecb24626a5a37ac625c1e46bd32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f24bf6-0b0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686786565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786565, "uuid": "2892b6d3-e787-49dd-bb75-eef33cdc1ca2", "comment": "Malware payload", "value": "e983b34c51dd6ac03a301e95409690ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786565, "uuid": "5a8c5cfc-53d5-4e0c-89b7-dd63a459f095", "comment": "Malware payload", "value": "07109ec0f36d15537a80c566875fcbb482f1057104ed0669bc77489b1b2e3bb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786565, "uuid": "b210260f-30e5-4715-9687-80c02ed7fc29", "comment": "Malware payload", "value": "c7f4d44002706b22e3c5131e8a1ba3b1836ccf1f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786565, "uuid": "fe81790b-47d1-42c1-ab69-6cb03d1a0e20", "comment": "Malware payload", "value": "25f39d79548d30bca9063106ee5017cb3cb9944f244b2dce59048a3eb667c0d0102f045bb0b0e18635c0da3eb4bba31d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786565, "uuid": "4ed57fef-5086-4c04-ab33-268820e30f36", "value": "T18A54E02372E0D8B2D465A7318C39C6E46A6FF8F25F7426DB23581B3F1E322919972351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786565, "uuid": "b4cae5d7-7f6c-4dc0-83de-b1bb9bd864b5", "value": "3865ca37561d2aa29b9e83d3d87488fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786565, "uuid": "5843f418-73c5-42eb-859f-68c5255f6feb", "value": "6144:Uj9TQSTO+pwp3hVtJDnELYYB1OSFBtcpSA5Fv:UZTQx+p83hVtJDnypOSXtOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686786565, "uuid": "7512b2b9-b92b-4ca6-b501-4a1e4b4ee2de", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686786565, "uuid": "699cacc8-ca2b-4f04-80cf-7d5de619a474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786565, "uuid": "5caf4c7a-8cb9-4d7d-82f2-9e6ebc6c1213", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0824b9ef-0a6f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686718248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718248, "uuid": "e6eeae39-e205-4544-8e23-a1ab307e467d", "comment": "Malware payload (Mirai)", "value": "362a6846259ca5151e02bd42da5b7ab9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718248, "uuid": "06d49bb3-4a53-4730-938e-31a67669a5d8", "comment": "Malware payload (Mirai)", "value": "0719bba362295ee1c14c4907515d5039c03365d25463153798b41f521f91efb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718248, "uuid": "e78f3ff6-84a9-4e57-8917-cc98c5bcfbdc", "comment": "Malware payload (Mirai)", "value": "05f83aa755986fced03b6e6fd734f0b3a543094b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718248, "uuid": "e2ddc437-35b7-41f0-a25a-13d28c06218f", "comment": "Malware payload (Mirai)", "value": "d815e03742485c9f567daa0eda5686f6d180e004f323d1c49120846e2134cdf15b38e1700dd668f58363cf1699511cf5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718248, "uuid": "76a8032d-5982-4e70-9a02-3691aabf30f5", "value": "T14E632995F4029F3CF88BD6B990170E05B921639057D30F2BA6B6FDE37DB2068BA25D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718248, "uuid": "902d84f3-d25f-431e-b23b-b8de6929aac0", "value": "1536:q2gDyZk+B1ssfkIl8Ok/zoJWnXKtnzXNO:q2gDb+Hdfpg/BXczg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686718248, "uuid": "f72fa162-8fd7-4ccb-b890-9fbb33d40dc1", "value": 72328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686718248, "uuid": "36c6acbd-7a21-40fb-976e-dc7ea1a87bb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718248, "uuid": "9e363277-2484-4b91-b919-73a5bc2ddc75", "value": "362a6846259ca5151e02bd42da5b7ab9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec01c9d7-0a85-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728080, "uuid": "a700a576-ab9e-4646-a4ec-083961f1fd8a", "comment": "Malware payload (Quakbot)", "value": "e62d92b79f46be853a4f96cde1f07917", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728080, "uuid": "3f3d7b8d-b1d1-4171-bda8-129b492373e7", "comment": "Malware payload (Quakbot)", "value": "0787387747384f631c0a746905175f19f71d462cfb3cf432d69cf92ff90953e3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728080, "uuid": "297071d2-be0c-4627-9665-467e42ed2eaa", "comment": "Malware payload (Quakbot)", "value": "02a1c115ed449e705d9877494267259e1afae266", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728080, "uuid": "930351d4-bc3f-4abf-9cff-f8db40a132f6", "comment": "Malware payload (Quakbot)", "value": "d20e1d317fd29296696f477c2e54f5a88a4fd683618b8f5eced235b4e14e3b124214cf76e1b1edbae0cada376de27398", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728080, "uuid": "cf16ea53-143f-4711-9854-e1722cc17fea", "value": "T1887431896645E0F04237F33BDE578010FAAB1E5B20848932B97C515D6F3D8697AB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728080, "uuid": "ffc6ed93-9476-4c7c-be20-1087ae90c224", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbI4zgoFesAdrd367zhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728080, "uuid": "50291c63-5a79-484e-a57f-b8fe0ec1b95e", "value": 351974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728080, "uuid": "b3978632-60d6-433c-9ef9-eff2e8df5a45", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728080, "uuid": "c850eeac-cd02-4fe2-aebf-5a9d61613ea4", "value": "f3NjGJVIKJVsr.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d59613f-0a6e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686717935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717935, "uuid": "260e0ced-a7a3-4ecb-a7e4-9a3eae144401", "comment": "Malware payload (RedLineStealer)", "value": "d23e90866d2d1bcce313ae6d793c5b17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717935, "uuid": "fc0f335a-923a-4e69-abdd-36c7215a83a4", "comment": "Malware payload (RedLineStealer)", "value": "0871bd3afd1a0b5cc15b3dae103e3519235ebc9f9beb229bcd7f8103f65cdb91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717935, "uuid": "327a3811-e2ca-41fe-96cb-bc680895652a", "comment": "Malware payload (RedLineStealer)", "value": "7bee0e0c3b41884a1522f0d17b490f130710e0b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717935, "uuid": "ff035be1-86d5-4793-8a7c-1a97ca0ec949", "comment": "Malware payload (RedLineStealer)", "value": "14888ae1687191f5fa7f998e30ade3935f1a446bfe5553af0bf7da6f19e035ab5ac708969689b2ea3e121b8ebcb4f4fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717935, "uuid": "d1fb904c-8bd1-4b68-8018-1b94fb179599", "value": "T159052343EBE88077E9B2137444F703E31B36BCE16978972B37C298564833985663676B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717935, "uuid": "94a54af0-6067-46a8-94d5-59940abf46ae", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717935, "uuid": "12fecab8-4669-4571-b38b-6f61aa436bb0", "value": "24576:ay/AQYq/ls92NG1evEk3ZAcca2UlgxS1cqIcxxYre:h/AUlrvlcatjYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717935, "uuid": "26217deb-d5f9-4cc7-9886-c0234040dd82", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717935, "uuid": "cf7711fe-2620-47d4-b0f0-e59c380d05bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717935, "uuid": "1b81443b-4bdc-4e1c-97db-fd54f775fe95", "value": "d23e90866d2d1bcce313ae6d793c5b17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8cde6f8-0a96-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686735322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735322, "uuid": "cca2fcc3-ad35-4850-a384-e0007e0ecf8d", "comment": "Malware payload (Mirai)", "value": "91c52105105c8a470e5c5ff97a296417", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735322, "uuid": "f67e1e30-5457-4123-82e5-dc0aa2713425", "comment": "Malware payload (Mirai)", "value": "0873c3c119f8bb68f1e44f353094882b672e8bbf82ebfbb0a4caeeb427c22fbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735322, "uuid": "6078ae2a-f789-4492-9ff9-524f83493b34", "comment": "Malware payload (Mirai)", "value": "1d911d2673948eedc4c5cab79b6eb9394425a776", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735322, "uuid": "ca1f3e79-29f3-4439-ae82-1befc79e1a9b", "comment": "Malware payload (Mirai)", "value": "57d47ee6408a4d55bda08053e2ffa88c013257ef09dd8176e4597f17030b79a5671d616890febc08cc48b423c85388f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735322, "uuid": "00df4cf2-e298-4e71-8d11-b16d5b57189d", "value": "T1D7732C723B650A27C5F1553C90EB972BF3FB47891834812B7A911E4CBF999A03193BE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735322, "uuid": "39265fa1-cd06-45ae-940b-73ec6750f997", "value": "1536:lMtmq5+UhAgok/SUyAVv9Ks4OL92l5sdxt/+DQF:lTmok6UyQvB4fsdXHF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735322, "uuid": "6772aad6-1d27-40cc-b061-cfe9980cbbd3", "value": 75376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735322, "uuid": "4f702f31-f9d9-45d8-a244-341a852e2596", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735322, "uuid": "9d480ac3-3503-45fa-b313-d00ab4e4d7fa", "value": "91c52105105c8a470e5c5ff97a296417", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4de64e-0a6d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686717745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717745, "uuid": "b552fd28-1f32-43a0-be39-3361c17c02b9", "comment": "Malware payload (AgentTesla)", "value": "0cd65a45399629c15e2038c1bc0cd3b2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717745, "uuid": "59b0ea51-4ad0-46de-93b8-90df22eacb6b", "comment": "Malware payload (AgentTesla)", "value": "088cdf847f505d47e52a6d6b968e653a99b97fabd3d89a981d57883f493404c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717745, "uuid": "0d573d82-2045-4ef4-9fd2-1b265cc62bb3", "comment": "Malware payload (AgentTesla)", "value": "de16663056de036f648e632e322d343f21a03085", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717745, "uuid": "4c7c93ae-b274-497b-92a8-f19463e36b60", "comment": "Malware payload (AgentTesla)", "value": "5a1370791cbd14f3ee87c33cdbbb2330e4bd75a253c04014fa2ff4abdcd32ac9ec12e17849fa5b05c122ef097946e600", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717745, "uuid": "0b387a2f-19e3-46c5-b9eb-6206ce14dfcb", "value": "T156850121F1965C3DEA868B3895E3305A851E7C273D8DD8052246372E7733BE2EA7364D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717745, "uuid": "784400d6-7224-4c83-9d02-293f99479ca2", "value": "49152:WuCfcYIH3uzg0AacYI4ntqns8ZD2oI+6/P:WjIH3gySI4nsnEXb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717745, "uuid": "c8cc7265-459d-4f7c-af36-7d9d2f12fdcc", "value": 1740288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717745, "uuid": "96468264-2205-4f7c-bc21-006a272c1304", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717745, "uuid": "cbf2d636-22ab-42a7-b7d1-218100b18986", "value": "INVOICE.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac9f019c-0a7d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686724537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686724537, "uuid": "0e3bae11-1c1d-4e49-a61b-1a6a46b55911", "comment": "Malware payload (RedLineStealer)", "value": "189e1f3b84a8affadf56358e5db5f121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686724537, "uuid": "b08e552d-e597-45f7-b3f9-b441fd83d3a2", "comment": "Malware payload (RedLineStealer)", "value": "08d35da19df385f60fd842308a6c0f7c84eccc8dbcefda02e7c099939e1a8b36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686724537, "uuid": "968a5649-637e-4873-83af-c62708e96537", "comment": "Malware payload (RedLineStealer)", "value": "821ab22445c6702afb91077a836c742934cb83ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686724537, "uuid": "17aadfde-756e-4af4-aa77-20ae77ecf850", "comment": "Malware payload (RedLineStealer)", "value": "f08b269af331653eb71011a15285dcb882c2d78a896516546b02a3e559a9880fc5e217891403ad574543a749325fcfdd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686724537, "uuid": "7fe3b4f7-bce4-4e79-82b6-39c3a28bae3d", "value": "T14A051243B7C98073DDB22F7069F613831B3A7D919E78462B1645681A1C72AD8ED3236F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686724537, "uuid": "761c9a0f-664c-4589-a206-0d3b982fd209", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686724537, "uuid": "2399a67b-44e9-4a45-b76a-cb716dab4042", "value": "24576:ey6isjTi+yKsJNB2LoWCUKlRFaRKIMjKO:tAjTVyKsyldK/FaajK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686724537, "uuid": "56d17c72-dbd1-4410-a674-bf448f016b21", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686724537, "uuid": "409a3847-93c6-47ca-a563-b407c8d116f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686724537, "uuid": "534f5651-ad4b-42c2-8498-e6a6fadb514b", "value": "189e1f3b84a8affadf56358e5db5f121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "639fd59e-0a9b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686737300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737300, "uuid": "1f1026cf-7863-486a-9f87-7ed0315b1e20", "comment": "Malware payload (Amadey)", "value": "83fc14fb36516facb19e0e96286f7f48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737300, "uuid": "beedbb75-a0c8-452a-95c6-5f2e7ec592b8", "comment": "Malware payload (Amadey)", "value": "08dabdd0b0fb13d5d748daf1173f392aa27eb9943eef78bd29e6a8fa61007a6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737300, "uuid": "395a8805-18f2-4b04-81be-89d20bcb07ee", "comment": "Malware payload (Amadey)", "value": "40082ca06de4c377585cd164fb521bacadb673da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737300, "uuid": "dc0f4698-89a6-41a0-9b67-a7f5fb957cf9", "comment": "Malware payload (Amadey)", "value": "4fee6dd6a2191dc06c243e990e14db45671641b9bd8be8d48327957ab37bcfbf3fe83a0bc4112198fb27a7983563578c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737300, "uuid": "b1916723-7c4b-4b48-bbb6-fb51fe989d4b", "value": "T15C936B1030D2C071D67E55351878EAB68B7DB914CFE08EEF27551A7A8E702D1AE32D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737300, "uuid": "2c9b6231-8d54-4855-8142-1313a47fd5d8", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737300, "uuid": "ed071c7e-b489-4a0f-8acf-e3743bab0705", "value": "1536:Uo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUGNaB89p:UoUCWbBNpplToUs1uNhj25LJU6aB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686737300, "uuid": "f15cd763-d401-4395-9ca9-e245c803438e", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686737300, "uuid": "30a4635c-948a-4f68-8dfe-77fa7347ba93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737300, "uuid": "240d57a1-60dc-4f41-b230-a6fe08bb7a8b", "value": "83fc14fb36516facb19e0e96286f7f48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cc72109-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728323, "uuid": "7fe5b2f4-617c-4817-a358-e39169c0b403", "comment": "Malware payload (Quakbot)", "value": "6fb4585a81c390778a01ba30cd6abca4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728323, "uuid": "af651c41-90ca-4044-9e95-deffa56d9f47", "comment": "Malware payload (Quakbot)", "value": "08fcba4bd4294f71d9703bdfde10ef905083c55eb4288959983ed7e7dd2b0d18", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728323, "uuid": "4e6dde3b-005d-41d8-a739-b32121ce42a8", "comment": "Malware payload (Quakbot)", "value": "8625bcae9e9ce48be09a32d5b023a8f58fab3849", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728323, "uuid": "7bdf9de6-b662-40e1-971b-02d09bbd5273", "comment": "Malware payload (Quakbot)", "value": "d8995f1f91c87e2d578313c3feac4112a173e9993b4a9f3215d2384ad63037a59e210b13991726cd30d1e31693eab234", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728323, "uuid": "0fe9c810-3202-4b1d-9587-1aedd3d90c86", "value": "T1AC7432856A55F0F04037B37BCA179450FA6B1F1B2184C932BA7C505D2F3D8697ABBE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728323, "uuid": "d4e84e8c-e856-44aa-a1f0-afcf3e08a4fe", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbobU1wxwrB2hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728323, "uuid": "5eb7c44e-b4fa-4d47-8014-42a37ed8fd68", "value": 339550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728323, "uuid": "d934abfa-f40a-48c1-af1e-38e5a5677bd5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728323, "uuid": "d3356722-d320-49cb-9e5f-cc78259cb889", "value": "ZOTRrwJXjmtfwZ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1410e8e3-0a7f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RecordBreaker)", "timestamp": 1686725140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725140, "uuid": "cffb814f-a45f-4dcc-947d-8fe0e5f1cf9e", "comment": "Malware payload (RecordBreaker)", "value": "abcc86bf00fe60fcd4370ae91927c915", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725140, "uuid": "a0129cc1-0ca8-4932-8400-fe69a05dc811", "comment": "Malware payload (RecordBreaker)", "value": "0926d34feb430c936dafe0152ea5b130047767da1e0aa78d20b13df50670ffb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725140, "uuid": "45331a8c-e0a4-4865-84cd-891818302e52", "comment": "Malware payload (RecordBreaker)", "value": "0798388092a66c4e4c01b50bb982cd3a03aa2abc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725140, "uuid": "dea8403e-38a6-46ec-9e3e-a1a3a6a1c99c", "comment": "Malware payload (RecordBreaker)", "value": "aca6b4bb7ac50e7e69111eac0ba9bead461211fed36b88fc17381dabc904b0355193b7b549b8d38b3236f41cd6918cc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725140, "uuid": "9330bc3b-ffd3-4505-b715-ea68f69c21cc", "value": "T12B07339738CBC1F4D9C11870CE0B29DB13B36DA98E8585287AC5358AD5F1FB3507ACA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725140, "uuid": "bb99d492-0fdf-4139-9a25-20b74f55e6be", "value": "fafeed772601714ec4fde701acf5a08d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725140, "uuid": "c257303d-9a3f-4793-ab3e-c3de691c70ff", "value": "196608:L9gL2PvTsZ882g2F65Blp+FBRiAeyn6lGf80pfIRerD/D3atj1+lwGIi:K+AZ8YfQFBRiBY6lMpwRerD/DKxQwGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725140, "uuid": "bcc73655-1c49-4489-ab8b-296f4509c4bb", "value": 17335808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725140, "uuid": "f6b10999-d8e3-4dd7-ba98-d3a86e2da3a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725140, "uuid": "ca921024-3822-41cb-8721-dae83a9387e0", "value": "abcc86bf00fe60fcd4370ae91927c915.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b94e5f7d-0a5a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686709526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709526, "uuid": "752c9d7a-2184-4213-ad63-f36ea5fc90aa", "comment": "Malware payload (RedLineStealer)", "value": "d1df30c028ebba38b2f3d799169f1908", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709526, "uuid": "e7a299b1-fa7e-4fe7-94ec-922f25baf753", "comment": "Malware payload (RedLineStealer)", "value": "0949ad6bf2c4b3bf494f88d16973650573daa32580f34981b44ef461ad08aac0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709526, "uuid": "a2fee514-b7ff-4b5d-bbfc-141aad3fed2d", "comment": "Malware payload (RedLineStealer)", "value": "ccd153558ed89a2faf0cedc8cff31f9eeb0ee160", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709526, "uuid": "2b2df719-5f12-4bc6-96f1-265658ae3be1", "comment": "Malware payload (RedLineStealer)", "value": "7866f882a3080592de98e0a0f0355485752e59d73c0a6def34a1fc213b97c36890c9eac89258d8561f66ca31b7d0e6fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709526, "uuid": "36fadd5a-d017-4b72-80bf-9de360861fa3", "value": "T1B705231396D84573E4B82B306CF712931A3AFCF65DB483563B41989E1CF2AC4A4357AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709526, "uuid": "f9074990-d527-4c83-8710-1036dc2afff1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709526, "uuid": "f11cc718-3a65-4097-98ba-095ab9e8bde9", "value": "24576:TyGSy0aKDv5mp9FWmKAnrUTKTl+iqaTakexkYe:mG/iRmpWmKAATzP5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686709526, "uuid": "405a613e-c7d0-4ab3-bf3a-3fbcf5f8bc72", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686709526, "uuid": "70fc0af3-6ff5-45b5-86b5-7729e64a5907", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709526, "uuid": "49151bf4-bf8a-4e52-9f3a-f1f7a868a9b9", "value": "d1df30c028ebba38b2f3d799169f1908.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "003a86a2-0a51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686705350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705350, "uuid": "07068a1e-a975-4096-87d4-9681842fc7a7", "comment": "Malware payload (CoinMiner)", "value": "4df8da19fb1a9a3697e0eb6c3fa50505", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705350, "uuid": "b240b12e-0ef4-4691-96a2-acad033a9acb", "comment": "Malware payload (CoinMiner)", "value": "096e104dd53a1aee1532ea8b52201360c3b85f664b8ff3d2242fb61b97c1c3d7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705350, "uuid": "dcc4fe62-b344-4be4-a5d1-238c307e1729", "comment": "Malware payload (CoinMiner)", "value": "50a1a9cfcdb31a2c9da235e8a51d1d7aabf5bb79", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705350, "uuid": "e55532b4-da43-488c-b58f-070910df6f7e", "comment": "Malware payload (CoinMiner)", "value": "769855248213ae3376937fdd99781f5778a509163eb8d806926bc04fb127b81d74c371b8191f70cc6f8121e946a51984", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705350, "uuid": "74fcf150-b879-47ad-ab73-ae4ef656f112", "value": "T189B5334D5A5D4B3CDC962577C887C2399374DF2E6F13E22E368C436C29AA36258FD092", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705350, "uuid": "48c3d505-0d19-4cd1-8e38-481a6f909b80", "value": "49152:gOaIyWpBvRfs0yyDCLyWwFauRhVrT2BzROeu9ku/Rfyf3mWqPR5M:gpBYBls/LyzFaujV2BtzuZ/RfyJM5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686705350, "uuid": "5b3c8a02-4be8-4570-a7a8-fe78ec9f3d8f", "value": 2483712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686705350, "uuid": "862d177f-c82b-46ad-bd60-30c31cf429bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705350, "uuid": "542dfd7b-6013-49a9-b4b9-f4d0b72a7a0a", "value": "crack4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f105fd94-0a50-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686705325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705325, "uuid": "5f7f2273-aec5-4b67-a88e-2adde70c9f4d", "comment": "Malware payload (Amadey)", "value": "db98f100709bec3bb5d4364f93155ffc", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705325, "uuid": "2768a413-e27a-4483-b00c-7fd6f3908ef9", "comment": "Malware payload (Amadey)", "value": "097732716b5f176fa3dd8e77519be569e243d2469c7988bd6167c1c0d7e2309d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705325, "uuid": "c1ed6294-6823-4d44-9e96-6c0d21810a66", "comment": "Malware payload (Amadey)", "value": "d53cb671bfdb7aa8a588237b04d761d42b969264", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705325, "uuid": "f7916834-7868-4e29-b67a-ca5e6052299b", "comment": "Malware payload (Amadey)", "value": "db16affa47c474bf4658a3ac63696c419e5ef7c797ebca2d3840b67d2a1537198059de3890a86dff9c11d9b12544836f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705325, "uuid": "37e118a4-19d3-4d7f-b9ad-1eaa41e68745", "value": "T124D41203AAD8A433D9B567B069FB02C30F39BD549A748B7B7B81651F1C72295E032367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705325, "uuid": "9c7a69e3-eb64-4ac9-a328-24c8f64055b2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705325, "uuid": "7895146e-2d92-41bb-a6bc-c2027e149c28", "value": "12288:nMrpy90aNE2aH2q9Yl+wbtmhJZb2EsL3UCqLPW178sOBYhO:2yRuHbwbtmB9s7Bjdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686705325, "uuid": "7e3cd67d-4a1a-4383-a677-892a0931a4cc", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686705325, "uuid": "f30522bf-a17e-45d3-b80e-520e4717d19d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705325, "uuid": "3229fbe0-5675-4f7f-a1c0-a5985f5a158c", "value": "db98f100709bec3bb5d4364f93155ffc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3ca88fc-0a6c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686717328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717328, "uuid": "758f8f47-6514-452c-8907-94852a164cc8", "comment": "Malware payload (RedLineStealer)", "value": "c98e3f90bf9c1b0000a633b2dc047746", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717328, "uuid": "4e154bb4-7234-48bd-a5be-120807a9a3f3", "comment": "Malware payload (RedLineStealer)", "value": "0a9668442ba25c144be0efe0348d32c9376af8d5729741eeeaf9dd4ba4a41099", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717328, "uuid": "279c5806-5fd5-4459-a3dc-f0b437d7a68e", "comment": "Malware payload (RedLineStealer)", "value": "14a5f9de6c980a894ccf24f7ee990b6f621a7c4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717328, "uuid": "617a8702-2b46-4af3-b607-b5ab08593866", "comment": "Malware payload (RedLineStealer)", "value": "8c485da2764452e790e957ec5b3724da8d712f4c6ed9d65ef43286815350bff2a47a02b637dd4716f3214af250a312d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717328, "uuid": "d3edaf66-88d6-44a4-8add-b0ea16578023", "value": "T170052203EBD4E432C9B1233019F766831B3D7D689DBC9B6B328658464DB16D0A97273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717328, "uuid": "95bd7573-5b0e-4715-bda9-7c41407ec9e6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717328, "uuid": "fb4353de-f30b-40d0-a8dd-153447db29d2", "value": "24576:0y/Uvf73eTRnDfHpIHCNXwvh/AhfmOr6q:D/gfjMRDfHpQ5/ARD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717328, "uuid": "7ba6c5fe-12ab-49f0-b38d-4d3ea7374f2b", "value": 795648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717328, "uuid": "a27903e8-218f-4452-8c16-d4af6ce7290c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717328, "uuid": "876a800a-96a4-494b-b40b-c54c6f9de8d9", "value": "c98e3f90bf9c1b0000a633b2dc047746.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f394c9b3-0aeb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686771901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771901, "uuid": "6369b1eb-1171-457d-a682-7d54b0d3c1fa", "comment": "Malware payload (Mirai)", "value": "d5019f691feb1c784c38d5c426ea1445", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771901, "uuid": "7c70dd3b-a827-4205-a229-7b73714a9630", "comment": "Malware payload (Mirai)", "value": "0aad70b73e6ab612135f8be3336f33c96bbe9a21bf1638a520458bc1f7f0fd17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771901, "uuid": "b63ddbf7-e750-4b34-9161-0ed331bbdbd4", "comment": "Malware payload (Mirai)", "value": "345ccf33774923e05b8444ef553db7907f9a757a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771901, "uuid": "a8afedb3-6596-482a-9498-4f882c0cb2c0", "comment": "Malware payload (Mirai)", "value": "d943cf6b7d1d792f0bdb25796ea61fc000d53779a147e61a6ad3c0aca57d31176f3362a5c5b0afc49a6c3003888f8d53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771901, "uuid": "f51d5615-0657-44b3-b1ee-6f27e10e65e1", "value": "T148B2C0CC61543484C98D7C7C278D4A674F68A190BAEDCF26E350CD98B3BEA8B345D079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771901, "uuid": "a51ecaaf-c1b5-45e1-a143-b93488473248", "value": "768:oCrQlS07dEv0UXqUhvQE+CXQKMQKCXBpnFZqEWvd:/QlS07FUXqIYSXQKqu7qH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686771901, "uuid": "24162073-3d79-498f-a3b7-7e150a8ae703", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686771901, "uuid": "c7309c9b-751c-4deb-a8ed-efba41db1c6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771901, "uuid": "1449f959-e9ff-4a35-8bd9-3a2c24d678d6", "value": "d5019f691feb1c784c38d5c426ea1445", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8718a7-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728399, "uuid": "b7f80811-f2e6-45a7-9e42-eb2cd9c78008", "comment": "Malware payload (Quakbot)", "value": "700e1b1cd584344193811336f5d23ebc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728399, "uuid": "8ae884e3-feaf-4c03-a984-4738a65b302f", "comment": "Malware payload (Quakbot)", "value": "0b2edbe7945b11330089f5878420c7e0ef42edcf1341bea57ee1c06913e98907", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728399, "uuid": "c70623f5-bc9a-4243-98ea-0cc0e716b876", "comment": "Malware payload (Quakbot)", "value": "2a4c76970b3210d7cdfdfb416578fa81e5da1f57", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728399, "uuid": "fe30f12c-bd75-4f1b-8821-6d2c1e7e0be5", "comment": "Malware payload (Quakbot)", "value": "32dc45b7413036d452a5c2a71213a950ac0f4ae2af55c646e1b302a3cfcdabb0842c1c0f347d06cba20d474e3483b7e6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728399, "uuid": "4853f020-ebc4-4c10-95b8-7462f7597222", "value": "T11F6454496A45E0F09133F33BCA578414FAAB1F5B11848973BE7C50592F3D429AAB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728399, "uuid": "acf423c8-292d-4905-9fef-2149c3422668", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbFEBiokS7hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728399, "uuid": "238e5a1e-1c5f-494b-8b21-8b4951b8b8d1", "value": 308935, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728399, "uuid": "23b1ff1b-f666-4d26-95da-ac40ee05a493", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728399, "uuid": "080d5047-ad54-4d6e-aefd-32bef3397e19", "value": "WMXKTSYYUcv2Y.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d8a335-0aa2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Phobos)", "timestamp": 1686740223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740223, "uuid": "615b5b39-d00c-42d5-9594-f6156a98f643", "comment": "Malware payload (Phobos)", "value": "d458a2f85bc1330f13acccd63d88d015", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Recuva", "colour": "#CEB8E8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740223, "uuid": "b589def3-93aa-4774-8f17-c1eab570ba17", "comment": "Malware payload (Phobos)", "value": "0b997e8b0d0ff6cc4e6f1919c6c0f3080eaa0d08c8fccdf50f7648bf05cca446", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Recuva", "colour": "#CEB8E8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740223, "uuid": "f5a73e54-af5b-438a-89bd-2fa8b0fa7ec9", "comment": "Malware payload (Phobos)", "value": "2604402597e41faa97db737fe0fb4166864752ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Recuva", "colour": "#CEB8E8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740223, "uuid": "6eefff13-5a74-4d24-b13e-d165230d87d2", "comment": "Malware payload (Phobos)", "value": "84e9a39269947403051bc6ae648eba63e1b7c62a3c77c6f958ba369eeb64d2444785a837fa40a404998702c566632ab0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Recuva", "colour": "#CEB8E8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740223, "uuid": "af239ead-4994-4075-8dbf-dd35e7cda696", "value": "T1B943B046B06D54B2CEB28570293A2F5F8FBE610500B484874F394E867ED5536E73937A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740223, "uuid": "0d9db203-f878-4067-b276-7e90351a5d2a", "value": "851a0ba8fbb71710075bdfe6dcef92eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740223, "uuid": "86a547ce-a809-4608-9fb6-c0686f2726bf", "value": "1536:hNeRBl5PT/rx1mzwRMSTdLpJ5mwnf+viID/:hQRrmzwR5JUD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686740223, "uuid": "8795d75a-ded9-476a-822f-25f88c836f6f", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686740223, "uuid": "e400359f-2910-4ff5-b541-3f18e0fb0605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740223, "uuid": "0e54d7d0-67e4-470f-904e-e19ce01d0d70", "value": "AntiRecuvaAndDB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9985d4-0a7d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686724536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686724536, "uuid": "3f613723-e45a-413a-aab2-5b60b0550236", "comment": "Malware payload (Amadey)", "value": "b48052f01fb04a5b44932fef5c3d63ec", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686724536, "uuid": "7e06bd65-deae-4b72-9820-f18d5e818154", "comment": "Malware payload (Amadey)", "value": "0badc0cef14dcf7836756a1fe1636b2843216d89b42da9bf09f63b86c513feda", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686724536, "uuid": "8f6f05aa-96a1-427a-a58e-6dc8d19d8dd4", "comment": "Malware payload (Amadey)", "value": "3cc360dcbceae9ef939c589580b371fbb73a720b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686724536, "uuid": "f95d315c-8884-4941-9e98-b32c796b1e0d", "comment": "Malware payload (Amadey)", "value": "bf4142727dac8716c16acc82dd455d9465513167744cbaf465225d9b12df34aa855908f306f0a9c500ff5ee26545fd1a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686724536, "uuid": "c154ad1d-ddbf-460b-973b-3980351e9346", "value": "T11AD41213BBE49232D8B1277068F713971B357C70897C87AB2759949E0CB22D0A5367AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686724536, "uuid": "cdee1a03-8a35-48ee-b642-623a82ee25d9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686724536, "uuid": "5c8103d6-6bab-4b1d-923b-c5a81d3a4459", "value": "12288:6MrHy903qkiFxIi1zF+IoN2I8HM8FFI4w3p5fFv1kC:1yLvfdHM8PI4wZPuC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686724536, "uuid": "fcc150fb-06c2-46ef-b5ab-1dfc584e5d64", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686724536, "uuid": "90958d3c-7f46-4c97-ad17-0f331ef22b10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686724536, "uuid": "cd538653-d96f-451d-9ef8-f711fbd6c654", "value": "b48052f01fb04a5b44932fef5c3d63ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fc1ca8-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728605, "uuid": "0f8e1b3e-57fc-4f02-bd21-aec8865cf9e1", "comment": "Malware payload (Quakbot)", "value": "f18806eba9ce88504f276623c196857c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728605, "uuid": "16186fa6-1139-4381-b2d7-c3fe57575bb1", "comment": "Malware payload (Quakbot)", "value": "0c21520790a4f916213684fcdd904aea5ce48528eb25843c7eafd8c9bd706f3e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728605, "uuid": "9832b937-5b13-4b9f-93d6-70ed65fbff6b", "comment": "Malware payload (Quakbot)", "value": "a76b7b5568752d281a73b068ed41c562645a6535", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728605, "uuid": "bee4411b-50d1-4a3f-aea8-8a5de9421d72", "comment": "Malware payload (Quakbot)", "value": "65593853bd851478b7cf59b1b372c5b67fe019cfee3690d28c9c3a0d04bb05d928c331156bc5f5a2eb8e384ff30849ba", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728605, "uuid": "831e290d-09c2-4d5c-98e9-ef75faea1b76", "value": "T15D6463896A45E4F59237F33BCA174454F6AB4F5B20848932B93C505D2F3D82C6AB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728605, "uuid": "c4cbd779-a133-4535-b590-56f63169f502", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbqRf86KQlnNhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728605, "uuid": "bfec0d1e-e5f7-4a7a-9128-bcd906c8fc27", "value": 327279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728605, "uuid": "a2f13092-5a3b-4e8b-bf53-8607daeb4eeb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728605, "uuid": "b52b5d72-8dbd-4285-9808-8f30431f93db", "value": "TqKHBCgB5vMUe8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7764ac92-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725737, "uuid": "9ab7577d-c663-471c-a572-ba0b011422f9", "comment": "Malware payload (Quakbot)", "value": "a73cc914275f45ef8908df5e2c61b140", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725737, "uuid": "901bb01d-88ba-498f-88b3-299e08682627", "comment": "Malware payload (Quakbot)", "value": "0c9bd2cf68a473bf39a53f353fa5ac5f70995001cf388d4a410b49688713d3f7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725737, "uuid": "86dd45cb-dc27-4ee7-81d5-c2434fd81120", "comment": "Malware payload (Quakbot)", "value": "ca4ff7bd982e5e52dc99bc12a3a60b11120adff9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725737, "uuid": "820a5a36-2aaa-4922-aa74-fc346dab5e0d", "comment": "Malware payload (Quakbot)", "value": "5088cc9572270966e13991dd0ef658627a60c6708930a7317c35c0ee75b432d8ee61841173944174858706dd3474daa5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725737, "uuid": "0be1d84f-0c26-4b97-8f29-abbdc52e4778", "value": "T1B17453856541E4F19237F33BDA178420FAAB1F5B20848932B97C50586F3D8697EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725737, "uuid": "6b162f2a-83b6-4668-b3c5-f03b5511107f", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbUkKYSETU/Sd1giMeecnngql:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725737, "uuid": "3fa7e5d4-9fd6-4937-bc00-042e6bdead1b", "value": 351652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725737, "uuid": "f1c34705-3447-40c0-aa94-b231be6a0c16", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725737, "uuid": "71ee2057-bd05-472c-b511-c3443a42ca29", "value": "ltFP49RtVuvj.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c79f5ea-0af2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686774681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774681, "uuid": "f5c5d0d8-0be0-484c-8b31-9105b1c65db9", "comment": "Malware payload", "value": "d78a55e7632fb29f8864d48fab068b42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774681, "uuid": "0aa6882c-bf80-4810-9123-853750f9111c", "comment": "Malware payload", "value": "0cf149d5084c5f68f95c0ba03adcb3c9ca8b89fc957e12bde19602c6f3df0786", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774681, "uuid": "f412d68e-e39a-4d92-b2fb-d5b1727d59e9", "comment": "Malware payload", "value": "b0ef16034c8f016b5a5b867d1b67573b9a0cb770", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774681, "uuid": "29f0f65a-da95-40a5-894a-f0d8197b587e", "comment": "Malware payload", "value": "759e480436d4e7d87762349736429e52c278e8ac36efb5752f2f00498711702f9a7969fdc4d5f07ef7e16455fe6231af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774681, "uuid": "1ea1a36a-ae2d-4435-854a-fd2d13d5d50a", "value": "T15283A51E7E228FADF76D823147B74E25A69833C627E1D641E16CD6012E6034E641FFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774681, "uuid": "a9b153c8-9313-4779-8961-e914f3342f6e", "value": "768:2ty6IP7M/kq0INRhfuN2Eo9tl/de2YIwHKRH0I84EH6UTC7ZDYovZ73x/nL8y8Qs:Rakdn2Eo3ePu5GTCRYo99Be037Wp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686774681, "uuid": "749b26ac-362b-4190-a917-22b8a74b7fbf", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686774681, "uuid": "06f56b6f-4d19-42e2-9b3c-d109fb4fde00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774681, "uuid": "3c31778f-9562-4d04-b328-ab814ffbb6a8", "value": "d78a55e7632fb29f8864d48fab068b42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdacefa5-0a85-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728109, "uuid": "7f57dcb6-397a-4987-a240-7f66bf7e4789", "comment": "Malware payload (Quakbot)", "value": "bc3fdb7200fd74ee7e758067bc18e6cc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728109, "uuid": "93b50d48-4516-4b9f-8442-f98e8c1c619b", "comment": "Malware payload (Quakbot)", "value": "0e00ded5f9ad6662d955770f086ae1ed52d0eaac9375c87f9ca0e2d2ed2145cb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728109, "uuid": "c1e380a5-29f3-495a-995e-9ca20067d063", "comment": "Malware payload (Quakbot)", "value": "032e6e6a6cc891737d3b86aead467b2aa4c242be", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728109, "uuid": "66b3a772-d121-4008-9eaf-259f6f6dcf45", "comment": "Malware payload (Quakbot)", "value": "d0c19c44290543f0839c202d224ebd8ae6679d3d8135ac9c69c923932a888c2bd2cf76e2d587adfc84d73460ff6eece8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728109, "uuid": "d250f781-1751-4910-abc3-32b531145e4f", "value": "T1F77441496A56E0F15237B377DA178010FAAB1E1B2084C972B93C505D2F3D8697AB7FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728109, "uuid": "34d1c00c-7c01-45ac-a1b2-96c2d4b7897a", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbtVnWyKVwhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728109, "uuid": "7370b5e4-79a5-4994-bec2-0ccfe6cab5df", "value": 343142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728109, "uuid": "4bc4655b-493c-4ed7-946a-6140354614a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728109, "uuid": "009dcb51-c879-44ef-b96d-a5b3284ed02a", "value": "eQRceHliSaMJD.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b390dd4-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728803, "uuid": "af4ee84f-bc41-40f7-bcdb-25ebdab23c38", "comment": "Malware payload (Quakbot)", "value": "891d31d117f34198472a715f6c3d06b5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728803, "uuid": "11d321e7-6d7d-4878-a833-44e06fae615e", "comment": "Malware payload (Quakbot)", "value": "0e2c3e6d62c9a7aa6af1ebe5f83d3fb9a5bfdbfb39fb17bbff0040137907ea2d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728803, "uuid": "463ba630-1460-4d1c-beb6-94fe60ec54c2", "comment": "Malware payload (Quakbot)", "value": "a369ee0a196a014248d4417a468158e1352555a5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728803, "uuid": "e3690a99-59a4-4876-acf3-01ed18c0a71e", "comment": "Malware payload (Quakbot)", "value": "a9880ef11310e60b147e5fa19ce5982067ee0e22cf04a55b95cdb5eeb6751dfca9b8bcc6de65ca3cebf8d6a4b0906f4c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728803, "uuid": "26aa59dd-3fbe-46d6-af47-4e24f2c6e684", "value": "T120742149AA41E0F05237B33BCE178410FA6B0E5B20848936F97C51585F3D8697EBBED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728803, "uuid": "fc96c1c8-0f35-4eaf-8dbd-9b3a74bc19ce", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbByP3DaeqrZR5hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728803, "uuid": "e0977a22-c3f5-4c4c-bcb0-f22deae74d1e", "value": 339498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728803, "uuid": "8ac39558-5680-4aea-a912-db39ca6c5a7f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728803, "uuid": "4aafe073-0507-4a73-b0f5-2b95b4388b09", "value": "OqUIsNV9h8Ya.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e2b5c5-0a90-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686732445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732445, "uuid": "fe663c33-7bbb-4ec3-9b09-0585a113e250", "comment": "Malware payload", "value": "06f8547d6dc1da65ea814855871ffe90", "object_relation": "md5", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "norominis1-com", "colour": "#1D41F8", "exportable": true, "hide_tag": false }, { "name": "norominis2-com", "colour": "#2E5F77", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732445, "uuid": "3b86b2ca-5b8e-4895-aa86-1d1b3ab2f8c3", "comment": "Malware payload", "value": "0e4de26a4958cbbc2b761a4d1950de41453397059f4cbb033b6fa541214055c9", "object_relation": "sha256", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "norominis1-com", "colour": "#1D41F8", "exportable": true, "hide_tag": false }, { "name": "norominis2-com", "colour": "#2E5F77", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732445, "uuid": "a47ea352-54d8-4ece-a307-a2b0f539e32b", "comment": "Malware payload", "value": "5e019f7b756e795426e670fc879d90edbda03ccc", "object_relation": "sha1", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "norominis1-com", "colour": "#1D41F8", "exportable": true, "hide_tag": false }, { "name": "norominis2-com", "colour": "#2E5F77", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732445, "uuid": "c832dc9f-7b3d-4c7a-8364-7d0e6b45746b", "comment": "Malware payload", "value": "2c263d4098a3722bd627685f209e28fcbfc05c548fcbed0b0edf290487f078cad7c2aec444b2f25e87f0fb9d7fae4f3f", "object_relation": "sha3-384", "Tag": [ { "name": "client32", "colour": "#B57C4B", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "ini", "colour": "#995D98", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "norominis1-com", "colour": "#1D41F8", "exportable": true, "hide_tag": false }, { "name": "norominis2-com", "colour": "#2E5F77", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732445, "uuid": "fc583eb0-2029-4613-9aaa-785edc0be4ec", "value": "T146110012664BBE5D192BF3CA377424902FD38100F09D39229754590FAF3287E49DF8D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732445, "uuid": "727aa87f-11cd-4306-b5de-8d107041c890", "value": "12:XAx/vONhz7q+mPXjxGSGpzWVTXuZ7/PfY837GXoKIDWUpYL7XBGSaCYubluJEGR0:wpOhzZmPTxapz1l1yXtIDJCPBmuaVRzo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686732445, "uuid": "22ba9e77-918e-45d0-aa49-51d8556237bd", "value": 916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686732445, "uuid": "77da1ddf-88c2-402d-9c77-5752159876ad", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732445, "uuid": "7454e70c-325b-4418-a380-30b9dba41ceb", "value": "client32.ini", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676248e6-0a6d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686717549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717549, "uuid": "ef3095a7-8654-4741-91a3-7dad3b1677ee", "comment": "Malware payload (GCleaner)", "value": "4a22ea757a426fd31b50ae30407e6f22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717549, "uuid": "f3bac6b6-fc78-4ab9-bd15-78e194aa6c94", "comment": "Malware payload (GCleaner)", "value": "0e7e6473a8a924640088dea5df76adcab081e2c6e01ca674d4df54c5a80abee3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717549, "uuid": "315601fd-bac9-46f3-9a96-774ed87bc88b", "comment": "Malware payload (GCleaner)", "value": "0434a1ea2d0bfc151a36f54e5045e796decb6b8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717549, "uuid": "a119cc15-9e8a-48a5-9e24-b4609e3efbdc", "comment": "Malware payload (GCleaner)", "value": "1c7f8293294e36953ef5ac292ebf458aee56e21eddee7d1ea1c2d0b704ec14ba75ee84ac06c486c7592e739d5d397daa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717549, "uuid": "84c3af95-96e1-4eda-b8c9-097723bb2686", "value": "T1EC44D0613DF18836F2FB65304871D6A52B3FB8736A71858E3BA026695E327C19E30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717549, "uuid": "cc362612-c47d-497a-94aa-7985c3c5672c", "value": "293e47a0cfedd1b59c93e4a7e35003a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717549, "uuid": "6ab43acb-e1b3-4f60-a8d3-1be5812ddeb9", "value": "3072:dRF+MBHhFOILMxSW5fKLTi7F26+Yl473H38dGTrwr4pfCwXWNiTD5AU/DemS:BBHhFISWxKLxxA4XzTcrzyWLuDB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717549, "uuid": "3bdd72cd-2d58-4290-9e65-09fb7f299e30", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717549, "uuid": "391f9f3e-fb6f-4324-bceb-18dd772799cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717549, "uuid": "b4444c2c-edc9-45d8-b024-237950cb4bd7", "value": "4a22ea757a426fd31b50ae30407e6f22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9faf205e-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728811, "uuid": "83b484b4-a2e7-4bbf-853b-730dc564042b", "comment": "Malware payload (Quakbot)", "value": "a6cb97975df7dfa00c8a953f55f27809", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728811, "uuid": "47d7c3e0-6a48-49aa-a105-46b489eea1ea", "comment": "Malware payload (Quakbot)", "value": "0e8c06b0ceceecca29b95c14087a277ca66d8e0af6e49dcba8f588de5b98ae11", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728811, "uuid": "ea786034-adfd-4e49-9069-299d18fd0fd3", "comment": "Malware payload (Quakbot)", "value": "8476d7371608cbb7fadddf494291ab2bde1e93eb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728811, "uuid": "0c86af0c-2ee9-46fc-b10d-4c7f850064a9", "comment": "Malware payload (Quakbot)", "value": "27dd32f70e5b8cfcb3c82308f7d53f1066cae36d0baae679e43567f641cbe11a02658f582f2bf79ead875f0777fa7854", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728811, "uuid": "dcd3b446-ea6e-4389-bce3-5b83697dae42", "value": "T1947423896A44E0F19137B37BDA578420FAA71E5B1084C932B97C505C2F3D8697EFBE84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728811, "uuid": "fbc1e5de-2a34-4246-84a3-8f393978289e", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbR2KobiLB7MqjwjP1FluMMbn:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728811, "uuid": "ac0cbaa1-9d14-4a6b-9d9d-c1a481d80c29", "value": 354629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728811, "uuid": "5a5fb051-2e88-442e-b03f-d473a4ee40b5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728811, "uuid": "1c26eb53-dfb7-45b6-9919-22b366484695", "value": "Oq63BuFHfG95y.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "790ae194-0a75-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686721015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686721015, "uuid": "ff3af637-c93d-45bc-b5a6-be1647a63e1a", "comment": "Malware payload (Gafgyt)", "value": "9252bed7dc0a025a12cd7db1cf6e86f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686721015, "uuid": "2ef454bc-d626-4fe5-b14b-7b9af28e4d54", "comment": "Malware payload (Gafgyt)", "value": "0ec069a2d2294ebbbac35040419aa77fc02bc653edec0e7a779bbe2b48040b03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686721015, "uuid": "475411c3-6c1a-419e-a6a8-037b96c9b2ff", "comment": "Malware payload (Gafgyt)", "value": "ef21bfc3c5dcfe63e59cde736e039eb73dbd4d36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686721015, "uuid": "9ea27a22-99c9-44d1-8265-c07b121b8546", "comment": "Malware payload (Gafgyt)", "value": "8905bbce9d1c70a18fd47a0b367f4b47ea9652b94c45c09a5fe6864432a178d314944b9bca0be63da4ece2b68fc63112", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686721015, "uuid": "8907faee-f163-489d-b954-fb2e00f57656", "value": "T1521471261A4DC683C066127561DE9F3BDE7EB2C63A59CE437CD028385E05FDA390BE85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686721015, "uuid": "4ee14b2e-9540-4ba3-9420-0226c4a0f206", "value": "3072:5w/AypNPuRyphaZlTaYPDdQuA2/p/I2t8Ni:5w/PluRyphaZlTaYPDdQuA2/p/I2t8Ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686721015, "uuid": "37206b24-ef8c-4886-b6fa-bf1a4476c7d6", "value": 196294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686721015, "uuid": "ce89bdbd-e28f-4004-97fb-68feda9407a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686721015, "uuid": "9ee34064-932d-44cb-94d1-63749fee3b76", "value": "9252bed7dc0a025a12cd7db1cf6e86f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c40100f-0af2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686774654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774654, "uuid": "b27b1f21-d5d9-4554-8949-c6d6e2c7d80a", "comment": "Malware payload", "value": "ced5a24a846c25499ae0cb0d7fd96d24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774654, "uuid": "8603515b-a91c-4e98-94ce-77c111ce27be", "comment": "Malware payload", "value": "0ed5468ebfcd39b4df9f418d3aba70e6c2731dfd74ed658b6497c07b9a812a09", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774654, "uuid": "5b31eb1f-c79a-4364-b10f-ef5ded08cb24", "comment": "Malware payload", "value": "9e406e677ed35af7664928c199a427b51aa21322", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774654, "uuid": "354104aa-7b2e-4acb-b452-7c60dafcef93", "comment": "Malware payload", "value": "0f0beabf69f5fa2c6ae12cd67d93f92f04e529f611cc9900f98aa0103d25571bfb11fb32efc94f70630bf1dce07f0862", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774654, "uuid": "cf54fbd9-652f-4bea-addc-4839803e9e2c", "value": "T144633A21BA761E2BC4C1947621F74B25B2F143DA26ECCA0A3DB10D9EFF719846543AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774654, "uuid": "dc151a6f-bd56-4fc9-bb6e-0aa422bcc782", "value": "1536:lGRaTYmol/hGIAs4PNvAEQrGm75123tStZl:lya7hJsGmVDjl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686774654, "uuid": "cdcba12c-d3f0-4ba8-a964-ca8ad5d5fe24", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686774654, "uuid": "08d83b1d-4db2-4741-9624-81a66960d728", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774654, "uuid": "74dae779-dbd5-422e-8428-71f1919149f9", "value": "ced5a24a846c25499ae0cb0d7fd96d24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6fe1f4-0ac3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1686754711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686754711, "uuid": "968b2963-678d-4144-9757-623b722bd653", "comment": "Malware payload (Rhadamanthys)", "value": "ba4b9530c664a0b57b572cc22ac996e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686754711, "uuid": "e55effa5-2e02-46a0-a60d-d39ca46d5fcf", "comment": "Malware payload (Rhadamanthys)", "value": "0f13412e34d79c5c24595dbf76c44ded557d8bf22bc420802e7843cc84ef7ded", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686754711, "uuid": "d1b9ff7d-0681-4d15-a450-858b9c958603", "comment": "Malware payload (Rhadamanthys)", "value": "eb40b07b928a80627cffa1e5605f7015911b4c1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686754711, "uuid": "407edae5-b45f-4470-b859-7cf1e8b2116a", "comment": "Malware payload (Rhadamanthys)", "value": "66a10c3c2bbc2d8ec4d986047acd7f12e47681c3930bb090e7cfc3fdbabcb5a75c3b6bfa41515ece0332fd549572d231", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686754711, "uuid": "7842bc68-dedf-44f7-93c2-bcee85ea97ed", "value": "T19894012A31F1E471C6AA1B314D25C3E4677FB9125F3466CB6398963F0D72AD0AA33346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686754711, "uuid": "15d43aaf-201b-4147-8eba-a81a53cbfaad", "value": "b14a6a82fd1c1e39d5e11c743609d6e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686754711, "uuid": "29fda195-b9aa-41ec-8a99-575f7460105b", "value": "6144:76PncCRQA5cswBr6tg8HKN4nyqors5ymIlKqdRSTk6vx0w00/MjFDlKOELqsEm+x:76N2Ahw4Hs4y7K4DVR1YCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686754711, "uuid": "cbb875ef-cb45-4bef-a2bb-7d3e40fbf042", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686754711, "uuid": "b2be8869-727b-46d7-93ab-0d298898f479", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686754711, "uuid": "137ee754-cddf-4495-bfe3-8724d4b2734e", "value": "ba4b9530c664a0b57b572cc22ac996e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9ce709-0af2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686774686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774686, "uuid": "9351d72f-af72-40a8-93bb-8d79721ed86f", "comment": "Malware payload (Gafgyt)", "value": "e5e2d5e60bb48f937ff083375553c5b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774686, "uuid": "5b3d32b6-fd40-4ec5-a140-0f6989b045b9", "comment": "Malware payload (Gafgyt)", "value": "0f13ebd15c1c4d131bc2ad61ef388ba054d737111b97299137494b6933ca9744", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774686, "uuid": "7932bd27-c48f-4843-8308-95374f0406c2", "comment": "Malware payload (Gafgyt)", "value": "decaa330483870eeb9defae07edd4e8c3cacbd1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774686, "uuid": "77c606f0-4d59-4bef-9b66-a75ba696e07a", "comment": "Malware payload (Gafgyt)", "value": "e0ba2f0f18b3d71afc4a4300fd3cc6f4dc0427c103059cb0f32c94d33ee57f67b7bd9b93bba2d30a0796973c218ab4d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774686, "uuid": "686c406d-af1d-49cb-a0b7-03fb66b3e58d", "value": "T182B33B4795A89EB3C086BEB525EB59300722ED120F2F1A9621387BF4437F5CD741EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774686, "uuid": "4314d4b8-a59a-4d07-b8ee-61be61df6718", "value": "1536:Aq/W65rWXAiP5dfK4EBbkb25lyDQnAjCQB5+TjgkHmmycgYVLu1IPYC:R/vp+9C4xb2MjX0j/HmDcgYVy1IPYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686774686, "uuid": "32594b85-25d1-4745-8e9c-a3a94e701af0", "value": 108486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686774686, "uuid": "13241474-d765-4f34-bae7-815076eda589", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774686, "uuid": "8eba511c-c222-4f00-a15c-0890ec1b7495", "value": "e5e2d5e60bb48f937ff083375553c5b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d8f8d7-0a70-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686718833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718833, "uuid": "3b3f2856-a603-4a14-9b3d-0a153bf39a7f", "comment": "Malware payload (RedLineStealer)", "value": "de9825118349fa416efcf340a55dfda7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718833, "uuid": "c7adc31f-2160-45d4-9c9d-c2bfe0ecce46", "comment": "Malware payload (RedLineStealer)", "value": "0f3c7a6cb84441e196b92d391b44f892b269593ebc326a9718d8e94d4d24987d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718833, "uuid": "c6295899-49bd-41d8-a3e8-c112c49cfef6", "comment": "Malware payload (RedLineStealer)", "value": "15998df69cfe6a73cc7bee80033762fc3fa2d0a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718833, "uuid": "da5e6f6a-c6c5-410e-ad36-b7405ab68049", "comment": "Malware payload (RedLineStealer)", "value": "1d63338abfa4f017b4bdcdc625026138b77ef9a5f275c99747d6eecb8245e74de01a78ab531185e6c24cc4a85077bf30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718833, "uuid": "1abf05ec-3e9f-42ae-a7de-fdcb6f6598fc", "value": "T1E9646DC0991CD231E2838472E87B4263960CE8767A54D7EF2F86A53CBA766D1CD54EC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718833, "uuid": "c4769058-64b7-422e-9e39-e9df822a3da5", "value": "5b43169544844188711b217df61eb2d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718833, "uuid": "2b8bc652-280f-4a30-bf2c-83361ebcda5b", "value": "6144:XlYALt9/jXSbAqY704pnH7hYx7oPG5RU0nCL:XZ9jXSbAqYTVYxPRU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686718833, "uuid": "18917ccc-cabc-45ab-9a02-3b9eb6de29ca", "value": 326825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686718833, "uuid": "afc3feea-f9d9-4612-91b6-771dea7f956f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718833, "uuid": "5ee3ba44-1625-45bc-a283-b86d12310e61", "value": "de9825118349fa416efcf340a55dfda7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62001189-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686725701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725701, "uuid": "880ee128-afee-4e33-92ea-29de75560acf", "comment": "Malware payload (AgentTesla)", "value": "fd6f0a70ada45c35bf6271eaa369fdc9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725701, "uuid": "caf2feb6-e30c-4770-93ad-9d4121a2b1d0", "comment": "Malware payload (AgentTesla)", "value": "0f3fc2740ed21a83715c2dfa243643d045c05921641eaa4421a8dd4122c50226", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725701, "uuid": "ba276283-7d94-45fd-8e46-d5fb57ce2a34", "comment": "Malware payload (AgentTesla)", "value": "f90ca2d94137082aa172f7c0b7c7096b9fe71113", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725701, "uuid": "b0fe65b6-0706-47b6-a271-1a88bc7353b6", "comment": "Malware payload (AgentTesla)", "value": "ee402c8a07f32c00d5338a39727d0abc15bf33d0efcd2ddc83ffd3c69797f56ad0c9954b449092a461fbba8f8e17c50e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725701, "uuid": "d309e4b9-c5c0-40f2-ae4a-810c4e3c20c3", "value": "T13DD42310C3EE45AE95BAF0F8F98D10C5C79F14F88BFE831A12989745158097C936AFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725701, "uuid": "d5204e78-a9a7-4cba-a139-6bc91d9baa03", "value": "12288:ZxOiO5qjsJEAR/TZt0mOrhFJs82BZrfj66GHPsp+piX/o7nBRBt91Inv:DOicbRFfOrhju766vGs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725701, "uuid": "c619227d-32a7-406a-8bbf-0d7407f392f5", "value": 638491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725701, "uuid": "e21f21cc-6ed3-4c41-8869-61abe5f82e2b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725701, "uuid": "f6db3a89-6754-41e4-9455-a71c02f797c9", "value": "revised payment-pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afab9df3-0a50-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686705215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705215, "uuid": "31ce6648-6d84-41a8-9dae-3534e306ff2c", "comment": "Malware payload (CoinMiner)", "value": "37ff60eb57217cf27ad71a42073155aa", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705215, "uuid": "6c63764d-b4db-4d60-bd60-65c10b7ad546", "comment": "Malware payload (CoinMiner)", "value": "0fa17d47e42b98700369782207d3e4579b6bf24785134a047fc945e019ccdecc", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705215, "uuid": "ad355b31-51fd-42c7-8261-68b6aae43f53", "comment": "Malware payload (CoinMiner)", "value": "54938ea5dea48d337f466bc1b173a080c4ecc3aa", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705215, "uuid": "5b94d66d-e816-4229-bdaf-4c5be11268bb", "comment": "Malware payload (CoinMiner)", "value": "c4706903ad54183962af4786fb11ea40abd5fc7b43c1866e3f180d663d52619c3260a3ea33d02cd1082b25faf2811c58", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705215, "uuid": "b834dc52-18c6-4808-a544-9f834d63485a", "value": "T15EC5339C1C544E6EC53207797C1DCAA12BB6757B2F8CAE42C25EB36257FCC618272983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705215, "uuid": "8d27ba21-7bc5-4040-9b29-7386443947c1", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705215, "uuid": "eeee4479-7aeb-4a53-b985-e8f2b3ef4bd8", "value": "49152:86/NNfO0SHouIoC9abnYL7o7CNniiDuKG+QAzAEO0g+MWUlY9w://rO9HoTP007y7bK3QAz3OKGY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686705215, "uuid": "288d11fd-6339-40fd-ab52-2140e4529a31", "value": 2500608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686705215, "uuid": "4b211bc8-2219-40aa-9387-9281dc101ace", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705215, "uuid": "8d76a76c-959d-427b-9ae5-32eb66f32853", "value": "rap.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf44601-0aca-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686757393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757393, "uuid": "725cda7c-18ec-4e6e-a054-fae50d05aab6", "comment": "Malware payload", "value": "8b2d1796fb7e669c8fb7fb056e066b6a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757393, "uuid": "85658986-0481-4ca6-8051-08fa31194466", "comment": "Malware payload", "value": "106c49baea2378575a77764bf5c9042eec9a0ef051a55a03ee6310aa21c00a7f", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757393, "uuid": "a19e4fdb-f63f-46dd-a885-8c2c5072da74", "comment": "Malware payload", "value": "8fc70050eb8d11f81275044a206794f7b3b54354", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757393, "uuid": "2970f3bd-b124-4650-9b48-221186e7be83", "comment": "Malware payload", "value": "0b3d24e076bfedf38bdc5ce288b2332802512309e4e61b440287e90dee06f7e13101df84255375b4c31418b171dbab3a", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686757393, "uuid": "637d0c18-0fff-461c-a325-52ce5c24378e", "value": "T179B633EC1BA0A79D89184F2B2ED3A552F2D34C7B10C9880B5D599327EDEB46CDDA4483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686757393, "uuid": "2e4edddf-ebbe-4e14-9315-3caad99ca6b3", "value": "196608:jckTATdbDH6lGd/E+ykGv4qETBK+57BH2bd8zhPsKJuc1KTZfo3h:dTAT5Dal/xV4qETYEPsac5g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686757393, "uuid": "0330eed0-cae7-4e9f-94e4-3d756b2106e2", "value": 11309356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686757393, "uuid": "715ebabc-ac8b-434a-bfa5-bae2d4baac44", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686757393, "uuid": "a24b8920-4cd9-45da-9efa-0d17b308496c", "value": "8b2d1796fb7e669c8fb7fb056e066b6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58629ba-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728498, "uuid": "8a3eb91c-4a82-4877-8f63-24880cbb6364", "comment": "Malware payload (Quakbot)", "value": "c98e95d0ae14334633cf60e1a5f02539", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728498, "uuid": "acb8cfe2-8186-478a-83a1-d8968f2321c6", "comment": "Malware payload (Quakbot)", "value": "10bdbeb8894f821afeec68f1262a65a9b7513d8fcda6407f64377dd0adc00b51", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728498, "uuid": "03e49acb-0521-40ac-9faf-687d6c35486f", "comment": "Malware payload (Quakbot)", "value": "2afd5cd4609c5cc8a281fa9a241b872f852c5095", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728498, "uuid": "bc49782c-bdda-43d5-bded-5f07ef08db6a", "comment": "Malware payload (Quakbot)", "value": "8e2dd7e45f7a9f6ff975d721054bc07b301035019bfa9c049065957c39322ff69792305e2571ddbbf127e25d69b1084f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728498, "uuid": "f7f6c94e-ff3f-442b-b02d-821b7f821fcd", "value": "T1B5744289AA44E0F09237F33BCE174010FA6B1E5B2184D972B97C51592F3D8597AB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728498, "uuid": "4563919b-fbc0-4c0e-8055-ce574262c307", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb04VETS9FV6B+GghS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728498, "uuid": "d11f7e14-6c42-47e7-bc7c-4558e83478be", "value": 344301, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728498, "uuid": "637d7f70-01e6-4ccf-9cea-a0fa56071e42", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728498, "uuid": "97222e10-af6b-460a-a542-87495a87c312", "value": "Un9t2YaAGBHzot.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46c4957e-0a6e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686717924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717924, "uuid": "4aefee4c-9066-4fee-94e7-eb50137fbf7e", "comment": "Malware payload (Mirai)", "value": "1008bf51f2859c542f74269f90fcfff8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717924, "uuid": "78daa402-7c91-40c7-9d9f-def3d9ac02ea", "comment": "Malware payload (Mirai)", "value": "11793fe3c07ebb3b72a8c9b6fd04270ce42047716c673ce06c3e08b8e0753325", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717924, "uuid": "158fdeee-feda-4289-a21c-fb553a0f826d", "comment": "Malware payload (Mirai)", "value": "8c9e8f050360a9ae3659967a16003da26011b234", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717924, "uuid": "4b3d7159-84ab-4616-90d6-2cd06396e466", "comment": "Malware payload (Mirai)", "value": "87ff13aaad5f6875a699aebb08caa21f7c12524be9f53f87fb863a9cb170be391b63a361849eef37859a903a8f2f1123", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717924, "uuid": "7872ae0f-6979-428e-84b9-c239857240fa", "value": "T13E534BC0B643E9F5DE020674306BEF324E37F6F6211AE987E3E49573AC425419643A9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717924, "uuid": "61117657-3e99-4f1c-b1df-28495cee83d6", "value": "1536:mX23TSwlS4keBfrtOVqlQzYnnmKBPKlg2UWmsvnt05nFEiA:1jSwY4keBfrtOCQsnnFkOWBV05F3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717924, "uuid": "981808fc-8ee2-40b1-9c1d-cd0abc5c2e05", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717924, "uuid": "d507fea6-45fb-4a3c-8c4f-c108a4f48bf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717924, "uuid": "cc5c37be-15f7-43ac-bd40-5287e18d3116", "value": "1008bf51f2859c542f74269f90fcfff8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756c5535-0b0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686785863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785863, "uuid": "2c43edd1-599d-47f9-8e31-45845e7011ce", "comment": "Malware payload (Amadey)", "value": "90d5cd0d4cbf9d65eb1288816889313e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785863, "uuid": "ea2f0a75-63a1-4c70-a373-ea8cfa14f841", "comment": "Malware payload (Amadey)", "value": "11b4a8b687418fbf065b588bf6ce3db983ebd005a5f7e206c6c6e1abf52f6f63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785863, "uuid": "d08ca9cb-53a0-4472-8f76-4ffe8782fc10", "comment": "Malware payload (Amadey)", "value": "6ecbfd8402210f700f31ac5e2511349b10e8690c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785863, "uuid": "e243b849-3a65-4984-984f-7ce855be0301", "comment": "Malware payload (Amadey)", "value": "ce4cfdccb242b3536d98472f9e947d13fbf64d8fd000ef0b6c73435d36c50cbb08d0504382b3e248428ec9471fe0eeec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785863, "uuid": "eba443f8-6637-4e10-b874-ec8a137a1148", "value": "T1E4936B1034D2C071D97E55351478EAB68B3DB914CFE08EEF27551A7A8E702D1AE32E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785863, "uuid": "50761e7b-9cf1-44b6-b718-8ddaa7c308f4", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785863, "uuid": "2edd5fa2-d3a4-414e-a551-8a45e9d9adad", "value": "1536:zuON8V8ybtiqY2bpxLW9woUsScAbcauNhV2ZszsWuKcdJUmaI89p:zuhVZbtvbpxLHoUsYuNhV25LJUmaI89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686785863, "uuid": "a74491be-c631-4b1b-b019-0da402712183", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686785863, "uuid": "3492f9d7-2e5a-4ef4-8587-e9685e99664d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785863, "uuid": "e1b743b3-fcbb-4374-b620-94dc2a2f2062", "value": "90d5cd0d4cbf9d65eb1288816889313e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78220e91-0abf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686752796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752796, "uuid": "7286658e-b6e2-4b71-9ba7-da66f544d921", "comment": "Malware payload (SnakeKeylogger)", "value": "2abb2f09c2a5f2529eba741dd8e32a9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752796, "uuid": "2881af77-8708-421d-bc3b-a725c978c7cc", "comment": "Malware payload (SnakeKeylogger)", "value": "11e254d19638d13b5ca7387839d1b9e81b6722ff046f26d73388352d129b6322", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752796, "uuid": "bddba6d9-1f95-4889-add3-c32cea2f8798", "comment": "Malware payload (SnakeKeylogger)", "value": "ac41fc4d6d37548b44c2317cd361db271c02d04b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752796, "uuid": "c5c1e155-34eb-43a6-acf1-e8d7739b417e", "comment": "Malware payload (SnakeKeylogger)", "value": "0f5940bbfe8a124e134b6472691451eb62808e67b177c187b0b9a6188da85074ce35ebb52bcfa1c7409603bfee51b4ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752796, "uuid": "1f93c469-a602-452f-bd6b-b48bac9fba31", "value": "T145F4024597BD870AD6BF57F8A47495344BB2B85B2537E34F0D42B0EAAA23F214A01F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752796, "uuid": "47494a89-e72f-4be5-b69e-7c469e5584a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752796, "uuid": "d81dde6a-d2e0-4bfc-a27e-d7d8d4644827", "value": "12288:UZhqBPH1nMf5UaaP4n3CxTAgyyRGY0CQRunsunuB4EXqXdVo:YoBpq5Lz3EAgyyRGY0tRLB44qXdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752796, "uuid": "8beae44a-70d2-41dd-b8f2-b3d2968eadc5", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752796, "uuid": "d7c93aa9-db1e-41b4-9be9-3a2281ce0516", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752796, "uuid": "54dea49e-4c15-4dc8-9b26-c90cbbbc6835", "value": "MV INO HORIZON.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8805797a-0a68-11ee-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1686715456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686715456, "uuid": "a6c54ccb-6a97-423e-aea2-d337475edd04", "comment": "Malware payload (QuasarRAT)", "value": "a49c5e330ff32fce3525644710daacdf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686715456, "uuid": "6fc9468c-d755-4dcf-aad7-302adcca675f", "comment": "Malware payload (QuasarRAT)", "value": "121ae5f10dcf3d17712963a24c03b3abef427781924b6b72f2b48dfd1e6f3607", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686715456, "uuid": "36a1fc99-ebb6-43d6-b493-0122211c6ec8", "comment": "Malware payload (QuasarRAT)", "value": "e72f714e0efe504309641de4f02ceccf66a39590", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686715456, "uuid": "f04d5a51-665a-4932-8927-770fcc3b4997", "comment": "Malware payload (QuasarRAT)", "value": "a8514660f129fa0dc3eabd907a0dffd1e01536a4c1d1aca64129a2829466343a2aaf11186b8dec355f6b9573726c9a11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686715456, "uuid": "9e42f680-fc4d-4a53-9f06-f5a764de7d83", "value": "T1FB858F4BFF95AC05C8F806348C97724E63A0E84574FBA76F2D4CBB349E662834DE5621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686715456, "uuid": "457b0da4-292e-456d-b4e7-ef815844ab56", "value": "6f543444487328d5966207cb412374d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686715456, "uuid": "e1e17674-adce-44e2-b4f9-30c5c7bb1e46", "value": "12288:wG+i1cTob5rpXuEq++p6xG5ssxODepysgSk9DyL1HUyIP9IylT8rhke6nuRs9U5m:wrkcG+p6U5U8ae6n+5ra7krn6qw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686715456, "uuid": "bae58692-b1dd-4ac3-b4cb-cb440b1d2e56", "value": 1856034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686715456, "uuid": "7460c15a-abc6-464b-b94e-1e3e5e9833b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686715456, "uuid": "8f28d660-e5a9-4c74-a3ca-170fe4732171", "value": "a49c5e330ff32fce3525644710daacdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "781cbd4b-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728744, "uuid": "7fc66b41-29a3-4c08-9c33-6d5f02e476f5", "comment": "Malware payload (Quakbot)", "value": "b86f07e3ebc2e1802b7cedfe8616b6ce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728744, "uuid": "3a5c09d5-7c5e-452d-8d71-8f0504cb95cf", "comment": "Malware payload (Quakbot)", "value": "12562595663f9028448ea4561baff9e994bb76069f3e483b95ebf79c58b8a2b2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728744, "uuid": "e2b49ac2-454d-4339-8078-a2514ad46310", "comment": "Malware payload (Quakbot)", "value": "b2e29956962ea8e315bca6cee542607ad93590a1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728744, "uuid": "f32e7a77-8d62-4603-92bd-326bc69e1681", "comment": "Malware payload (Quakbot)", "value": "f3b9acf36600bb86e5a7e98aa4a012021bd14cb172f9a5bc396a2f564c871b83de43ecffe20088aaddbdd7ef05e11005", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728744, "uuid": "23d36718-0e02-4b24-9111-525c1efa6a50", "value": "T1956433856A51E0F08137B377CA5B5410FAA71F5B20C4C972BA3C50596F3D829BEB7E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728744, "uuid": "349e9307-b90a-4e65-9fdc-791b77262c4f", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbm3urkE1ChS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728744, "uuid": "1df34a7f-372e-4332-8951-568c8dc9422a", "value": 315832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728744, "uuid": "856cf522-84f9-404c-8806-17700029eada", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728744, "uuid": "cd85aa28-5c9f-4ccc-8756-8ea646cf9b0b", "value": "QfqGO5XBro4CKw.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "513b3ce6-0af2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686774635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774635, "uuid": "e0c64965-f44c-4933-b25c-c837baf5b1d2", "comment": "Malware payload (Gafgyt)", "value": "8b4f827f1ebca6855840f1fd964671d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774635, "uuid": "8c738e03-b278-4445-af39-8cbf11863e87", "comment": "Malware payload (Gafgyt)", "value": "12c2acc79ed66d11d6b7635ef8f26a977ef62d02185aa8090d9c65ee5ca3f624", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774635, "uuid": "b51dd4cd-b8ae-497b-8c52-d6bb452a6d46", "comment": "Malware payload (Gafgyt)", "value": "732122784f423c87f34f1080d82072d9a7010ef3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774635, "uuid": "63cdeafa-32ec-4f96-b04c-f883c6efbca8", "comment": "Malware payload (Gafgyt)", "value": "dbc5c7729f21b5729010bd6300d98ce0078d7ff2062a12c483fc0659a888f4a0b73684ea24935406ed1b9fd999a13ce9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774635, "uuid": "1f02efb1-a320-4927-8d37-3281b3c3c55c", "value": "T1E6D31905F460875BC2D217BAB68A425D37231F7893CB33256A34BEB42FE1B981E79531", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774635, "uuid": "61106961-24e2-45d6-ba66-d997466da9f9", "value": "3072:Sdf+fvEqa9FazYA7IboRhNe391CErktmCQA9FX9aH:ifWEqa9FaNhNe3DrktmCQA9Z9aH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686774635, "uuid": "6d25ae52-8dd5-4d2c-a27f-0b0b9d42c146", "value": 139585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686774635, "uuid": "3c14870d-cfc7-4a78-9bbe-48143b024925", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774635, "uuid": "fbe56456-c4bc-4dc2-bd53-65297b71fa76", "value": "8b4f827f1ebca6855840f1fd964671d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0749afd-0abf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686752864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752864, "uuid": "47c4ea52-ab12-40f9-acfd-00eb6c1e2490", "comment": "Malware payload (AgentTesla)", "value": "5adae5ecf2ffe70cb15189f02b0bd1dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752864, "uuid": "bb0cc865-21c6-40d8-945b-9bd1925294b0", "comment": "Malware payload (AgentTesla)", "value": "139a5389daa8a43eef2d078835f474594512b5c15d761d05a2698780347887e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752864, "uuid": "2af4d0d8-6f91-49f4-9157-6a82c195f712", "comment": "Malware payload (AgentTesla)", "value": "f8e878bc35fd5a18e6f01d482dc322784078ba55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752864, "uuid": "77609a28-0528-4ac3-9516-643e9b4afc16", "comment": "Malware payload (AgentTesla)", "value": "a530dac84abfc58c0ef14a51012bf12fca435f5e52ad8f3a7a2986c8298072d3f768891785c64920424f6bc97a48ded6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752864, "uuid": "f09c9636-b728-4295-9534-5f8dc07ef768", "value": "T1A304A491BA23ECA3E912427476B9F21311476F237A14CE552AD3B21E07F3B507C79E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752864, "uuid": "aee18375-8ae0-4b41-a588-6f0123687425", "value": "3072:XzakZ+RwPONXoRjDhIcp0fDlaGGx+cL26nAiXN2QsiYlZqnkl1jvBXeMby82IQjo:jZ+RwPONXoRjDhIcp0fDlavx+W26nAiu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752864, "uuid": "ee66ec07-8602-4359-aae4-0593175e9090", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752864, "uuid": "68432239-d7ce-4425-9b20-46ad523a6085", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752864, "uuid": "51da4fb6-1487-410f-bb95-923e1afc8ada", "value": "shipping docs.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1addc0a-0a85-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728089, "uuid": "856dd20d-3190-4daf-8021-78187bf0963e", "comment": "Malware payload (Quakbot)", "value": "defd5988494b5e70234bf3d1608e894e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728089, "uuid": "b6010252-7515-4e51-93f5-2ba9c78b3f6e", "comment": "Malware payload (Quakbot)", "value": "14bd8dbe7b00ada45c018c3eca47e5ec63bcd3ca917a8ebe3028265dbfe860ed", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728089, "uuid": "6ac37945-a487-4b0e-a5ac-15dec4794b4c", "comment": "Malware payload (Quakbot)", "value": "5fc6962b728dcc2abcc9fd98e0796420ce3ffd93", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728089, "uuid": "93315406-3ad8-4403-902e-87791a919dd0", "comment": "Malware payload (Quakbot)", "value": "ae0944899cd94fa892adbd266fa6deb69715a34f66c52638270519f53da68a5cc4538a42197615d9489352a0061e474c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728089, "uuid": "5d5bdcb3-c6fb-4b07-ab4e-09053f9b3086", "value": "T14F7455886A51E0F19237F337CE178010FA9B1E5B20848976B97C51586F3D8697EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728089, "uuid": "4071cbbd-5d4b-4251-a11e-aebd5faa09cf", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbZS2Y+HSRQifPN3WLarsgaYT:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728089, "uuid": "88fcda32-35ae-4b92-a7b6-5e07b9a578bb", "value": 356344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728089, "uuid": "9f1c0fce-5291-44c1-a14d-cbe8b735e8de", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728089, "uuid": "95e8f43c-6e2b-47f1-8c55-d5ff325e1b88", "value": "f0ADIPqU2CuN.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989bc5fa-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686750703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750703, "uuid": "dd663f9b-d2f4-4b1a-b236-b4c0c9dde515", "comment": "Malware payload (Amadey)", "value": "4ed4eddaa248ff117c9b38b9b53260ab", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750703, "uuid": "2b5460e0-aa41-4ca7-a70c-5c338bb22653", "comment": "Malware payload (Amadey)", "value": "14eebd4b954a57afedb867c27d981ef6c7416465857d44ccb21b2dbd013996d7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750703, "uuid": "f71765ed-9b4b-4f6a-aa30-ff4583608d7a", "comment": "Malware payload (Amadey)", "value": "62a2e13ac9e424d546a5adee99a6ff0dd8e8012b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750703, "uuid": "a6ebeed2-3e92-4090-a853-0aec2938bfbb", "comment": "Malware payload (Amadey)", "value": "baa522cb017c1e1f37864ef3512b57d7d878709a59bcffdd3ea13cbca80d2c41d2b4c845886b8d5be67128acd3b54ee0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750703, "uuid": "6fad3cca-e4c3-487c-92bf-fd43e13bbbec", "value": "T1A224F7217D12C032D96161B619F5BFF2C59C6828ABB049DB7B800F77DA122F73961E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750703, "uuid": "eaff86b3-d60b-4746-988f-7236b855dcd0", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750703, "uuid": "87fe986e-dfa5-41ff-90b1-3a1201da8f1f", "value": "3072:CXkSckkHbzG1iXAt60p0zuNmnKG7peNMQbuZAIOb2y3xfbT:8kSDAzG1iciuInRexuZAIKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750703, "uuid": "0c47c8cc-2e5f-4b3c-b007-2792a5f8b792", "value": 210264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750703, "uuid": "88d0afb4-14f3-4121-b20e-6b4f96271f69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750703, "uuid": "2b99b75e-013a-45ca-973b-aaa408dedf7e", "value": "4ed4eddaa248ff117c9b38b9b53260ab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d5f545-0a85-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686727751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686727751, "uuid": "21a07904-135e-49b5-894b-b323d25c0185", "comment": "Malware payload (AgentTesla)", "value": "0ca5a59984f58c81b0eda68bc300b6f2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686727751, "uuid": "94a7214e-994d-4e45-8a43-4f31e6aad116", "comment": "Malware payload (AgentTesla)", "value": "15300e819795abf13183ca240911b06ac05244ed6eedb74bbc09e20f9f0d6a3b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686727751, "uuid": "17842587-5511-4489-a541-af89c7d7832a", "comment": "Malware payload (AgentTesla)", "value": "90c3a8736cf4dc4d066a35720d1ddcd0878fb34e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686727751, "uuid": "bd76e707-9606-4400-9557-cd4ccb8b2797", "comment": "Malware payload (AgentTesla)", "value": "3fd8fad3cc52840834150c0954e65c62ae1644134fa0d3b8f450d24a061baaf9169eaa31e0a407f3d36e920d3cd997b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686727751, "uuid": "244b4828-cab3-4dee-8cfc-73ceb1e7887b", "value": "T1B35423F71AAEE8855CF45BF41215C350C8582493BD3FD92942A4B3D8AE24BF7298FB11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686727751, "uuid": "9ebae591-00c8-4dfd-9088-d36bf41287be", "value": "6144:UNLOLsv0KhjNRgpZqMuHLabZprN4SIBZByD3vcD9QtdyIbbA:cLx0KhjXuZuanyT+DknYA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686727751, "uuid": "e8e083c5-f941-4162-a3d2-2cdeb9b3d87a", "value": 296294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686727751, "uuid": "bef7b240-ca11-4115-a1e3-8c75fe1f0293", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686727751, "uuid": "4449b9b5-46a0-4a3e-97de-70096a369b76", "value": "RFQ 11054.PDF.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06f5848-0a74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686720705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720705, "uuid": "1c0a8b41-9b83-4d0c-bffd-c16e91d435af", "comment": "Malware payload (Amadey)", "value": "560dc9f0fa1ebd81f67c44dbabcd4bbf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720705, "uuid": "8f2e10da-00ad-4ce0-b9d3-99f274a1d3d5", "comment": "Malware payload (Amadey)", "value": "155627897cbfe455dd97dc2b8cf2367c5803f2b0fc4cb40ae609f62ff53ce299", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720705, "uuid": "a40e22a3-4fbb-413d-8365-59517974b8d6", "comment": "Malware payload (Amadey)", "value": "3766f3a924343af4dc916a20b1294f1c3755d781", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720705, "uuid": "64cf64c6-ccbe-44f1-b082-dafe28b7b690", "comment": "Malware payload (Amadey)", "value": "e6f3c863541cbfc54c1e29f51b7a5e2e688d17d27d247c7d4fa25c62bc1a30fe6a98f1212de1df5f14da1009ccf4bf66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720705, "uuid": "258dfecb-092b-4252-8b15-e67a6e1f516c", "value": "T1410522556BE88036DCF527B06DF243830B39BD614E78C7772248AD191DB3691B6B03BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720705, "uuid": "c36069b6-2ef4-4014-a7ee-2d031449d7a7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720705, "uuid": "0dbb4c7d-3144-4ce8-9224-6b5f497f4a30", "value": "12288:JMriy90cnZvG0+AKSjhyTlTw08HHDzj9B4KIE4mEWkqRGYyvKGNmow14dqB8lvU:Dys0+U4ZTzOHpmtzYkqvD2mowL2U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686720705, "uuid": "bb0503fc-7088-42e9-a540-dcfbb72d98c2", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686720705, "uuid": "e6b643f0-d84a-4898-ace7-ee7fe6f868cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720705, "uuid": "e4a8171f-f80d-4c98-b637-2c5bdd19c9bc", "value": "560dc9f0fa1ebd81f67c44dbabcd4bbf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12709464-0a81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725997, "uuid": "51b3de3f-706d-4592-93c8-4d346346fc51", "comment": "Malware payload (Quakbot)", "value": "5a5aee8559a26493c4b9bcaa7605792b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725997, "uuid": "13c8cbf3-ba20-4efd-9af2-5c93443d1053", "comment": "Malware payload (Quakbot)", "value": "15966c2356779bce20cfd45c8d665871a77e6b8605ecf7d494daa4cb3c87ad47", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725997, "uuid": "10929bba-18b8-4b59-913f-d2114393f76c", "comment": "Malware payload (Quakbot)", "value": "97ddd886ffafe0981fb8d6c3dea6c2027d35c5a8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725997, "uuid": "f1aababb-1389-4b8c-b6dd-b038a4022db3", "comment": "Malware payload (Quakbot)", "value": "f5ab1d7f9fff2c6102e46af53843cdc925f06d1a4a0a96e25a44b5382f98d123e0236c144d25bb1c077ec2695f3459eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725997, "uuid": "d22b1121-a31e-4819-ac42-d8e69cbfdac5", "value": "T17F6453496A55E0F19237F37BDA578010F9AB1F1B1184C932BA7C50582F3D8687AB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725997, "uuid": "a4b39b82-8a85-47f7-8a58-0b6f1cc4b5a3", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRby2JNLghS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725997, "uuid": "457161cb-8913-4ab3-af74-35601f75ce12", "value": 336026, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725997, "uuid": "d3feb855-7d14-4a0e-8625-935706b16a4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725997, "uuid": "c5d74c3f-7ecd-4eb4-a890-05abae6c34cf", "value": "flUJRnh1qsDL.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dffa19cb-0a96-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686735361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735361, "uuid": "14b4e89e-4db3-478f-802d-08def49efcd3", "comment": "Malware payload (Mirai)", "value": "8e657835829cccf401102fabeedf6b8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735361, "uuid": "f33ca0fc-25a5-4e56-bedc-5326a8ddff53", "comment": "Malware payload (Mirai)", "value": "15c517c9388e4bf7d1a6f8d1ba1af876891b3342aa48a1670ef193a1c8602ec4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735361, "uuid": "61f667f3-a83e-43e1-841e-48c1915f18c5", "comment": "Malware payload (Mirai)", "value": "0aa3281f909d06bfd25ec4ff9a9f45de6c205f61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735361, "uuid": "5818101c-d1a8-4cf1-b50d-df5119c0e410", "comment": "Malware payload (Mirai)", "value": "18d9c49a1c850d3d075ad29b73fb3e8ab6022daa0d34aa440eaa5906e5ca5e0bddd5f7c27c8c1f20b4c5fbfc124c1f14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735361, "uuid": "913fb56e-639a-415b-94b9-5d4e318f7c63", "value": "T1DEC32086BFA03FBFD81ECD324198CA06129C4A5953A4AF7B5F74D404B69B14E5AD3C8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735361, "uuid": "03c36317-1066-426b-b4e5-bb26ab278a0f", "value": "768:tNNT1Nc12cVJ4vTYAc02GeJy3B2LGF2ahPur8zhkbDrjeQ6BN8YJq6J9yx9Ly7Y1:tJ2GrMcubDr6HBN8DCoyEElqXyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735361, "uuid": "a20f1300-6ce8-4b0e-aacc-6760f49b1918", "value": 120068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735361, "uuid": "dd79d2a4-8c45-4483-a95b-e136a1cd1f93", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735361, "uuid": "31217117-5b86-4c6d-8692-09f38a07f3a5", "value": "8e657835829cccf401102fabeedf6b8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "916cc18c-0a82-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686726639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726639, "uuid": "f7a26c4f-9d9d-4c34-b93e-99a0e2890ff8", "comment": "Malware payload (Amadey)", "value": "ac6c329789b6fc9a234c9f134caa1b4f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726639, "uuid": "9e58a008-60c1-486b-ba53-f362f6b603dc", "comment": "Malware payload (Amadey)", "value": "15e9ba88a28765d93b02f29f9d9eb6f800a357b6183cc6bb567c48ae49b2807e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726639, "uuid": "eeae9c33-e416-4701-a038-9e176cc5dcb3", "comment": "Malware payload (Amadey)", "value": "2697061ec5884ca7359aad086101b0d08ade8cf4", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726639, "uuid": "b145e578-194d-4c63-9408-aec16c95745a", "comment": "Malware payload (Amadey)", "value": "fef6deac59bab16fa548549479f92ed45817e6ef9748893d28a4e431c8e4d232c59597314bbe9e3e177b237cb8571418", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726639, "uuid": "5b5b50ee-6411-4164-999c-6b8db1d69a28", "value": "T12725CC9D366075DFC86BC4729EA81D74EB50B47B831B4203A42726EDAE4D89BCF150F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726639, "uuid": "8e3b5e32-b732-47e0-a541-8dc2162608ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726639, "uuid": "abeeb6e9-1d59-4804-971b-f035f513b5c8", "value": "12288:b7j+zRQR/zzOFEhkI85dmiJFldo/XvsF+6iaguJX205V5H8VGQOZYffgpHEVxRoq:bfEQR2Fh/nVFEX3HagSIzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686726639, "uuid": "d1220d9a-455c-4a44-9fb4-52e5b22e3d44", "value": 986320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686726639, "uuid": "7df12c7b-95f1-47f6-91a9-bcd83674bcee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726639, "uuid": "37a1d42e-670d-4578-9685-ed8d314c5df5", "value": "ac6c329789b6fc9a234c9f134caa1b4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb905d86-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728508, "uuid": "fb637a98-aab1-494f-9e0c-e5b5d567d306", "comment": "Malware payload (Quakbot)", "value": "499664d64dc3b4438fa59ef548d0f7de", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728508, "uuid": "1bf1bbbd-d2a1-43b5-b574-e3961e086cd3", "comment": "Malware payload (Quakbot)", "value": "174df60ab76cf134aed2dc55c0eb31bbf27199aaf5d77a5a7371be192c9ab3a3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728508, "uuid": "6c3b1e2e-cce3-47bf-ad66-85e2f355d0a0", "comment": "Malware payload (Quakbot)", "value": "b5d49e49036a5803f92f7397887e2f913c15c6d1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728508, "uuid": "30317e58-7df3-42ca-b3b0-1c7a88cb2143", "comment": "Malware payload (Quakbot)", "value": "23874484f04ef7654476eeb1e468d32661a3577342565d6c5e45f43cdcc6183c3dea937f0e1d06daf10e7cefbd172456", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728508, "uuid": "9c0b26bd-e500-483a-b90b-bbc65c6ae656", "value": "T18D7453499A50E0F09137B33BDA578010FA6B1F5F20848972BE7C505D2F3D8697AB7E89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728508, "uuid": "06dc8943-40ec-4a1b-8940-dfbd552ae421", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbZb3ZyWpnwhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728508, "uuid": "dfa8ddb8-41c9-4941-a95e-6164633e3076", "value": 346498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728508, "uuid": "0b3e45ef-cad4-47dd-a279-fbdc9536f91c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728508, "uuid": "02831d9e-1cf3-4a4d-aa1c-3c69aab7bba9", "value": "UbwII8oqMneOk.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e084124-0a97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686735492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735492, "uuid": "d8a45253-b0d3-4c5e-9045-121f5e3298db", "comment": "Malware payload (Formbook)", "value": "b0d079dbfbc848cabde3e9d4bffa70a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735492, "uuid": "5f0592bb-b60a-440c-be7e-e91f912697b4", "comment": "Malware payload (Formbook)", "value": "177a3569e8be9aa2d379612f24951335ea6e9c36893871bf5a479baa15b1bfd6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735492, "uuid": "42140cd4-87f8-4213-8ad3-8fb8cfb32c99", "comment": "Malware payload (Formbook)", "value": "257ba11baed4de61d885b6d013bb49bf9394fa21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735492, "uuid": "f60709bd-5546-4b6f-8ebb-521a41490a9b", "comment": "Malware payload (Formbook)", "value": "7376d4298dd9d6d4610cf2e92fa5be50f75a87cc20edbb18bf404e7b3da500c81d8d81316e7fd201db75164981c62a87", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735492, "uuid": "7493f23c-b8d3-449c-b59b-3a0496b4456a", "value": "T11EA417F871E1E279C80482312E617C7057F14EA0DCB2A955EDECF9E4D631EF62B2164A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735492, "uuid": "d7e8ed8f-1dd4-4b18-81ac-1cdf1239e734", "value": "6144:P9jyWesJ7Qt85IbM832oAcKtZeRCJPOpOMWnuCxFwKxFf+3WPYMogLXax1vj5:FjwsSa5IfpK7xOpOMWnDxXW3WPYMTXW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735492, "uuid": "45053874-3328-48a5-90ab-e50e87b2e02b", "value": 480832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735492, "uuid": "208bd6d6-02e2-48e1-94cc-14e9ed3ffb02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735492, "uuid": "7d58df6e-e42e-4e10-b189-c95008cfc29a", "value": "Sat\u0131nalma Sipari\u015f No.129099,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b19ff35-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728347, "uuid": "4faca8ff-378e-4368-9602-5fde1c86a2d4", "comment": "Malware payload (Quakbot)", "value": "9aa3188d428175d3575cc8be3c47f63d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728347, "uuid": "71791db8-d39a-4d84-9e90-815d8158a5bf", "comment": "Malware payload (Quakbot)", "value": "17e0b63a9658844a7abe937e437ad78b32a0b831718cf4a8504c81f558243073", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728347, "uuid": "60e3eb39-c5e4-4ea8-98ca-ea925e15023d", "comment": "Malware payload (Quakbot)", "value": "9d62c7e821f574595e1c0eb9c8bd83b07361cd3c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728347, "uuid": "79921e0f-9f91-4207-93bd-bff725dd7c47", "comment": "Malware payload (Quakbot)", "value": "62073bf533dc4b76cbf5a8457b682b366efdb652045602758fd77e003248adc7e8157eae2b5a47fc6c5444b96d4188cb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728347, "uuid": "676f089c-3c20-489d-8c94-b38d6b8d5924", "value": "T1807452496A55E0F19237B33BDA178010F9AB1E5B1084C972BA7C505D2F3D8297EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728347, "uuid": "748e9032-d536-49de-afee-0d8b113a1055", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbcjec+H9MAM1QHqhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728347, "uuid": "c0123e2e-4484-4b4e-b559-d191f1bbde98", "value": 353238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728347, "uuid": "bda1a1a1-53fc-4472-a21c-937d43cad3ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728347, "uuid": "8ec1391a-e880-4755-90d6-9e14c5205d90", "value": "YabCFLVs3Wbx2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66af224c-0a74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686720555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720555, "uuid": "7ac74865-eaed-4251-acd9-0c364ca570ff", "comment": "Malware payload (RedLineStealer)", "value": "1730aa5475a43d8f889faf7208bbabc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720555, "uuid": "928801e0-bdd9-4a0e-89ce-7052e39c2a8b", "comment": "Malware payload (RedLineStealer)", "value": "187a40c80f0e837cdce06aae645e185e8da0b82f7ef922f83cff3e4fa27ac421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720555, "uuid": "00d5408a-2627-442a-8247-064bb26f17d2", "comment": "Malware payload (RedLineStealer)", "value": "c196ca36073ad9439c4dd76c8089ed0dfa95fa6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720555, "uuid": "462719d6-ff15-4902-9b3b-5558adef5d3f", "comment": "Malware payload (RedLineStealer)", "value": "cdc7ab9190c7b83288022721d55616662e098409c3902ea67b37229523658ecac44944f73c0629b145f3a231c3b23aaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720555, "uuid": "c1dd62d5-76a4-432f-b061-090f37269431", "value": "T1DB646D90991CD761E2838476E8774223A60CEC367A54D3EF2F8A957CB6769D1CC18EC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720555, "uuid": "ed2a7ab3-ad6a-483f-a51a-f5596a42d1b8", "value": "5b43169544844188711b217df61eb2d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720555, "uuid": "98916b3f-7ae0-4ee1-bb81-dcfde8fc9bfb", "value": "6144:/OgXRtRV25aqTLI5gWWIoX3VWXPzRUITun:PRXA5BTLyPzRUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686720555, "uuid": "3797e0f7-6673-4625-862f-7e0f0b0bdcaa", "value": 322720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686720555, "uuid": "f3fb5791-8cce-4e98-a332-f21f6403ae4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720555, "uuid": "4abc6fb2-fc04-440f-be8c-34e5c0f1858c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35a61b1e-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728203, "uuid": "645c3e86-cfd2-4f76-a8fa-a70025f8d032", "comment": "Malware payload (Quakbot)", "value": "705cff67f4322363a23a7626287e26fc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728203, "uuid": "8904d87b-12c5-419b-8d63-82d2179f28b6", "comment": "Malware payload (Quakbot)", "value": "1921a9b34e0f70f6cd73ef0a99e7dc401f82e4505e70dd373dadcb3252beb81e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728203, "uuid": "f34c634c-8cd3-41ef-b3ae-b0162f83e5f9", "comment": "Malware payload (Quakbot)", "value": "ed4b13b8997a27d50b8ca5f1c692f837b375e45b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728203, "uuid": "d1ca0205-4371-425c-9f48-b1eec365509b", "comment": "Malware payload (Quakbot)", "value": "b0772cebf07628a08748bc10197dfa3940da5aeec5d3bfee784a8d36a4246ac31bfd6e161949a3e812f75e6252996fa7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728203, "uuid": "54257465-ef37-4238-a0e5-c2ea517da842", "value": "T112742084AA55E0F14237B37BDA174420F9AB1E5B2084C972B97C505D2F3D8297EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728203, "uuid": "1170657c-60a9-4618-b4a2-7ea27bdfbc55", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbcG35wP1PdO+/PQG1bUhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728203, "uuid": "bd2fb1b6-9166-4ef2-b9c2-d6761be446c4", "value": 351969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728203, "uuid": "1e870412-856e-41fd-9ace-2201003e9a07", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728203, "uuid": "e2ca684e-56a8-4c95-8dc3-57cc3c19d49b", "value": "binXc16M8S5V.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "799423da-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686750651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750651, "uuid": "3da21e88-9d7f-4a0c-8e9b-de2a665945b7", "comment": "Malware payload (Amadey)", "value": "4a91acad201dd7090a499627f258dab3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750651, "uuid": "92a6a4f3-c9e4-4a61-a4b9-e518d30d9159", "comment": "Malware payload (Amadey)", "value": "19396664f9e708546f1326c289e9f7a83c90d84bb3a52886aa1d892d42e18d91", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750651, "uuid": "e5044c50-a5ab-4ad7-91ff-f7ffe1e22f58", "comment": "Malware payload (Amadey)", "value": "0cc03d5cf25a25e33167367dcee9ff8b9af477c6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750651, "uuid": "badbcf27-0663-4ec1-92fe-56ebdd10dffd", "comment": "Malware payload (Amadey)", "value": "c76dc65442745141615dca2831f7dceeec95065a00e6b741c2b019e48497154c04dd78e5f5ed759441643c72ff5c7aeb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750651, "uuid": "0d4de5e2-3319-4feb-b0aa-fde736523566", "value": "T18CD41202ABE99437E9B0277104F603C71F327EB15874929B2796790E0D336D4A2B5B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750651, "uuid": "73759513-ffdb-4d8d-9a5f-13949b9b7691", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750651, "uuid": "22ff54ad-d1b1-4a30-a0c2-40a85a1f50f7", "value": "12288:aMrmy908IjczWmkwWqXbTNRrU5dqm7FzCJ54hlmB:Yyz+cSmbbZRrkz7q4hg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750651, "uuid": "20514212-aacc-4620-a49c-a2626539eaba", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750651, "uuid": "316336da-d2eb-4471-8fad-aadd7581893a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750651, "uuid": "4280c617-cf58-47a0-a4ba-02c54b97eeaf", "value": "4a91acad201dd7090a499627f258dab3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b361ab8-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686750520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750520, "uuid": "5298a793-1346-4e3c-a3d9-ec580cb16533", "comment": "Malware payload (Mirai)", "value": "bc859fedf35b5bd8a6a4610b54c226ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750520, "uuid": "79141090-f330-4f49-8179-2b8d4ea5fcfa", "comment": "Malware payload (Mirai)", "value": "1944771cdba491de8461774d06abfee2c579c887d59cf116e30e1192923e629f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750520, "uuid": "f830078f-113a-4a92-acbe-a8a9882b7f15", "comment": "Malware payload (Mirai)", "value": "77fae507ef80a16f6da9c027d9af641a44828dc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750520, "uuid": "69d37fe0-9adf-436d-889d-7cc4ae48e6cc", "comment": "Malware payload (Mirai)", "value": "0eccc4700678ce97e1161322e4a499cab7499c7a01b331fd409b3c71d7b4f9ff3cfd5b297bc6461adfb911b7c5c89e91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750520, "uuid": "94a245c8-b939-4667-aaf2-071eceac6cf8", "value": "T152F21A5D69012D1CEDCAA8FC652A8F59DA553310E1A3070FE3B9FDD22D33264BF19286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750520, "uuid": "4dedd58f-daea-4fc3-94bb-b70e573b2851", "value": "384:6Jz8DmeY4GNZIZI4VmFfcS/l0exp0yBz3gt4utaUxBNwel76X3sD8c8JBZKHG:/meWZIZ7IfZd6KcjNRlchRom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750520, "uuid": "54178481-4b0f-47ae-bfd7-18c2720077b0", "value": 37168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750520, "uuid": "7f65489e-28db-4f88-a0c9-4dda67a656ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750520, "uuid": "cefa70cd-7f04-420b-86be-467df73cc053", "value": "bc859fedf35b5bd8a6a4610b54c226ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6cbb10-0a81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686726171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726171, "uuid": "1270d930-3ed1-4bb8-9665-53d62782e24d", "comment": "Malware payload (Formbook)", "value": "c49c0da7274ddaad2edbc5a73e9fd72f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726171, "uuid": "c18bb871-28a0-4ce3-b604-2c4c8769a995", "comment": "Malware payload (Formbook)", "value": "1a5d0ea67ecdc0031e3f45c4486b68596d322e1770ed382a5b81374253c2b58d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726171, "uuid": "6d65e92d-5120-46a4-a2b9-977663775050", "comment": "Malware payload (Formbook)", "value": "78cfb54aa214dea1dc89d069ff3d92981ab5ef77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726171, "uuid": "a4f3637b-8dbd-4e43-8170-cb22ae8b81a3", "comment": "Malware payload (Formbook)", "value": "5c38555adc2b77c1e2dfaea122832b76315e6a56356a307a92dec5d800afce90cb4a57d64edce5c32399c9f940a0963e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726171, "uuid": "3902848e-6e90-4520-9895-9b7e120f81ba", "value": "T113541292BA94D573D1F607B05D3B177AAFF1EA28A06E1E4F77100B1C7992211AC1E783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726171, "uuid": "6d1544f8-dec3-4cab-854d-f62a0fba7fb2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726171, "uuid": "c2c2dd50-2f21-4a59-a3df-bac4819e9dc5", "value": "6144:vYa6GESXLlmcS/C+o/g0UoVyifSF8bu8k3TCGFOErMP/gP:vYwNUCvyz6q8k3B74P/gP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686726171, "uuid": "3c351c4f-dbd4-4811-b030-b9f66634e68f", "value": 282085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686726171, "uuid": "37c05d28-49b7-40e0-8ffe-7687b909b40c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726171, "uuid": "cd46abec-2e9f-4132-a04a-b7be2a20e2fc", "value": "Marine Loading Arm SEACOR Marine Rfq Relsa Ordering document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a256fe39-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728815, "uuid": "6b122f9c-5e63-4bbc-9563-a8e341d7cf13", "comment": "Malware payload", "value": "90f85d01f0d28e55b77e577d0249f0e4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728815, "uuid": "5a7b8f74-24cb-4036-b3de-d491e47f0508", "comment": "Malware payload", "value": "1ab1b8718e6f930d3cba401c52e2765d9a40eae41f9f08c4fd62decb7973b6e2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728815, "uuid": "ee8ee1f1-fd72-417e-b367-b18b7bac89be", "comment": "Malware payload", "value": "670c4f13bdc256c62c6bdb6b989cd916dd1054b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728815, "uuid": "6158402e-8219-4550-863d-bfe80ed465e5", "comment": "Malware payload", "value": "e1667859740399fa687d0f2ec57247745ea4b6989a4911370b9f78690a726ff1a17cece1611083bae3b327e2a467cfaa", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728815, "uuid": "48c88612-c1cc-401e-b6ad-5d007eadc345", "value": "T1857432896640E0F09237B37BDE178410FAAB0F5B10C48972B97C51596F3D8697AB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728815, "uuid": "7216cd00-1889-49d3-92b4-fd98d1faf023", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbdJNYXhg92kvOYP8ZJhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728815, "uuid": "c61b6869-0ec4-42bb-bdae-5db4eeef9356", "value": 349450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728815, "uuid": "9437e7b2-6d8a-4a48-820a-678e3e5591bc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728815, "uuid": "0ed7b9b9-de89-4a1e-a832-2f2933a3a03b", "value": "OnKAUP90XCMT.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd74c880-0aa4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1686741370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686741370, "uuid": "58832f67-7b06-4ca3-9067-e4c6ae1a1ebf", "comment": "Malware payload (AsyncRAT)", "value": "b332ba58a283826d4d1606c37a97dfd2", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686741370, "uuid": "cb34bcfc-9370-4f3b-b3f3-550cd77cdf9b", "comment": "Malware payload (AsyncRAT)", "value": "1b003797a43807e83f85b2431f1239e9db680d51657be09985f891d4f6612a2d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686741370, "uuid": "548764aa-eeff-4aa1-b5d6-350cb0cdbef1", "comment": "Malware payload (AsyncRAT)", "value": "39c76bdf398ff410453bb867d8f60cde9118b14c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686741370, "uuid": "183e3195-fa8d-4baa-b503-1dfde677f45d", "comment": "Malware payload (AsyncRAT)", "value": "e117fb557d41f193ef980d94d2fe4060a2ea61a9cdcc93c9f0fea82646e49c7ecc609b9d8d962a66a2c79a32e770f2c5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686741370, "uuid": "aa463e51-42ab-4246-a4e1-65e5106e15ec", "value": "T119231A0037E8813BE2BE4F74A9F2614546BAF2637603D54D2C8452DB5713FC69A426FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686741370, "uuid": "0930fa2f-dd3c-46f3-9a93-64c87d81580e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686741370, "uuid": "57e4858a-2c2e-4000-ac46-4a5440f1a987", "value": "768:MuwCfTg46YbWUn8jjmo2qrzM4dxYkvwPPIxTjbwgX3i21PT5fd8ipS1i/Xy9MBDG:MuwCfTgp/2IM2pxXb3XSyPTBd8cS4Xy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686741370, "uuid": "9fdbe162-5773-4d6b-af38-54260dbed67e", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686741370, "uuid": "a20b08f7-1e74-4793-9509-802cb62844d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686741370, "uuid": "0310f6c1-5212-403b-bc62-cfc636764282", "value": "b332ba58a283826d4d1606c37a97dfd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fb0150a-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728327, "uuid": "68231b9e-21b4-44d4-be65-70939e249f24", "comment": "Malware payload (Quakbot)", "value": "5146cd03d2e22d37156c7c5af79190c9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728327, "uuid": "c2e1d145-a5c8-46c5-8ae8-624f19f36957", "comment": "Malware payload (Quakbot)", "value": "1b274b1ea61e38b4b5125e0ac36550da16f5ede11ccdb32eea5aea1fd24ecc17", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728327, "uuid": "413b7c89-c470-4ccc-b4c6-a394ca1b3491", "comment": "Malware payload (Quakbot)", "value": "c5d4136899559f78a075ee7c92fb22efc6fa7ec7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728327, "uuid": "a267ee76-f261-4f91-a01e-96ba4b89dfc0", "comment": "Malware payload (Quakbot)", "value": "ecd780d3224b91905e0dfa6838be0f71acbc9a7603c14be96a2a252400d062c9ce4e785b4aeedcbf5294b85516cfc5ae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728327, "uuid": "70bfcd86-77bb-4447-9b88-b3ab657f4c45", "value": "T1F26436896A45E0F08137B33BCE179410FA671E5B11848932B97C61585F3D86DBEBBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728327, "uuid": "49c721d0-e34c-4d93-938f-f4ea8991bc71", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbsGvhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728327, "uuid": "07364805-0776-43e7-b217-5f5d31c71669", "value": 313909, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728327, "uuid": "c5275662-9be7-4c60-8bed-356ec33fc3f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728327, "uuid": "8e2dd89b-7518-47d9-bd8c-a87514b03dc7", "value": "Yy7EKlxmkcEj.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad26a1a1-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728404, "uuid": "2600e3ac-0b71-4d75-b18d-df8b8189970f", "comment": "Malware payload (Quakbot)", "value": "408af5a57a98f7c8c9dd66134a0867f5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728404, "uuid": "9f827437-8c81-408f-ad49-1cd08208d233", "comment": "Malware payload (Quakbot)", "value": "1b3e3c12210767938b8b0574c31c17ac4246fefce53d0a34080a685946e8f4a8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728404, "uuid": "1871f0a8-b00f-4d6b-9b62-4f29e00371f1", "comment": "Malware payload (Quakbot)", "value": "f6f539e0c8ab0181adb27f223b9e1ea2a0fd7ebb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728404, "uuid": "d1031dab-7a11-43c2-a24d-8496b651a4dd", "comment": "Malware payload (Quakbot)", "value": "b1c566d3618d22b2b20c22c7ee407faf4f70f957217e43ae6869c4b197252e7af45ffea84403a26241e5908e4d95e8ff", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728404, "uuid": "2062751b-a350-451e-a614-53e58fc0e34a", "value": "T1B26432496A51E0F48237F33BCA178410FA6B1F1B21848972B97C505D6F3D85D6ABBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728404, "uuid": "da2b9fd0-8076-48c0-b41b-4ffaa4c4490f", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb3jP2YjxuhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728404, "uuid": "16145f3f-0bd9-4f70-8b17-148a9df701e8", "value": 322608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728404, "uuid": "6d7e8dfe-2a8d-4f53-9e24-fe0aaa941a63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728404, "uuid": "ac1779b7-6ed9-4778-8ae0-5ff3c3854c41", "value": "WnDK3vYAwLWFS.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dae4c49-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728619, "uuid": "6551c52a-adef-4268-a334-3c22d3d8153a", "comment": "Malware payload (Quakbot)", "value": "d83e09c60b5d75a8dcd8bab8aab50d0c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728619, "uuid": "aeea0a95-7895-45c2-9300-1d85a689a32e", "comment": "Malware payload (Quakbot)", "value": "1b51b8063a026dbefcdb1f41c988303956a34ca1bfe8b09e9f8eb8a8bd2b0905", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728619, "uuid": "26bae70b-ef70-459c-b6d9-ae5b3510398e", "comment": "Malware payload (Quakbot)", "value": "90bc18245928002ad7c8e544223e32fae3297f13", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728619, "uuid": "8df3523b-9029-43d4-a998-744ed79a96c6", "comment": "Malware payload (Quakbot)", "value": "765c1e36d64fe5cbe8292ce59c9b23b5700348d2e6a7fe08fd71b7c59ff8738d70940476a34dd98526227c4d1866b980", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728619, "uuid": "ef12cb36-d0a1-430c-bd45-e2bf96ce0107", "value": "T1417424896A45E0F04137F37BCA578420FBAB1E5B10848572BA7C60585F3D85D7AFBE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728619, "uuid": "f60b5062-3728-4ae0-96ce-c5e7c4691188", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb3fmOE2MY1hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728619, "uuid": "18ceaf74-fd4a-4954-b057-3466afcab634", "value": 352316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728619, "uuid": "0d50319e-0868-4ca0-9279-57da936048b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728619, "uuid": "edfb5403-b73d-410d-8c1f-1aecdff0f177", "value": "SyluCEzqroQN.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0357fc8e-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728548, "uuid": "021e75c0-73d4-4bbd-af7a-f79520cdc465", "comment": "Malware payload (Quakbot)", "value": "1e9f42222ad5a0c64ba7a70ee0140523", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728548, "uuid": "4ceb747e-fb33-4765-8ae8-8a6bad994443", "comment": "Malware payload (Quakbot)", "value": "1b64c00768c6add77bc652b656bb85be65d2b30e8af0bbb96515146e20b6e9c6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728548, "uuid": "6187e761-ed03-4371-9ea6-700f1823b673", "comment": "Malware payload (Quakbot)", "value": "e322c0f55d94f4fdaec2779453b772a62ceb7fe7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728548, "uuid": "0ea29f4e-21f2-432b-8fb7-b5ed615a181c", "comment": "Malware payload (Quakbot)", "value": "f89dfc12c142700a1cf31852d469d07e6846a50aff13e4b4ddf6f8d5d4bc6c5b7d2eb8f90f6a65a210d51e4f9e6e88e2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728548, "uuid": "5ce8da79-1a2c-4f43-8229-7e08e615318e", "value": "T162645589AA45E0F19137B377DA5B4410F96B1E1F20848972BE7C505C2F3D429BEB7E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728548, "uuid": "a7b2353a-47bb-4e1c-a73c-a29a8c77e766", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbA2xzHo4lL4hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728548, "uuid": "4842d68a-4e86-4d2d-a2b8-49194452cf0c", "value": 336528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728548, "uuid": "1292cb4a-7afe-449d-a3a6-b68c6e4748d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728548, "uuid": "2b18ceec-ee3c-4940-b303-4ea7af5835ab", "value": "UIP5X4RVHW8dB.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ab2ed23-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686750653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750653, "uuid": "685fa2a3-53cb-4367-9d1b-5540aa685006", "comment": "Malware payload (RedLineStealer)", "value": "7fc34073d7ddea96f3ceda8bc3f1934e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750653, "uuid": "65f59b4b-f32a-455c-a7cb-ada81940db64", "comment": "Malware payload (RedLineStealer)", "value": "1b8f09ce5298d85ed40914389df71cd7d7981df34220d9b5eaf9b1dc1c7e2e0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750653, "uuid": "3f02d2c6-8c37-43bf-a164-61045e945d3d", "comment": "Malware payload (RedLineStealer)", "value": "b44a719e4729051fb839f46b88d110475a911b3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750653, "uuid": "4f81ba44-6fdd-48e4-869a-c8140b63b620", "comment": "Malware payload (RedLineStealer)", "value": "01c1279cf7520313252ff1e9c8f3e468864c299e522e5dc6fa1c1f6a9e6c1bca4530e19184f2f75a7d8e475db33e8829", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750653, "uuid": "f3aa0039-241b-49f2-961c-b47236788a08", "value": "T15A052307A6DCA432E9F227B428F712D31B35BDD24DB407AF2B55DA1A0C72698A435337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750653, "uuid": "5251e1b6-decb-4ef8-b9b1-5930ea1586b1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750653, "uuid": "c33aa7b4-5078-408d-8563-0337b99e18fa", "value": "24576:0y3iPc8Sl6m0FGdoorgNQsOJVHS2qikRZeLk3:Djld04doUgNQsOjHS2qikbe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750653, "uuid": "a83dbf38-355c-49e4-abc9-13d09022511d", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750653, "uuid": "729b5982-7729-4cb4-a7b9-08e8b1fb3a3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750653, "uuid": "baacfc14-6c8b-46f0-93f8-9d1236626df0", "value": "7fc34073d7ddea96f3ceda8bc3f1934e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e9c2101-0af9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686777530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777530, "uuid": "7db1a817-26e5-4798-a2d5-522bc4599169", "comment": "Malware payload (Mirai)", "value": "880726e335c4afbd2e1cf9a1cb13c0f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777530, "uuid": "73d1df37-a3ce-4ff0-8440-125e2f113b2d", "comment": "Malware payload (Mirai)", "value": "1c55e14242d6475e3fb26c1fce18e0370b21db0931a330c2528739b6044a9dbf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777530, "uuid": "d07714f9-4724-4356-9a18-91a226d0b163", "comment": "Malware payload (Mirai)", "value": "0c752b5501ed3f4f0c059bd4a1faf578fd9df777", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777530, "uuid": "1793c71a-5b8d-432e-87f4-4c0f80006b4a", "comment": "Malware payload (Mirai)", "value": "61c04082630bf3e1b3ee29b52a72d13d219c5e1673330754b6f83c1455abd12f1ce15597010d2a42ad8bb66edb435944", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777530, "uuid": "f94c6cc0-ed98-40b1-a6d2-e0d4104b69dc", "value": "T129D35E97B4019F3CF89AD27E41274A0DF121A35466A20B27F356BCABBC730959F1EE41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777530, "uuid": "e26d3394-488d-461b-b6a1-314901917b01", "value": "3072:HVsx3VpdD6fnYU39rzmvxYxHK/9sQaNJ/kcNdMHnO:Cx3VpdD6frNrzmvyYINJ/9dUO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686777530, "uuid": "a040e912-1b4f-49ba-b7b0-4c0e5222aca9", "value": 131940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686777530, "uuid": "383a22c2-8579-4f8a-976c-4b03c3478310", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777530, "uuid": "5e4e69bf-a267-441c-bee2-4c1a9430d324", "value": "880726e335c4afbd2e1cf9a1cb13c0f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78b8d2f-0a8e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686731857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731857, "uuid": "c6e46949-6083-41a2-9684-6123fc437805", "comment": "Malware payload (Gafgyt)", "value": "f0dbf068e1c17f410ca60ab52dd275f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731857, "uuid": "3cb7ab50-cd51-4704-b0aa-c8bb115f11af", "comment": "Malware payload (Gafgyt)", "value": "1c776698bfe48885c0af2c1df7d987fbfbc434d3531a3d696dca41d645aa4535", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731857, "uuid": "54b94dd8-9a3f-44c0-8266-53b38cfddbbd", "comment": "Malware payload (Gafgyt)", "value": "7455189c120998e1d08865be3a80be5a072dc3e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731857, "uuid": "a10e5a2c-e8bc-43fa-827b-e22d688aec68", "comment": "Malware payload (Gafgyt)", "value": "9515ae534ee228e8e9b08f06b4de5d22944ef9e8d503805b6f360452a8c3f645f023fb0f5826054e26d1bb8a23921e8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731857, "uuid": "4f94b7a8-fc1f-40ca-9c25-b6480e3855e4", "value": "T119930941FD418B27C2D237BAE78F435D37366A5467DB33016A396EB42BC27982E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731857, "uuid": "d6e9eca1-8148-405f-be75-33e93f82152d", "value": "1536:LBkF9VQPAGaHYyEfgcqpq1innPTxHOxUePczYrmREqQ4b/X7XSee:OQ2HYBv1WTxePcKmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686731857, "uuid": "130c9994-813f-4c3e-9d5a-9e4dfd10059c", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686731857, "uuid": "a7cdaad2-0398-4068-8d84-7081a1fccc01", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731857, "uuid": "50b491ac-bea0-45e2-b352-ceee175ba081", "value": "f0dbf068e1c17f410ca60ab52dd275f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34a196b-0aeb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686771874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771874, "uuid": "7ba3eeb6-a1dc-464c-ab22-cdb50b700eab", "comment": "Malware payload (Mirai)", "value": "b946bf03df38328242146d902910a651", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771874, "uuid": "ea65d75a-18bd-4cbe-b563-659e6a57f6b3", "comment": "Malware payload (Mirai)", "value": "1d84c0a96b2adb963a6ec96ec20fd882e54f7602a4393ee87817a1fd02e88978", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771874, "uuid": "55047330-d710-44b5-b7a6-3f2640146f27", "comment": "Malware payload (Mirai)", "value": "5a401daf776a246466486bde4d75000bf889b610", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771874, "uuid": "2fb850e0-f16e-40c2-9699-ca1884f4a088", "comment": "Malware payload (Mirai)", "value": "7ae905699ac945e4afaf8efe98164496804eeb8c8d3629d6ca347daf50a9933e040b9baab0fc05c922076a026683046f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771874, "uuid": "23c705a2-7654-446c-b4b4-3d0bafc2fc71", "value": "T144336B36E029DED0C5960234A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771874, "uuid": "8d12c3d4-9f2d-424a-9488-f8fe8bca1a63", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+ydZCZQoVjfjmCozw:Oa4U7G7SvT6ftBTydZKVHmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686771874, "uuid": "55ec8d7b-3fe0-4a95-8f3d-4c5ff158a2ce", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686771874, "uuid": "5dc879ec-e55c-4ae0-bac9-f038483bb256", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771874, "uuid": "61a192f1-14d1-4fb8-94ed-4d1c0c812c09", "value": "b946bf03df38328242146d902910a651", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ecdc58-0a7c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686724236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686724236, "uuid": "75b809d9-cdea-4f70-934f-a2973430a727", "comment": "Malware payload (Amadey)", "value": "c070c0c938b83a9920e2e393ef4d5d3c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686724236, "uuid": "968c828d-104d-4f10-8284-1e4bfd3a4c96", "comment": "Malware payload (Amadey)", "value": "1da0644ac098e2c392c1cdab654f8f9d95b0af32471cc1edbe912a842641df31", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686724236, "uuid": "3800e543-4e5e-4681-9dc8-af02441be03f", "comment": "Malware payload (Amadey)", "value": "25f4b4954d8d2d3f71d28bd7d2424e628a53e5a5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686724236, "uuid": "73078673-25f8-4c62-8c1c-4200e795d832", "comment": "Malware payload (Amadey)", "value": "0262ce3515c4d207fcc6f9f909a0874cd181d4fdb26fc2fb56ad626add9983d66c6d2d03435115345d481d10895e389f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686724236, "uuid": "9556bde0-ec03-4901-9d49-58cbf8056792", "value": "T1F8052213ABD84076DCB5277058F312930F3B7CA16978936B2785249E1EB2184E536BBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686724236, "uuid": "bc320f51-f5db-4cc9-a0b6-cc5bb1a51603", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686724236, "uuid": "4d6383f4-96a9-4b83-be78-928407092a2f", "value": "24576:FyfU7dztBkpN5OGLM9JdGDkEytwJA/knlE:gfUpIHZLM9JdGD7owG/kn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686724236, "uuid": "4dc02c66-02bf-4fe4-af3d-f4bc670e225d", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686724236, "uuid": "00eaa3db-06f2-478a-b505-8454707d7c8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686724236, "uuid": "0710736e-726e-4a5c-810c-d81c7e814f5f", "value": "c070c0c938b83a9920e2e393ef4d5d3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdd2037-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728140, "uuid": "fd21c151-5316-4ac6-aafe-914764d1469b", "comment": "Malware payload", "value": "35ce6e13e1f3b40f19dd2e7c2f4d8bda", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728140, "uuid": "1083beb4-5773-48e8-a060-a01832c43092", "comment": "Malware payload", "value": "1e567b4015164976fee603e26a6bff005f1d0bee5c66f2b55c5a715d318a3699", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728140, "uuid": "67b73d5b-bb93-45d9-9095-7b761310244c", "comment": "Malware payload", "value": "f314f524514b951d1c05c108c0ed7739c1d77331", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728140, "uuid": "2722baaf-99fa-47ea-9929-603ff85f1bfe", "comment": "Malware payload", "value": "aa7aa4deca124505963653f1588ec947030c8a3d630e5321bc8689ce7326b305c69b065fcb70f4adab7658dfed5259ee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728140, "uuid": "ddfd4900-ca9f-4370-b35a-24d0837d7bec", "value": "T147746285AA45E0F04237F33BCA575020FAAB1E5B10848932BD7C51596F3D8697EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728140, "uuid": "14fad8ba-b6b3-451b-a3fa-bdca40a74c45", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbxVvALN5IAbghS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728140, "uuid": "82f85f25-563f-4b11-9475-c5dbd785e9d1", "value": 353324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728140, "uuid": "2ce80832-272a-4069-b1cc-9b1e4b8231be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728140, "uuid": "0b2d0a2e-f2c0-4f2f-a998-29ebd10c9246", "value": "cz3EfRwcgvveH.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee244ff6-0aeb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686771892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771892, "uuid": "436afc1a-d582-456e-9505-310e19daf7cf", "comment": "Malware payload (Mirai)", "value": "e3550c8adebac44b1f8de953a7558149", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771892, "uuid": "138470d7-ab48-494a-a603-719f844ea5cb", "comment": "Malware payload (Mirai)", "value": "1eb133a8bf7c129119737871c50a9d98cb7d140d59cb0d89fa7d06c3584d3808", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771892, "uuid": "d83aaa73-60f5-404e-b0a2-9b31b5ee0dfe", "comment": "Malware payload (Mirai)", "value": "b4989f03463cc2e58b1cb4eb22a1fb5a6bbfec9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771892, "uuid": "4c916672-d739-4d78-beca-30078e53934f", "comment": "Malware payload (Mirai)", "value": "bcd042600a283c00ef264eea5a1af3ff0a4fc06cfd6f75f860b8e5b301b2f621e06b44f1054b0bf662ce2dab46e83e96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771892, "uuid": "780a5c85-357d-49af-bb41-6fa92592856c", "value": "T1FA23F1616980AA10F3B50E32EC2C9647A7C997ACF2B974E137D8496C5A935D10EE7CC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771892, "uuid": "6b1f419e-a76b-47f2-a420-5764b94c1468", "value": "768:gW2myW5zrY3m+KDOtELVpuyUEQNIM4ZktwkVlXFbkdzxa9q3UELMIk9r/e/lQMq6:f7d5zrY3mVqtSEyUE0IM4Fk7FbkdzdLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686771892, "uuid": "667ca708-fedf-49ca-b91f-a2b8ef677be3", "value": 46648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686771892, "uuid": "01cfa7b5-1b8e-430b-bb8c-d3cb2c945fe0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771892, "uuid": "2ac2394c-8490-4e06-9219-7255178d72f8", "value": "e3550c8adebac44b1f8de953a7558149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21dfecd7-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686728170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728170, "uuid": "29f9b179-2c05-4a6d-ac98-3ca7a515bdfa", "comment": "Malware payload (AgentTesla)", "value": "a2d8195f917d9e50e1765926996f8b3c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728170, "uuid": "bcc8c807-223f-41ed-9070-1a8158424ca4", "comment": "Malware payload (AgentTesla)", "value": "1eb3ffb0fb85f3ea3e23ff4951f0902a6362b9c42106e79b705ac8aedd8b21f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728170, "uuid": "8cad8dcb-73a0-4704-9f12-5eb6a74aeec5", "comment": "Malware payload (AgentTesla)", "value": "e20d5b5cb29242c91b20e6e3bedac13e269e88db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728170, "uuid": "aad0126c-ed9c-447a-bd0e-c6b93c48be65", "comment": "Malware payload (AgentTesla)", "value": "79cbd2dd166c0e306efba1cb0fbad30d2cdc60ae9185485b9487bf992ad794571470897116e43c97c5798018f4fc1d09", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728170, "uuid": "93e72841-4d81-4de3-b3cb-60635ae2e233", "value": "T166051200ACAA5F53D236B7F94F1172B037FE1ACA3815F38B0E8AF4D56969F051A41A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728170, "uuid": "0153aab8-0aa4-425e-8633-eaad8b146e35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728170, "uuid": "b8498864-af92-4651-a918-4e4be82ff3cf", "value": "12288:P2cvG73htU7/2eQ1x9o40vM/Oz56QKHaovm1m6XKXTgZ:OgG1tCueiS40vM/M56zHaovumHXTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728170, "uuid": "57d73e1a-bed9-4cb0-b16e-3dab0c109648", "value": 822784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728170, "uuid": "fa855220-7e0c-4eb7-a7f5-2a200859008b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728170, "uuid": "fb444df6-2b16-44ec-b555-b68cda4db7da", "value": "bill of lading.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67ca9c8c-0af2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686774673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774673, "uuid": "a52c7e7a-c81f-47e6-8a56-e6ed2a146e19", "comment": "Malware payload (Gafgyt)", "value": "d67c30d90419239cfdc670205ae0f30d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774673, "uuid": "7ab21437-5e43-4032-be30-8f7b1b575ead", "comment": "Malware payload (Gafgyt)", "value": "1fb107eae74424af3c0cda446da3f2071265722a120f77a314b672485d6cfee8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774673, "uuid": "aabb2edd-12fa-40a9-9385-3415e9747463", "comment": "Malware payload (Gafgyt)", "value": "f0bf0bc15924e41c4085c2137b9db967c1d31350", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774673, "uuid": "6d7f75c0-8503-4e08-9600-d7154a4d70fd", "comment": "Malware payload (Gafgyt)", "value": "060e34da1d4e296c8f08962d71feb6efedb836fc3695c2a24823f8e1bc3f108a3ddaaaab60e851eaee86dd0930f2e3f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774673, "uuid": "24e15db2-d3d0-42b4-bf75-9621c4ff4200", "value": "T188E38366BB619EB7D80FCE7309A64501118CDD4642D93FAFB2A0E51CE76B84F08E3E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774673, "uuid": "53365cf3-aed1-4b6d-89e8-4c2f35f71b7b", "value": "1536:bVeTpqCVvWRYx0O9vPBysZgvsgxqAz/0ufMytVppLtaoLAImlP+s4zWfOodW:byvWmBx+sK/PflfgImlWs4zWfOodW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686774673, "uuid": "6f645834-141f-4e04-9be2-a2b85f98ed13", "value": 152201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686774673, "uuid": "3f7e9864-15dc-44a7-bec6-1c6a862cd239", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774673, "uuid": "48cf76f1-3f46-4020-aa3e-c9222669d52b", "value": "d67c30d90419239cfdc670205ae0f30d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463564ec-0a7c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686723936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723936, "uuid": "376b27de-7da1-47f4-9b97-0ceb1d89ae9f", "comment": "Malware payload (RedLineStealer)", "value": "9359d442fdcd24f1e8d608c65adc1913", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723936, "uuid": "a711b339-d91c-48ef-a03d-aec78f12d0ef", "comment": "Malware payload (RedLineStealer)", "value": "1fc014209b6ea611c6b38bd3f77802ef1dcd9f43e61e98ac66f8d356f10dd176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723936, "uuid": "af22aee1-e1a9-4a5d-b839-7da87cd24032", "comment": "Malware payload (RedLineStealer)", "value": "5dd340565e40f2fb068d95cfee8c35df7919fae0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723936, "uuid": "6e0a318d-506b-498a-aa55-3dff94091c35", "comment": "Malware payload (RedLineStealer)", "value": "e05768f4803c20390f51e366fbb369a6f49293b242d50ca2da63caf7b5f9099f054fff152c556d4e49c3395119ef23db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723936, "uuid": "357f1317-f01c-40c2-8b6c-9c702117ae1d", "value": "T1A5645CC0991CD231E2838472E87B4263960CE8367A54D7EF2F86A57CBA766D1CD54EC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723936, "uuid": "e3ab797a-ef5b-45c5-b605-2e4bd50621c4", "value": "5b43169544844188711b217df61eb2d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723936, "uuid": "cd5fcfaf-1663-4fca-867d-6fdca567b0fc", "value": "6144:BHm6WsGgYVXHDJmqY704pnH7hYx7oPG5RU0nCi:DRcXHDEqYTVYxPRU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686723936, "uuid": "6566e783-c2f6-4058-ad56-6995a8e93670", "value": 326313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686723936, "uuid": "1eafc776-b799-47b7-8ecc-d6aae2261374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723936, "uuid": "6f0d0b75-a950-4b40-980b-42d7bc167af0", "value": "9359d442fdcd24f1e8d608c65adc1913.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69cafe71-0a75-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686720989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720989, "uuid": "64669bbe-37f0-45e2-a537-ea2036e75492", "comment": "Malware payload (Gafgyt)", "value": "07f2ce78ac487e7218fe12196e56c50f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720989, "uuid": "f2f0586c-2805-438d-8f64-fa74b872438f", "comment": "Malware payload (Gafgyt)", "value": "206080e9123f7970224a5c9acab67d0bd1dbffb716462abc2888309d4e2b58f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720989, "uuid": "ed8a0905-595a-4ab2-ab99-5a6283746f2c", "comment": "Malware payload (Gafgyt)", "value": "a3dc08c08c0788bc837652b9ab34152d6551d4df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720989, "uuid": "c3ff8fe2-2588-4f47-bc76-bf2c891bca1b", "comment": "Malware payload (Gafgyt)", "value": "0fad979588b197c2b80a3737eae68705c45ca56005e34607a0f61ba48e5b06655a32e49e068fa12ed9afe00262ad4685", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720989, "uuid": "3bf3c8ce-74e5-4d39-8c47-992582d15238", "value": "T1C433F185054919FAC4BE2D72F81B3E5F4D22673FA820606745CC23BD0D29ED2AB993D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720989, "uuid": "5ea9526b-7283-420c-a3d4-c15d190e6e53", "value": "768:c8Fso9JqItA4YeXF2HuOP6dG3bEUeLBi5r0WE2eB3gHM7nbcuyD7Uryq85O1lyi6:FTZWSKP/LEUQExMnouy8mq8Y3yipM/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686720989, "uuid": "420d969c-1aa3-4476-b56b-1136059c580b", "value": 52784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686720989, "uuid": "7d83d27d-9864-47d8-aa29-90cc97270498", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720989, "uuid": "e4a953ee-098b-4d1b-84a6-60262e2cee84", "value": "07f2ce78ac487e7218fe12196e56c50f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14d33aad-0af9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686777540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777540, "uuid": "35a41fe4-08b8-46db-b03d-34f6da199f7a", "comment": "Malware payload (Mirai)", "value": "cbbe6e79b51c3bbb692ff116d375199d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777540, "uuid": "50b01817-316e-49ce-abd3-047ffecd705a", "comment": "Malware payload (Mirai)", "value": "2066216145bbfadae5b33e100c09ed07b706e63d7b744a3650233008273f2d3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777540, "uuid": "95caf5b5-8a2e-4045-a5af-5cf2119d0815", "comment": "Malware payload (Mirai)", "value": "6fd956497fb70507a7c8c00c08b6295940d5bdf0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777540, "uuid": "73c010f9-1d2d-431e-978a-d77232764e06", "comment": "Malware payload (Mirai)", "value": "effc2cc2bd31a7ec514fd22aa7de57bb816645984c5e7edd7a62a8752847b6bc4fb89ea5b8b80dff87ec0a61f2d1346d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777540, "uuid": "62041b2c-068c-4d2e-ba3e-9757593299d9", "value": "T1696302C2C4487602F5E2A87DF15E8215522C1B3EF0372BA70B7744745AB4A5B76ADF23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777540, "uuid": "2c2925ef-922e-4f74-a7a4-c353ec75c422", "value": "1536:Nsw7T86rRNpbBuAy8gH+cD0cpf698w8S6ow6du4:Ns4pdRFU+xwBNFowf4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686777540, "uuid": "7bbcf324-e7ae-4ed7-8dcf-daab9b933751", "value": 71512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686777540, "uuid": "b11beeea-e773-46d3-b1c8-9c0627560de2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777540, "uuid": "e911d10d-34f3-4abb-a1a4-6a9cc7e40c96", "value": "cbbe6e79b51c3bbb692ff116d375199d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76971e2e-0a81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686726165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726165, "uuid": "2f133540-8eab-4a33-a606-6bfda486e351", "comment": "Malware payload (Formbook)", "value": "f1f7d6262caa8a3bc54b2bb18f7af182", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726165, "uuid": "461cd454-fb0a-4605-8583-c36a56e794b7", "comment": "Malware payload (Formbook)", "value": "216ef8789007b2c51360d6f812045535868588d44780df04fa8730b4f1081db8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726165, "uuid": "d14e4e98-c00c-4b4d-b0b0-29c02e23c236", "comment": "Malware payload (Formbook)", "value": "e4c2e3bc372d6284afb310bb6c28bad9acfe4e27", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726165, "uuid": "c695da3e-7665-44c4-b234-eaac0e6364f7", "comment": "Malware payload (Formbook)", "value": "2d05dd2b0053ef7b5faf28961f8240fb6790ae6041784a96436f0150e660534e5bfdbe931fb37f4b52335ccb04eed9fb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726165, "uuid": "78a212cd-a069-46d5-ab23-3db23dcfe499", "value": "T11F4423D3ED5D7270C1FA17A8684A6AF598E1EFADD07F2C9BB210032D41C61122D6D8DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726165, "uuid": "57bfbc47-7561-4d34-8070-6153bc5c581b", "value": "6144:bpU8PLnVXglqcw/Cko/g0mgVyCfYF8Js8kzBCMFOErDP/gr:BPLnVwuC1yn6a8kzT7HP/gr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686726165, "uuid": "69061926-ddc6-4095-bb77-1fd7747ac55d", "value": 267353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686726165, "uuid": "180838b8-4598-448b-88dc-56864c441c5d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726165, "uuid": "9df16740-497e-44fe-9909-2f342a9d28d5", "value": "Marine Loading Arm SEACOR Marine Rfq Relsa Ordering document.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a994ce3-0a90-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1686732480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732480, "uuid": "b372da20-2705-49cb-8d4b-b81a40bd50db", "comment": "Malware payload (NetSupport)", "value": "4890239e749f98c54fb1bcbddc46f00f", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "norominis1-com", "colour": "#1D41F8", "exportable": true, "hide_tag": false }, { "name": "norominis2-com", "colour": "#2E5F77", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732480, "uuid": "63635477-bdfd-4440-9f54-883f08d18d09", "comment": "Malware payload (NetSupport)", "value": "221c9baeadb9db299900f69c50fb086bd65d3079c59a7d2e09d6a4cb9cab87aa", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "norominis1-com", "colour": "#1D41F8", "exportable": true, "hide_tag": false }, { "name": "norominis2-com", "colour": "#2E5F77", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732480, "uuid": "3adb3ac9-ccb9-4371-9e4d-afb84311b7fc", "comment": "Malware payload (NetSupport)", "value": "bc1894ef2a79368d8db303354d49c21cc7b20cc8", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "norominis1-com", "colour": "#1D41F8", "exportable": true, "hide_tag": false }, { "name": "norominis2-com", "colour": "#2E5F77", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732480, "uuid": "4a8e8501-a758-4959-a0c2-834472b8dc82", "comment": "Malware payload (NetSupport)", "value": "c521858edfacf568e7e1533c02865cf7c9f52942c368c9a1f6366d473b09190812aafff3ae54889c8afe17d12e7a5486", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "norominis1-com", "colour": "#1D41F8", "exportable": true, "hide_tag": false }, { "name": "norominis2-com", "colour": "#2E5F77", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732480, "uuid": "92cfb14a-d630-4ce8-8680-6f42b70d32e8", "value": "T1FE611A935F49A295C3B3FFE2C9C668C8647C964B80AF30A052DC914D79A41E967CF111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732480, "uuid": "69c56d40-2b07-4948-891b-85bd672e1fff", "value": "48:/jpR02qj5dR1KSF4FhPEuPXbJ4PJSE8vIPqN9WWOOsYeM366n4+RAVEgYJc4cJe:deP5oKmEgIPqN9W7OsYeS6UsVEgSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686732480, "uuid": "85a4658b-f582-4f42-b705-f6489447d430", "value": 3296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686732480, "uuid": "f538d295-fb06-4fef-b3f8-380c95c7c243", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732480, "uuid": "f6c7f1a5-f369-45b7-b1ac-1cfe81104e31", "value": "readme.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed01d73-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728594, "uuid": "c1fd74a5-0920-439d-832b-a2f89d865d76", "comment": "Malware payload (Quakbot)", "value": "ad88dc7759665c3593f8dcc449ce7a4d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728594, "uuid": "618d4f91-ce21-4c82-a957-9bb6e9d3a262", "comment": "Malware payload (Quakbot)", "value": "2269785d0f9d3c221f7ec5be2786dbf397176f1386245c1c3d5f5ebaea544cf8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728594, "uuid": "609478cd-5947-466f-9dec-b3bbc0709c80", "comment": "Malware payload (Quakbot)", "value": "89009a2db581c95753e8dc27afe4ac18c2c8cb7e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728594, "uuid": "6a94f7c4-e547-43b1-b626-94ce64899ba4", "comment": "Malware payload (Quakbot)", "value": "f2a58dda172833f08a9cd6eb4110d95e6a13ffafec9f5bb5f56dce459a5ed1f1b1b3a5f2eefaf0666dae28f263cef92e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728594, "uuid": "fb30b58e-9b10-47a0-aefa-fc3dd7404fda", "value": "T1886443856A55E0F09233F337DA578450FAAB1E2F1084C972B93C50592F3D8697AB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728594, "uuid": "27c6f398-68a1-44be-823c-26c8dddef39a", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb7YH99BAatav917K28uZi3hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728594, "uuid": "e5233e7f-23a0-4200-bbc0-be72cd83d798", "value": 329081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728594, "uuid": "f2767001-34d1-4b83-8b09-43b7b1236696", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728594, "uuid": "57ccf679-02cf-49ad-9704-e75c7c4ab35d", "value": "Tlzyiv98dmVB.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2ed0f0-0a96-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686735355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735355, "uuid": "1b4baa01-5ad4-49be-997c-0728d6535775", "comment": "Malware payload (Mirai)", "value": "95007855753a573e3296beb0be524b74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735355, "uuid": "a083b4bb-00ee-4486-856d-b1353aaf5658", "comment": "Malware payload (Mirai)", "value": "22fa14cf8791fcef8ce9bf4a7c14ad3fd9a21ce930aac096d544dda8e028cf14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735355, "uuid": "ccc10614-cf81-45e0-abf9-66aa5ef22737", "comment": "Malware payload (Mirai)", "value": "faa559776505837f64504b6e7be59683f910591f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735355, "uuid": "cd32c2a5-a6ef-4047-b2ae-ce8163d992c5", "comment": "Malware payload (Mirai)", "value": "a63a9ffe188bb77f2eecc80b788f56aadc085fbdb3c351018e969e8781059c91de4c0db05e6c50ea8b33a74525a7b6ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735355, "uuid": "71289812-3f7d-42a8-93e1-340f5ca6d7e2", "value": "T150337D65F8642CF8D8120175E4788AB9D3939EB640C90CB62CDDE65008FBF59F68DBD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735355, "uuid": "a7ebd520-cc86-41bf-91e0-96ca47ea90c7", "value": "768:HHm764mELERgEpMEFH9YBjsxc4ea8MK9f7UnGOA92ntVsRaDRmhqmqokSjkFHgfE:m2kQnzFH9CkFH4sT9rPDEwhr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735355, "uuid": "6c5bdbd9-bbe9-441e-a609-dadcc92c3e24", "value": 54192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735355, "uuid": "5f2f1b50-6156-4495-981e-1c32b8763080", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735355, "uuid": "4e5e7a2a-3396-40e2-befd-fb134171aafb", "value": "95007855753a573e3296beb0be524b74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ce581e6-0a73-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686720055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720055, "uuid": "ef80926b-103e-4334-bc3a-5c58b1ad328e", "comment": "Malware payload (GCleaner)", "value": "6c0eb2ee4e4fd99e79197bbe29760887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720055, "uuid": "cef7d075-5890-4397-b875-ba3585b42b40", "comment": "Malware payload (GCleaner)", "value": "23055a5ddc6e91c5d2de86767e0951c96debe2a78eaa00239e6e9c52d7c49927", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720055, "uuid": "e83cb39a-d983-44d0-9caa-a00992db5c14", "comment": "Malware payload (GCleaner)", "value": "bfb9e4f02cdb138cc59da7e7e490d55d8f6c1741", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720055, "uuid": "2bbae693-fa21-49f8-8126-82e89dde12a4", "comment": "Malware payload (GCleaner)", "value": "2b07d19a3f462ee4a6b75643b8909f37e51c5f7bc2900a12f28afcab1e8da3e796fccccf55c99a2edc85f23343c4b104", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720055, "uuid": "64cf9448-7b44-4b46-a384-9a8a9e925ef5", "value": "T15744E12372D0D432E4B265314C75C6E46E7EF5624B78A68FF3685A3E0E702E099F2356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720055, "uuid": "6eaf9905-1d81-4eb4-94c3-9a8ed50989c2", "value": "f678da7882c86102a2a8a7a8ee56bca1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720055, "uuid": "a2b533c1-c1b7-49c5-ae0e-f4ce2f83441a", "value": "6144:g91cgnUfeK8M9Q1vQnE2clDITsGywzajPbcmgo3zy:g3cgJ8UlmoPbJgoG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686720055, "uuid": "dcd15c7c-4267-4482-99cc-237b11fcf88f", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686720055, "uuid": "b692ee15-8a18-4270-824a-4e8f442a8a5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720055, "uuid": "60945be4-8e59-4629-97c9-fee890094113", "value": "6c0eb2ee4e4fd99e79197bbe29760887.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e9a21c-0a6f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686718240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718240, "uuid": "a5f5882d-890f-43b6-8f83-4a1e38448ffe", "comment": "Malware payload (GCleaner)", "value": "69bff9635c1faf58ad74e3d63f20cb17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718240, "uuid": "3c16212a-7e1f-4cc5-833e-d089db75508f", "comment": "Malware payload (GCleaner)", "value": "235df791ae7391e3d73a6b64cacb1b15ed8e6e6f22bbfe50f91f13d5ebc84f6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718240, "uuid": "a08911d6-7951-4a41-b05d-e087e83f45e9", "comment": "Malware payload (GCleaner)", "value": "102aea049e387c79ac7748a7bc76d004fa44f9ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718240, "uuid": "1a6f4fbb-fd02-4d65-b0ee-d21c1c1261f9", "comment": "Malware payload (GCleaner)", "value": "45ba5d6a778febc649636bfeb6d29010e64a953b477031055eabea15fe0a974fd42873f8cb1c7630b538d7e5bd19275e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718240, "uuid": "33ea148c-17c6-46cf-8dcc-d66bf7b34ed4", "value": "T1EFE5122220A3B229C1C2513A5F08C074D7E9CC14663ACA2D66F1FE7B777E3A315DB55A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718240, "uuid": "f76cc5fd-9fef-423b-bc53-ce6c3e8841fd", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718240, "uuid": "b6ea974d-fda0-4b1b-8a5a-5b4a8eac8a0a", "value": "49152:n6djJkttttt1ttttt1tPqVFQttt7ZgcTWebB9ICxVmM5e+vXsM3y1RebtIki7j1O:6djJ8qVFYZgcTWebB9tVJ5ecsM3gitIU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686718240, "uuid": "2034633b-5736-4e13-960b-2d23e1d102ad", "value": 3081234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686718240, "uuid": "40f40bc0-42a3-46e4-b151-3a026eec1813", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718240, "uuid": "0caf12d5-0117-45b4-ae31-7e1cef430b34", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c0ae44-0a81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686726331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726331, "uuid": "4f3e2683-5a90-45ac-bca8-908bbceb10da", "comment": "Malware payload (AgentTesla)", "value": "5be80e6badf95e1bb2eec6c5a1dea788", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726331, "uuid": "d1173660-fde4-488e-b9b3-37fbc283d0ba", "comment": "Malware payload (AgentTesla)", "value": "2531cd775a9f35fe0b9af4199052310490998cbfb6133d69717593cf7b421712", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726331, "uuid": "6fc64203-460b-4a78-8ef7-7c66c037b077", "comment": "Malware payload (AgentTesla)", "value": "14ed0bffc71ac763c6069865f5bca3cc69e4bd19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726331, "uuid": "fae40c6b-8fc9-4b98-80ea-1fadd141fada", "comment": "Malware payload (AgentTesla)", "value": "d3db051479b0df75474a3420dabe37c6eeeba84f21934d13d23c98806be7e3fb3d77cb5731d4581dbd43a8628ccab781", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726331, "uuid": "e698d6a6-a786-4437-9926-473f879089d2", "value": "T17A55D040727E2963EABD8BF5015052B087F52F1FA51DE6E85CCAB0EB63F4F804A51927", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726331, "uuid": "86c97b25-25c3-4373-bb61-4ccb8fcf9e5c", "value": "12288:1lKnufEXqXdVxwa0lgHoLluMANIzCV8Pe05atlLBGcc9SX9nd:iq4qXdVxwaZGCVB00tlLsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686726331, "uuid": "3fa7c248-5663-4811-83d1-b07da7fae68f", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686726331, "uuid": "0e98dcc9-1502-4362-b55b-272da7608dce", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726331, "uuid": "2ee7d276-7d90-4ace-b2a3-d10456296579", "value": "10409R4_1.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f37e004-0af3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686775088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686775088, "uuid": "cacf8595-833f-41ac-b4ca-5823c896e14b", "comment": "Malware payload", "value": "d067cb68dd412afca4289f3be851a50a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686775088, "uuid": "a729a418-e188-487a-a8a1-d5098fc5e00f", "comment": "Malware payload", "value": "2556dd7adc577241ad81854101c67d97e75e2c203a4db76ed49b1db3e7a23930", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686775088, "uuid": "b52116c6-4bd2-4dda-ae41-b2d8df03907a", "comment": "Malware payload", "value": "781a616f6a86ae98b56c044ae0be41fa1d07d4b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686775088, "uuid": "2f75762c-431a-4fda-bd49-e4e5a425c04b", "comment": "Malware payload", "value": "6794da1230c95fabceefa4a20a3b57e5ab7ba0c563541a1931c231fd7425f33b25b96f1d7f05afe74022c7c03b17eac6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686775088, "uuid": "facd2ace-e58d-4bc7-b5d1-bb0e259d0b02", "value": "T1CE051201DBD9C473CDB41BB01CF617830F36BD618AB0869A369966AE58F36C4827573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686775088, "uuid": "e2e46fcc-374d-4afb-b1cb-f3cdd9d833b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686775088, "uuid": "f3bf45b4-fb8b-4414-925c-06b6304f4b2f", "value": "12288:MMrqy90nRX2f88LjQ0tHjhaBVErvS3eeztbC2r8pf7ID6i+Rb3c+xyAoH2l/1kBu:uyXjFtcBVD31zlt8p+6iOs+wqldkBu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686775088, "uuid": "89e5bb78-b79a-4efb-95b3-3c794af4f65f", "value": 802304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686775088, "uuid": "7c758f42-4171-4401-85f3-d4bb1459b8b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686775088, "uuid": "3673fa7a-8ab2-4d62-850a-3d5daada86f5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e771715-0a7d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686724272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686724272, "uuid": "d4f3c260-f55d-474e-858d-0044e3e2e792", "comment": "Malware payload (AgentTesla)", "value": "c15fa1fd4cc388e45267b4763205a134", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686724272, "uuid": "6f1c59c0-9a3d-4d63-ab5f-c08342506c8e", "comment": "Malware payload (AgentTesla)", "value": "257ba93dab8da864d90c650cfd8b28bd5df50817f574febd5ae102648c5abf1c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686724272, "uuid": "29baa0d3-052a-43d6-b56b-8c35b31e6218", "comment": "Malware payload (AgentTesla)", "value": "5ed680ca447cbe6a3a46853537c5efc527f66ff2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686724272, "uuid": "0cb8cb91-f4ab-4908-895d-db630d20d70e", "comment": "Malware payload (AgentTesla)", "value": "4fc23fc340b34d7e83c8767a08e05514c574592499c436d6be0f7d3a2fe7f220160ced963c1da8cc566d601e467eb3cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686724272, "uuid": "cc1946ca-068c-419c-9c82-dde9a1b352b2", "value": "T1D305DF81723D2967EABD8BF50161227097F62E5FA65EF6E84CC2B0EB52F0F404641D27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686724272, "uuid": "57cd0abf-6c67-42ef-990d-2a90ddc17636", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686724272, "uuid": "9370be4a-69eb-4e06-a586-96eecd79e134", "value": "12288:1lKnu3EXqXdVn7uRSOW0Qlb0m5SbYz3aZgXrHNHzBhaUnLo1VawAeO:iK4qXdV7uRpQlF5bOgbHNBV4VawAeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686724272, "uuid": "4f589564-4f57-42dd-925f-2acd223b0bae", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686724272, "uuid": "7d65a9a7-0f58-4e46-94ad-acd726da4d39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686724272, "uuid": "49e47e77-947a-414e-b00f-70bc1c01e0f4", "value": "SecuriteInfo.com.Win32.PWSX-gen.9590.31775", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f11a4a-0aaa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686743753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743753, "uuid": "d2bd62d7-88d4-4e9a-907b-cb8f83bd5c18", "comment": "Malware payload (Amadey)", "value": "49b94f2446a3819495fe83b16365271b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743753, "uuid": "0a5be713-32e0-4671-89e8-e45ce9031b9f", "comment": "Malware payload (Amadey)", "value": "26a110e78e7fcfc4728425557d16d66b990ce31254c0f0b581e3d90fafd05609", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743753, "uuid": "d4d9140c-a732-418e-9cd5-eac448f1a192", "comment": "Malware payload (Amadey)", "value": "6d6df6adf7a7262c56f6fb3a438bfece2ac9f94c", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743753, "uuid": "2622ade9-2eca-4306-a751-4fd7de0737a5", "comment": "Malware payload (Amadey)", "value": "eb82930f4aa0ca4a781826cae190664569453af083452b6cea255ca17ef32c7e74f72a32565b3b314f4c6248e8a06a6d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743753, "uuid": "6b686009-c2ec-431d-ba65-2df48fbff13a", "value": "T12B0512967BE85072ECB93B7018F717D30A367C606DB9835F2342949E0D72298693277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743753, "uuid": "dee8fe94-e3b8-4ad9-89f3-3f23493d7650", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743753, "uuid": "489204cd-7a8c-4a84-b8da-981a3c60b7f8", "value": "12288:oMrQy90Sfx7B1b0hcfquZRa/vcBZH5JDZ5V4NsBe6PGIi05Npl1BoXtM:Yyvd1bscfrevY5JF5V46BR4Xm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686743753, "uuid": "67d9d428-8162-4546-996a-109ef57bbb10", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686743753, "uuid": "5041da6c-3900-435c-8018-f9f928cc7d27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743753, "uuid": "587a506d-bdd6-43e4-9286-d0430ca4a8ab", "value": "49b94f2446a3819495fe83b16365271b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924ef0dc-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728788, "uuid": "005342bb-9b7d-418c-9e2f-6c25d80072e5", "comment": "Malware payload", "value": "93cff1438ed1dfa998dab43af9f20035", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728788, "uuid": "cc7dd9b4-399a-4193-8e70-7f9409da5775", "comment": "Malware payload", "value": "26c06f04308b5fd5720e774eb5a489f56df3f852d5b7159d1f55141d5593bfd8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728788, "uuid": "6757af5c-0527-49f4-8b99-4175a693892d", "comment": "Malware payload", "value": "c304b634641f5fea917ec77e58668ca02d4c32e7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728788, "uuid": "a2a10c57-c91b-4474-9171-941477a51d14", "comment": "Malware payload", "value": "0106691bc20262d38936fe89ad2356f3188236186e430f4f9b866b3e48aa05e7b0596270ea67099fe67a2d8b33fd1ccd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728788, "uuid": "4925510f-dd6b-4233-a309-42b6728d210a", "value": "T19D7444846A55E0F08137B337CA568410FBAB1E1B2184C972BA7C60596F3D85D7EFBE84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728788, "uuid": "8a8481ef-0daf-462d-be98-801852ade036", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbnGtMWVxPhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728788, "uuid": "2464d4b4-2133-4851-b5ce-6d11c43fe939", "value": 358881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728788, "uuid": "28174170-e361-4e48-938f-101eedbf35dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728788, "uuid": "d4f50258-2ccb-44c9-aa36-6e745ccf27af", "value": "Pmp48RAtNdcvRK.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa3048a-0a9b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686737446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737446, "uuid": "17e15f3b-4f4d-4b63-add7-b3383f2798df", "comment": "Malware payload (RedLineStealer)", "value": "ef8e8a0e99e50a40cc1e2f377d2382e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737446, "uuid": "18bff1b3-c0d5-4b31-b547-7785f012bd4a", "comment": "Malware payload (RedLineStealer)", "value": "273f6c085b96913230891c6bb1259f3efccf0345fbe737ec78b68ad27abc0ab3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737446, "uuid": "38f040e7-ed16-4458-abdc-7fa2ebdf65b9", "comment": "Malware payload (RedLineStealer)", "value": "3e771bfdaed2ee569106e181b961e2de970200db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737446, "uuid": "93c8b2a0-8581-40f3-ade8-a3e6401e7d7e", "comment": "Malware payload (RedLineStealer)", "value": "12814cc0405ced4b5f397b0304c24161f5e2cdc6944cbc1fa11e5922deb67563ff0b0b1848fc396aee6e9d2928ebfc06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737446, "uuid": "ecdfe205-5742-426c-976e-43fa5bc3f1df", "value": "T168543AB77792DB77E5D1D0BB9B2351A9C420A8F4B2DC24CED2806B1E56201E68FF0617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737446, "uuid": "4eaf2c18-7939-4cd3-a941-6e0c6bde5540", "value": "bb6d69b7632b1e5c0fdd9e8372c6b738", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737446, "uuid": "86d2e2ed-89f8-4856-a3fb-77afe666d021", "value": "3072:uTmQ9TJzVQyPE5PQcZ6qGtKY1r63fx8h0A2aH/ylBx:uTmMJzDOPQVqGr1Qf6GQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686737446, "uuid": "a38118de-6629-462b-9d3a-8a8565abec23", "value": 292476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686737446, "uuid": "a58f2714-bc35-4cba-93a7-ca24c6fc31af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737446, "uuid": "a7ce0e72-be5b-47c7-95bb-6bd4ac69f65c", "value": "ef8e8a0e99e50a40cc1e2f377d2382e3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae6dfb6-0ad1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686760451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760451, "uuid": "6cbf9f00-cc71-48ce-98a2-d7c0dabf5dc0", "comment": "Malware payload (Quakbot)", "value": "051ca5b22662dc01d89022625def3327", "object_relation": "md5", "Tag": [ { "name": "obama268", "colour": "#C8D754", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760451, "uuid": "d033dc08-436d-4c88-966d-8a93171a0444", "comment": "Malware payload (Quakbot)", "value": "27bb0a8c1d9f9e7eaee26a97bd01f377c1f3048b881107021f60f7804410ebe8", "object_relation": "sha256", "Tag": [ { "name": "obama268", "colour": "#C8D754", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760451, "uuid": "6212720f-dfa5-43c3-ba93-afb437c7145c", "comment": "Malware payload (Quakbot)", "value": "7069a0c061068c500f7254afa0a2f02ad783d18f", "object_relation": "sha1", "Tag": [ { "name": "obama268", "colour": "#C8D754", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760451, "uuid": "5cb0fcb7-7da7-4989-911e-cafedee23e36", "comment": "Malware payload (Quakbot)", "value": "02881fd8a0349aa88bb916ee49e37b76bbea9aeecb741989ed31640a11c4f8d6e84eda2efcd3f811f488a512b5e6cac6", "object_relation": "sha3-384", "Tag": [ { "name": "obama268", "colour": "#C8D754", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686760451, "uuid": "02270cb5-0431-46d5-a74a-b79af34cee13", "value": "T1DFB313EC728B5A5B7278D983FE15B1067C1235215350BE326699CF013D32E71C691A6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686760451, "uuid": "c172c80e-4ae9-4fef-84c3-3fe0e5d2a4ec", "value": "3072:vB1EnhktGs7M+FRxCV2WoupEEtr61CHa8k2kj+oFk2pOGRj:p1E03M+F7i2WjXr61C68kBfBpOGV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686760451, "uuid": "30d98a3b-a29f-42f7-99fd-e38a4d0060e1", "value": 114232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686760451, "uuid": "24d4da60-bde6-42da-81df-75489e0eece4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686760451, "uuid": "a26f5c19-f81e-4b1d-912a-8e0f74a7ae67", "value": "CalculationOfCosts-141075452.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96e7c3c5-0aaa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686743828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743828, "uuid": "86243a03-24b4-4f2e-8c34-211f666e5316", "comment": "Malware payload (Quakbot)", "value": "fc762bb1ec96f35474311bbb7206fba7", "object_relation": "md5", "Tag": [ { "name": "1686735623", "colour": "#C7EBF4", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743828, "uuid": "8c625f81-dd4b-4f42-8fdd-5b21ba8c39d9", "comment": "Malware payload (Quakbot)", "value": "28594895217bb8a7d617f6e0386195e724406e865655e5bba415396a7f48bb75", "object_relation": "sha256", "Tag": [ { "name": "1686735623", "colour": "#C7EBF4", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743828, "uuid": "d40af32b-e125-4de4-9ce8-ea805a40adf0", "comment": "Malware payload (Quakbot)", "value": "5f11a83a48d4be82915509afa9fd1a9844d87f58", "object_relation": "sha1", "Tag": [ { "name": "1686735623", "colour": "#C7EBF4", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743828, "uuid": "c81a2930-a395-4062-b209-60fb517c9b67", "comment": "Malware payload (Quakbot)", "value": "c5acad4dd3190e5d7cbc91f9a60228895fbde3dabf809b9453c2c5439efac75aaad1e27997560640cbe381af00b81b82", "object_relation": "sha3-384", "Tag": [ { "name": "1686735623", "colour": "#C7EBF4", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743828, "uuid": "6572ad59-c40e-43b6-b681-e553f6ba4723", "value": "T13C91DA95980486226846B0F3AD9AE824743E780518633F290854CBD6BC7A4B3CFF9E1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743828, "uuid": "67142100-49cb-4f17-8071-48582a5e3451", "value": "96:ob0jCtUpAictXvb0jCtUpAictXAb0jCtUpAictXG:ob0jC+pAxb0jC+pAKb0jC+pA8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686743828, "uuid": "b6a9b7d9-eaf9-4010-99e3-b8ed27e7e121", "value": 4378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686743828, "uuid": "4261fdaa-4720-40a0-923f-7851a15038fd", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743828, "uuid": "034046f6-8c26-43e1-af23-3f2990673b2b", "value": "docu_AE724_Jun_14.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744f9fd1-0a8e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686731744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731744, "uuid": "6b726e1e-3593-494b-959e-adf3c0933da3", "comment": "Malware payload (RedLineStealer)", "value": "a379dd6eedde4be1c4daca7d0d90894e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731744, "uuid": "62b67347-2cea-4ec7-94ca-751152205865", "comment": "Malware payload (RedLineStealer)", "value": "28b72070d6af0ef8d0bca993ab7a9997f95dad4b4b0963869d6962383f0647c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731744, "uuid": "2006fa59-098a-4291-b750-8f75d6a9157c", "comment": "Malware payload (RedLineStealer)", "value": "775bf216874ca879faceb19c10252ce5f78d36e4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731744, "uuid": "19f8ea94-1425-4052-9e6d-89d4332e73b3", "comment": "Malware payload (RedLineStealer)", "value": "0c87ffea1c891f8a8bc3758d8d6d20b918050243993e9bacf19cd6d84f4cc6dcb8b1251dfcfc32a996792a39c0671abd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731744, "uuid": "284c3f54-6ef2-4f86-97f2-7e133a97dc8b", "value": "T14B052366A6DCA072D8B2277058F647C30B357DA09D38869B37919C8B58B3AC4F53137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731744, "uuid": "a4ce73d1-78ed-45cc-94e3-4f1041570717", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731744, "uuid": "e99ba546-eaa9-4ed3-8bb6-c3b72a721cef", "value": "24576:NymZ5jf6otc8NeXsXnTlNBKWwA4GhaG7F2V:omnr6otcknTBvzhaG7F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686731744, "uuid": "8ff35d0b-abc0-44d7-93de-e19fce9e4968", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686731744, "uuid": "a115fefd-4e3f-4f1a-99a0-a28179c51517", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731744, "uuid": "9a64b146-3b1c-4ea0-9e27-92d3fdf72411", "value": "a379dd6eedde4be1c4daca7d0d90894e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9025715d-0a72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686719765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719765, "uuid": "239737fc-8a87-4209-b230-d0555277a318", "comment": "Malware payload (Loki)", "value": "cdeb58d22f8a2d63346f3661a0470409", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719765, "uuid": "13626eed-e06f-414b-92e3-d5ab9bcca496", "comment": "Malware payload (Loki)", "value": "2a2dffa21a0803c3d837ab4df1844a649b97c09602879b1356569b61e1cd941c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719765, "uuid": "208a37f7-3225-4d3b-b7f9-58675b3805eb", "comment": "Malware payload (Loki)", "value": "2d58648ec1398da7ab117bd6dd9be99d10d25586", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719765, "uuid": "2e71d2b8-f299-493d-a329-464c955958f8", "comment": "Malware payload (Loki)", "value": "6e1afe282042dd5f7d4ff23b1ac2b5670ecac25ebe8ff38da15f2456348212129bff9ec56cf10ef30fa82d5f68636d52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719765, "uuid": "ddd5bef7-3688-4d5b-9c6d-2ab078f65770", "value": "T165F4CF41723A2963EABD87F5015062B097F62F1FA65EF6E84CC270EB52F4F804651E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719765, "uuid": "63ebbcc0-3a74-426b-bf27-c20cdd2e286f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719765, "uuid": "3c501358-4ccd-4c8e-b3b9-469d4450d90c", "value": "12288:XlKnuxEXqXdVl8sdtbD2+TY/3ynsJ9sHYWAR+ZUvq4EG:kw4qXdVaexSx8KR+ZUv1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686719765, "uuid": "29c053a0-6375-4ca7-a0ac-f453e0921e46", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686719765, "uuid": "c2144079-895d-45a6-999e-a78fa019a70b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719765, "uuid": "e8a01bc4-536c-42f9-97f8-8f3d720b521c", "value": "cdeb58d22f8a2d63346f3661a0470409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3eb1b42-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728469, "uuid": "3500e0f0-4e38-42a9-83e5-5cb032d43a90", "comment": "Malware payload (Quakbot)", "value": "7e0dcf621d81b53ec0125efb1548e0d2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728469, "uuid": "eeb42e76-f497-4af3-b3c7-5cb88cb20405", "comment": "Malware payload (Quakbot)", "value": "2a406608a0ffaba2656cf5879e23dfbe00108787515fb0cf28a1f28ba8b06c94", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728469, "uuid": "f183ffb6-c8f0-45fb-8089-fc2052aa92c8", "comment": "Malware payload (Quakbot)", "value": "85b614fc734bc77b60458269357b241897759b1d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728469, "uuid": "e4210117-9e60-4821-80cf-60ea15519f79", "comment": "Malware payload (Quakbot)", "value": "29a5fe80c874fb20a23de022e38a44c036205b6e85746e2655575cf27ce3e438c205ba3b4a3630ddb50e2f9487a23b97", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728469, "uuid": "0304153b-6add-481a-bc28-29e4907ee183", "value": "T10F6454856A41E0F09137B33BDB178410FA6B1E5B21848932B97C51585F3DC6DBAFBE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728469, "uuid": "40e267a0-157c-4cfd-987f-52cae3cf1650", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbF3h9Nulh3KprAn5nhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728469, "uuid": "2170da1d-5521-4e59-b9e5-686838a581af", "value": 334856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728469, "uuid": "b9672c64-6b91-4108-912c-2b2659826b6b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728469, "uuid": "ea742bf5-93f0-4a20-aef8-32f595098e4c", "value": "UtyFjVGJJBGbZQ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ec5060-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1686728682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728682, "uuid": "753c4ef3-6547-4d46-88f7-7a62b7a60835", "comment": "Malware payload (RaccoonStealer)", "value": "43474276405985c951fff986d0899166", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728682, "uuid": "267911ae-32db-4e7e-b1de-575b5eb1a87e", "comment": "Malware payload (RaccoonStealer)", "value": "2b0a0558db511bed1250077dbb453ac0070fe8d07148050ffc7b4a6ac3726657", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728682, "uuid": "be85ff24-cee3-4066-a1b6-689dd59e0509", "comment": "Malware payload (RaccoonStealer)", "value": "b33754353bca7ba4b28c1f1c2e3d651a942e667a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728682, "uuid": "76f22387-9639-4351-8420-50568702c1b1", "comment": "Malware payload (RaccoonStealer)", "value": "fbd2466467fa481995e323a99b833ee78a4a0192194542293f392dd31ca594161633b6aa1a7ee64d423a5e11a84cb5e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728682, "uuid": "719b4df1-d918-471c-b49e-47bbd90658f6", "value": "T1DF56336F235E5581F6EC8C36C527BD9972B607B78BC16C7894E52DC03722AE0F206A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728682, "uuid": "95330f01-d9d3-4be8-b61b-407eeb7a2317", "value": "895e5e6e037e9108574fb94ed614d804", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728682, "uuid": "2f091a99-f91e-45dd-8e03-1148354bc2e9", "value": "98304:I6kuHWsY1q7BNrYwriaDMb6DdCUAoE4EMvB18kEMEM3nC7UgOUI12:BXWx0BF5nDPdhbEPQEMPz0Io", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728682, "uuid": "5b99065b-1b65-463a-858f-0d7212488e96", "value": 6425600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728682, "uuid": "30fb6678-d0dc-427e-bddd-92699a30244d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728682, "uuid": "d22e3c1b-a670-421e-a64d-77fb043b3e8a", "value": "43474276405985c951fff986d0899166", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f5ede55-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728783, "uuid": "36a93229-cf1d-450b-a8fe-759b475be1e8", "comment": "Malware payload (Quakbot)", "value": "1e409bb4af781ee41f99f44c42745d5d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728783, "uuid": "fedc535c-e226-48b1-b0ea-53ca98509dd8", "comment": "Malware payload (Quakbot)", "value": "2b8df3352f04c06fe9e0b763009baae7620e663224944963c4c5906d36555218", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728783, "uuid": "069a7826-b8dd-46d5-869c-cadc3194b7ff", "comment": "Malware payload (Quakbot)", "value": "0b919d0197c535f435109ad5cf86ed4391177de3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728783, "uuid": "22c28333-dcf1-4945-b8b5-9c620915dbde", "comment": "Malware payload (Quakbot)", "value": "9811b6373e471f13b51e3178b9741e64b6e832ff52fe7752c5e4b0c875ca63358ddfb2de2fa6249caf6d93abc2fa2664", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728783, "uuid": "431f6a4f-2c79-4914-9de7-d01adb1d733e", "value": "T19F6446896A41E0F18237B37BDA178414F9AB1F5B21848972B97C505C2F3D4297EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728783, "uuid": "d5517a33-0339-4a8e-8432-abee5a6b1297", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb4rMM+8vP6sW/JOLNkBMfQUw:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728783, "uuid": "3d4f51a6-510b-49d6-a328-fd58c06a6723", "value": 325348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728783, "uuid": "e4ab2737-ac74-4966-bafa-1f13c756ca5e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728783, "uuid": "892e8440-955b-445e-9733-a50f0c5865b2", "value": "PvW45L1ZR9ZJ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6f6d41-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728728, "uuid": "d9aab124-59ba-4c24-a53c-c33ff64c9441", "comment": "Malware payload (Quakbot)", "value": "371c1d5b7dc465fcf03042d8892bebce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728728, "uuid": "899ea887-6dbe-4e52-a3a3-fb230857b890", "comment": "Malware payload (Quakbot)", "value": "2ba3c60a38843bb6e94665abf69b0b4aacd50fcc34a699882d1c692a97f0c53e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728728, "uuid": "44a81850-7291-4325-ad27-e22d3cf7a6e3", "comment": "Malware payload (Quakbot)", "value": "4e62cb41001c0259e0056f37a335291002df9c4b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728728, "uuid": "69662a75-18d8-4f17-b0ee-194736a46739", "comment": "Malware payload (Quakbot)", "value": "9c6b9cef554fb62b150598c640638de35ab24b10fff97e17d06ab84fe0ed20d3ad762f2f46452019db7bb7268f57f7a2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728728, "uuid": "9442388d-cc79-477a-923d-ea7e5c3d3be1", "value": "T1366453496A95E0F19137B377CA578450FAAB0F1B2084C972B93C505D2F3D8297AB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728728, "uuid": "38abaccb-7f55-48f2-8230-17c4c159b495", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbBiHwaNc8/YjAhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728728, "uuid": "50bd57d3-cf14-4395-9cc0-731a5a7aec47", "value": 327011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728728, "uuid": "bc205343-c18e-455f-9f0a-6fa128c12524", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728728, "uuid": "359f3286-3135-46fd-96bb-4ba5da7d77dc", "value": "RKv4qulgOvL2Bc.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e11166-0ac3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686754594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686754594, "uuid": "7f87efc1-1060-4364-a0cc-6891daf47476", "comment": "Malware payload (Amadey)", "value": "2901f6086718d38d405df05304be0764", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686754594, "uuid": "86af1b9d-f735-4521-a89b-a6c881912fff", "comment": "Malware payload (Amadey)", "value": "2bbaa4bf6ad53f06b66d0d819a899d5526e57013856b46da40c5d278430b645e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686754594, "uuid": "c1340a77-a73a-439f-beaf-b7aefb25e77d", "comment": "Malware payload (Amadey)", "value": "02f09518a236cad3602e6d0b41c67ce5212b1c76", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686754594, "uuid": "037973ea-7eca-4b48-9014-0fc84c5cd493", "comment": "Malware payload (Amadey)", "value": "7b4134771691990a1f3b43cd63fb52ac358146b53e053326b40f734e443ca06464625b12dae56b43cf33299f1f86d2f7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686754594, "uuid": "0f785025-321d-4410-a3b6-8fb656e5f699", "value": "T1A1F41303A2C84477EDB527B159F607831B32BDA1CC7467673A4B689E0CA3AC06475B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686754594, "uuid": "8498c32b-9cdd-4847-93bc-523f1041a534", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686754594, "uuid": "e0203310-d361-4df0-996d-4ad4e9299436", "value": "12288:sMr1y90t6vbUWw3yGDc9lRp3w9JIlkH+tRGVQtkng4mB+6Wcc78VXKXFFVpZ:JyLUW/yc9loIiHkqLsB+6Wccy6XfVpZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686754594, "uuid": "c6b7753f-8a32-43f5-9b2f-0b9595cb4a48", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686754594, "uuid": "3fb0771b-f1d2-4df4-97ab-aa5b9104ac1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686754594, "uuid": "d2e737b8-ed3c-4c3d-8b9c-f18d590ef3f8", "value": "2901f6086718d38d405df05304be0764.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652f3ce2-0a8f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686732148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732148, "uuid": "bde88589-14cc-45f2-a4d0-452732f3cb0f", "comment": "Malware payload (Gafgyt)", "value": "0bc0931af765b48cd9910f7d0094193d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732148, "uuid": "3e2f5ce6-679a-4e3d-b223-19cf3e0217fd", "comment": "Malware payload (Gafgyt)", "value": "2c0c8a3d3ba0df8934a6df94fb0532eb6ebe3210d1177f7fe0a706f6a69e48e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732148, "uuid": "79ec55f0-fab4-4801-9875-51f403c9b043", "comment": "Malware payload (Gafgyt)", "value": "186b95970f2b2d291e76dc7aba2270abdb93235d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732148, "uuid": "3a4bf921-e4b4-4058-a6a8-f4eed4063b2e", "comment": "Malware payload (Gafgyt)", "value": "6d59069507b57e3bb194450747b6850b2667ac43ad39fe64d3973c47a0c4b7ccbfd03333e45058f234af46ea6fca26e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732148, "uuid": "daf5087d-9f96-4ff7-badd-86926f6611bb", "value": "T175733A02E652CAB3C8930BB602AB9B664631FD2A1E2B9F55F31C7DF49F124C87117355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732148, "uuid": "a6e05258-091d-4c60-a1ad-a53e2dd72cb0", "value": "1536:nm+c5osQWiKLoxKFn6pD+OTxzMSMmLI2VOCjXUfJRk:45omr0xKFn6J+ORMmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686732148, "uuid": "03d70bf0-477f-457f-99c5-5a0065d6678a", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686732148, "uuid": "ee0ef439-e854-42ec-a047-2a75f1c04313", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732148, "uuid": "7179b051-f049-43c0-aad0-68b4183852e5", "value": "0bc0931af765b48cd9910f7d0094193d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bbd5e64-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686750494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750494, "uuid": "bbfa8b84-87c0-419c-ad91-ea06ab19abaa", "comment": "Malware payload (Mirai)", "value": "a6b925368736cf9dc7e7ab4293c4b2b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750494, "uuid": "aea94aba-7eb9-465c-b274-b6c2bb57f9e5", "comment": "Malware payload (Mirai)", "value": "2c18cbfa00aafb5c6f970e5edb7d6199b97f98371af9398ba455f29755bd209d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750494, "uuid": "5eeb5179-e3c7-47ec-81ce-a1c2d9beb6fa", "comment": "Malware payload (Mirai)", "value": "a24aac95b7ce4496274f5afb362c96bbef9942c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750494, "uuid": "1fe5d81b-33c6-4968-8055-5b0754015ac6", "comment": "Malware payload (Mirai)", "value": "66d533a12a50245d9ae50127e21956746ff71524ff05cd893b123b000230412780f56002435b44f00ca1e29e44bfdf61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750494, "uuid": "c5f9b858-40cc-4092-8afb-6966dd9f15a4", "value": "T18B633995F4029F3CF88BD6BA94170E05B921638547C30F2BA6A6FDA37DB3054BE25D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750494, "uuid": "69175a1c-868d-4c2d-b074-bfe4381c06b5", "value": "1536:SKYDydkSp1mnPUnI58Ok/Tgp+nJuRbCxNM:SKYD/S/mPUIM/xJwCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750494, "uuid": "1e5de77e-1a4e-4c3f-ad37-01ca9b9d271a", "value": 72332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750494, "uuid": "77434f4d-0c55-4b5c-b716-71afec76b987", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750494, "uuid": "d8fc952a-8b37-408c-8b25-8abf02d79e1c", "value": "a6b925368736cf9dc7e7ab4293c4b2b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d47e219-0afe-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686779836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686779836, "uuid": "f122cd54-b325-4d7e-b244-c6641482e0d7", "comment": "Malware payload", "value": "32abc612ea26e92a75840092efcd9476", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686779836, "uuid": "a81ed950-72fd-4205-82b7-4cfa1e703229", "comment": "Malware payload", "value": "2c39d356cebc298680604be1162f4b482748c311f685734d0e472a199e6756ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686779836, "uuid": "e1d16132-de0d-4a60-b808-56573678dc27", "comment": "Malware payload", "value": "57bd61d833505d7f69d938d9f4531f0006d0bfea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686779836, "uuid": "68f318f3-b7fe-4b70-b08c-0641ae0ffc20", "comment": "Malware payload", "value": "24c0d0859f1374ca4ff2460961db5a4b25b4862c12070211e8ad58a32ce1e9997f3ee44caedb5f3bbc7cac4a4224b105", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686779836, "uuid": "47a17bc7-68ca-45f1-a7dd-ef17e6ab2cd7", "value": "T150349E3377F09833D982E033B7B49674D635B5749B6819CF66C00A652B201F6CE2A76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686779836, "uuid": "7384fa80-2eb6-46c4-9981-fdb96246c152", "value": "bb6d69b7632b1e5c0fdd9e8372c6b738", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686779836, "uuid": "e6f207d4-df44-4604-92ec-ac8e6f10e1b5", "value": "3072:3Xzm3Lt0+Tmy+tnPA6OKZ0aHw60zXxSSTc2SIQ3g8wuBv5GFk9fIBxe:3XzSt0+KKKy2EXxSSTzXQQ7uN5lx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686779836, "uuid": "d857f1b1-24a9-4df1-bf5e-c54e1793dc0a", "value": 245880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686779836, "uuid": "c96701a7-9fd2-4650-896f-222c1709d397", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686779836, "uuid": "9bac410b-9857-4957-a4bf-5a1a2e59f2e9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d819a1-0af8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686777245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777245, "uuid": "86ae062e-66ed-4987-8b26-997ad6f01ed5", "comment": "Malware payload", "value": "539a444f8dff3d9719e36fd9db31b799", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777245, "uuid": "5af9ee32-539d-48bf-acd1-6c773aa984bc", "comment": "Malware payload", "value": "2c5c3ba7eba30cc358b40d494fda79d9d2a6df152bdb7eb1aceb36f3fbcf60c3", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777245, "uuid": "61aaf399-5bfa-4cfd-8d15-df1967cbdb22", "comment": "Malware payload", "value": "9b4a836511afdb230888a1e2c0698c839850d8c0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777245, "uuid": "34055448-851d-4392-a5fc-b8ba9915e052", "comment": "Malware payload", "value": "1c60db8dfab80a5103f7ce3273b09e12bcd5a451f77151c6752c10b1dabf172cec05e98d774aa6d864731006a954008a", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777245, "uuid": "0dbb3079-1261-4300-9a42-6cde23a168c0", "value": "T18DF53306EA2E5838E1FF19769096C3BCCBE0FC616815536A769B3ACF3F722575502212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777245, "uuid": "02127eaa-e652-47dd-a8be-cd8e4f2b2577", "value": "79b3362178937bf9559741c46bb9e035", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777245, "uuid": "15ce724e-e2ac-43b3-a07c-184e6ed808bf", "value": "98304:GrZtcyQgVa9BjWmic5fcD75vuHgdtZgC:GsRgVa9ltc35WHG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686777245, "uuid": "f938d2cb-8cde-442a-8c39-b634268b9e8e", "value": 3620352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686777245, "uuid": "4469a9e2-7cd4-47e9-9dec-d47c5ad47641", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777245, "uuid": "aab22b46-ce0c-49ce-a859-d31e8e8791eb", "value": "539a444f8dff3d9719e36fd9db31b799", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e05db8-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725752, "uuid": "cfc0f7cd-d97a-452d-9113-4cbbfd0097b9", "comment": "Malware payload (Quakbot)", "value": "e5da5326c255e9291d8ee1f1ac1ecfed", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725752, "uuid": "8570cac0-7f80-4fd4-892a-f9323d36eccc", "comment": "Malware payload (Quakbot)", "value": "2c9753f3b2faf3e22fd3b6ef3be9c9edd4c22fbca372a9946b1fce7d7518c72b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725752, "uuid": "f2dd7fa3-51e9-40d5-8c0f-1149e87dfad7", "comment": "Malware payload (Quakbot)", "value": "918427f078af62703ff00ba5be966c35f56336b7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725752, "uuid": "499c250b-bcf5-4318-b0b9-bf8cb7fad2a5", "comment": "Malware payload (Quakbot)", "value": "968cf8c0dffec062d3faed5e203c632bed7cb84dc552f7a004c7ca3b2dc5b56b267f397ebf99a9350ab48cb3c59644cf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725752, "uuid": "4404b230-42c9-4b69-87c2-0b3a17ea8c04", "value": "T1C07411896A41E0F05237B377CE178410FBA71E1B10848972F97C61596F3D8697EBBE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725752, "uuid": "85cb0cda-ba12-49a6-aea8-e2b22920d43b", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbMD4fODkiGhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725752, "uuid": "5e3d51de-2bd5-475b-ac69-d7260cd15bd3", "value": 358360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725752, "uuid": "a78a8a5e-4d11-45f3-91c5-c27b44c65233", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725752, "uuid": "a990d30b-2423-4292-b9c9-b760c4e9c6ad", "value": "lGdsJjpxkhFY1d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6073ac-0a73-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686720004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720004, "uuid": "b66f2cbf-57f4-488c-b5bd-60d3a27c0985", "comment": "Malware payload (AgentTesla)", "value": "ff9dea15c5319d95dfbf540bfc870821", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720004, "uuid": "6922ce6b-0455-4e15-b1e6-9d34e4654920", "comment": "Malware payload (AgentTesla)", "value": "2d1f6e9c74a38ef216403f61048d294090f9cb70f4134c2d2be419657ac3c5bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720004, "uuid": "2d612f79-aa21-4105-ac56-59bf2f0dd06d", "comment": "Malware payload (AgentTesla)", "value": "abf42704bb4338fcc665035be6d9e71fe70c5988", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720004, "uuid": "cc6e50cf-baa7-42f2-a76a-8bd78df923e6", "comment": "Malware payload (AgentTesla)", "value": "cc9c9fcbb6f3c16944e210c2818b235b2ee269d97f35db7b4fc775f9f62527f647329c8080664abc6708b82b3f78c569", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720004, "uuid": "d0927edd-6846-48ff-a28e-aaacfedbb530", "value": "T1D405D081317A2963EABECBF50151527087F63E1EA25EE7E84CC2B0DB56F0F814651E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720004, "uuid": "0eb1b6bc-8ff1-40e5-88d3-83d1cefbe438", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720004, "uuid": "54e945f5-4add-4079-a7ba-37810ed7ec12", "value": "12288:+lKnuYEXqXdVJyow27DfTMFg3SrVuNxD8NZWg/+hl3Hv1j+eTiW:b54qXdVJ1jbM23SZ0xDS9+z3Hv11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686720004, "uuid": "c378cc5e-c288-4b03-a5fd-0b070c486b37", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686720004, "uuid": "ba2d6c8d-3bd4-4964-ac1d-2bfb1359f0ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720004, "uuid": "4d69a17c-144f-4634-9b3b-eae234c2e044", "value": "ff9dea15c5319d95dfbf540bfc870821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e34a8b-0ac0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686753363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686753363, "uuid": "d0930e12-6935-4dd2-85ad-8fe61be8d8e1", "comment": "Malware payload (Amadey)", "value": "0b25610b8bd49a5e7063f9d7fcc6adfa", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686753363, "uuid": "bed0a6e7-2023-44a3-b77d-3926e22bf407", "comment": "Malware payload (Amadey)", "value": "2da21c40315009a50d70393a1f6d5618c37f41597b1d8a76461c0d0462eeeba1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686753363, "uuid": "d370eab6-6e00-40ce-a5e3-5228346bdf8a", "comment": "Malware payload (Amadey)", "value": "5ad25d22851398ae05249568845ec9d6e6711a54", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686753363, "uuid": "f9377a75-e0a1-45fd-b0bb-a564e8aa8388", "comment": "Malware payload (Amadey)", "value": "7b7ccd5b46518a665dbf98f54ecfdd626b88a19e11d3cf663e659a62d0476da80b2aeb27586811fc6f8c5565b5cf181f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686753363, "uuid": "3b7eee11-e1fd-4b5f-bc9d-4dc96bd11ea2", "value": "T1E8F41213A7DC95B6DDB5177048FA13C30A317CB26EB492763A05A99F0C33694A93237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686753363, "uuid": "d4c0d929-573a-4885-ad8b-46f8e4e77bdb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686753363, "uuid": "395a3bb3-da03-47fb-85e5-ccc1b612d207", "value": "12288:sMrRy90nfIf+k13iLGaghkzMp/yLrEDhBwnC5LHZ7P+VT8TlCrwQDu9YXAB5P1/b:dy0k13iqaJI6nED76CV5bAUIMWu9YXA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686753363, "uuid": "3611eca2-3898-4ccf-bb2b-54fc0b2fc1d1", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686753363, "uuid": "732977cb-7b3c-41d2-8093-1771fa45cf86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686753363, "uuid": "2253d0f1-1ae4-43d7-a3c5-ca8f585fa153", "value": "0b25610b8bd49a5e7063f9d7fcc6adfa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6cc0521-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725897, "uuid": "e3573e54-04ed-4f80-a805-b9e10d5b5826", "comment": "Malware payload (Quakbot)", "value": "ce61f99a97287ea40e65a7805c15332c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725897, "uuid": "b8b69209-691a-4684-9cb2-b3f92dc84f13", "comment": "Malware payload (Quakbot)", "value": "2dae93e4b7c7c6d149df3f3171cfff9d70aa5814668e10c23ad5fdbe3a8de584", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725897, "uuid": "148d6cd8-7d3a-43d2-be78-fb97e3559282", "comment": "Malware payload (Quakbot)", "value": "7ff3d0aa63f9493023a37452a73a36f35262ef08", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725897, "uuid": "053f3996-15ad-4f6d-9493-5854e64e7849", "comment": "Malware payload (Quakbot)", "value": "aaf8f84488436d52bb95ae84d000a5be26edea390fa2bf5182d0ad7dcdb5688df466ff4c972c37c8b0c201f24fe7328e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725897, "uuid": "a3ac02e1-e98d-4a40-ab68-93b9700f5c5f", "value": "T1295465896A41F0F08237B33BCE578414FA670F5B21C48962B97C515C6F3D8696AB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725897, "uuid": "004576d6-16e1-48fd-b1d1-f4f5ca89c798", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbePCYhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725897, "uuid": "32d3e99c-d21d-40b0-ab41-b89cd8e0771a", "value": 303315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725897, "uuid": "46805816-c4f2-4fd8-9499-0daab95cbd70", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725897, "uuid": "c31770c0-3bce-4c49-8659-fb9f22fed1c1", "value": "hau7AToIbdSy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b611529c-0a72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Tofsee)", "timestamp": 1686719829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719829, "uuid": "ed9b40fc-d953-45c9-9eae-7d6d42b5cd61", "comment": "Malware payload (Tofsee)", "value": "495a1ea939030ecab57ad60549837e0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719829, "uuid": "e50f9935-9090-443b-9ea6-c2f4420ebfa1", "comment": "Malware payload (Tofsee)", "value": "2dd452add7571434898c24c9bdb636627b929b7620a3bcb36c3080b86def4818", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719829, "uuid": "2818f506-c235-4dca-b36e-5d15a592ad7d", "comment": "Malware payload (Tofsee)", "value": "921ffb10aef3937bef3a160b4d5f405fa4802b13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719829, "uuid": "617df7cb-5695-479d-8f25-a3ec25f19570", "comment": "Malware payload (Tofsee)", "value": "16d54587eb1396810cc72b5111654093094246722428c01e3ca00adb7490ec70bcbf200b32e899d37fe1344c3257d95d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719829, "uuid": "679e0b4e-1598-4355-a0c7-124bded819be", "value": "T1DF04CF2232D1D871D4636A314CB9C6E42B6FF9121F34668B931C1A3F1EB36D0A9F2356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719829, "uuid": "096e4ad8-4583-4964-93d4-4c8c77a7eff5", "value": "f678da7882c86102a2a8a7a8ee56bca1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719829, "uuid": "927008ad-0114-48b3-a9cd-7fd470929aa7", "value": "3072:QG36z5gnjk/KiYq4UzpoSEgRtyZrPxJKlP:n3egnw/YNE09VL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686719829, "uuid": "cbef7185-b0f1-4a87-bed1-74e9c9e6e422", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686719829, "uuid": "c4be1253-1a98-48e3-9636-f32236eff796", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719829, "uuid": "0033e078-3a87-4a1d-b031-8da8dea4044f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20bffa00-0a90-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1686732463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732463, "uuid": "e110e663-440a-40ae-9416-cd7d0f4cb09d", "comment": "Malware payload (NetSupport)", "value": "1012ed0bce65ac42425e7435aadcc8e6", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "norominis1-com", "colour": "#1D41F8", "exportable": true, "hide_tag": false }, { "name": "norominis2-com", "colour": "#2E5F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732463, "uuid": "b00ff6a5-d7b4-40e7-83e4-c81c496b446e", "comment": "Malware payload (NetSupport)", "value": "2dea97fa7ef3e4930e95666fc4ee94b781a3f9e787cbebc6e7bd3fd3ab88f0bb", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "norominis1-com", "colour": "#1D41F8", "exportable": true, "hide_tag": false }, { "name": "norominis2-com", "colour": "#2E5F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732463, "uuid": "8f1ef08d-816e-465e-89d3-661180e39763", "comment": "Malware payload (NetSupport)", "value": "58fb0890d74786bb4a6bc76bb7d08b7a941c565a", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "norominis1-com", "colour": "#1D41F8", "exportable": true, "hide_tag": false }, { "name": "norominis2-com", "colour": "#2E5F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732463, "uuid": "dfb11d5c-1905-47a5-8c69-3150a1730955", "comment": "Malware payload (NetSupport)", "value": "3e8c8ce76ed5c64b80f25a00e8b69be84de761b8ac35fd2940fb145ecb02234ca57e295c3a582c1c9eaaa75db981fa64", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "norominis1-com", "colour": "#1D41F8", "exportable": true, "hide_tag": false }, { "name": "norominis2-com", "colour": "#2E5F77", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732463, "uuid": "5ec17d63-5703-4849-8e99-b834afef922e", "value": "T158A533F2A7B003B36477826FF0ADDE018D5CF2AAE3DA9ABDA599070730861197F54741", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732463, "uuid": "2c077793-fa8c-40ab-8675-a437026fb147", "value": "49152:lZpS85PWZ5FvcBAilLUXP5qRroZT5YNdzlIbnNsOFdy:tzP+UxlLUf5qRroGKsOe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686732463, "uuid": "a951b0b3-cb66-4953-b233-363f179575d9", "value": 2262638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686732463, "uuid": "b533abb7-4261-4739-b64c-b9623021903b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732463, "uuid": "1a13215d-ab21-43c9-8ae7-09546c892ce8", "value": "4th.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c17bb5c-0a5b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686709826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709826, "uuid": "a0bc1896-501c-4377-914b-657b1e9e96ae", "comment": "Malware payload (Amadey)", "value": "806a239307f539b5124016cced0ddb61", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709826, "uuid": "64570e25-bdc3-4cc7-851e-b30fc5677518", "comment": "Malware payload (Amadey)", "value": "2e230fdd1d2e2bcd69a3f13f4902d45b197c23cf1aef16cf6022e881c3208555", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709826, "uuid": "4b83092a-425d-42bb-bd73-c630ffa90fcf", "comment": "Malware payload (Amadey)", "value": "fd3026879811d62c86c160cd9e84563c71dc7955", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709826, "uuid": "e39b5be2-046e-4c3d-ab4b-5c186ef80783", "comment": "Malware payload (Amadey)", "value": "26fa7669758e36c15843dad9dc1039a08455267e0a3064f2ffd99503462c558f5703164dba4f8df6776af4fa22e36362", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709826, "uuid": "15c936e6-a721-4da6-ac4d-4303301c0a28", "value": "T1B8D41202ABD98472E8B5177058FA03D30B71BCA19D3853AF3705685F2C726D47972B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709826, "uuid": "0d941a1c-6e29-4fe7-a70e-19903718994f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709826, "uuid": "66423eb1-5c3d-430a-b3c0-22af5c0b9c09", "value": "12288:4MrNy90FxVvf0nLLr4CwVkSeuehZrpQm8j+6PNGIE4LGoHXKDzY:FyqVv2Xoe7Y+6YWuM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686709826, "uuid": "41ddd856-e013-40af-b227-b17fe4ea1577", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686709826, "uuid": "2b58fcb5-86b8-4d2c-80e2-09c275b50898", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709826, "uuid": "ac8e3bb2-5c24-4b7f-8ebf-7772998b5cfe", "value": "806a239307f539b5124016cced0ddb61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c143d3e8-0a96-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686735309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735309, "uuid": "3c219640-22a7-45e8-81ce-ec7b709ad0df", "comment": "Malware payload (Mirai)", "value": "4f3e1c914bf1d64ca5efc7cab4e9829c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735309, "uuid": "c651c9e2-a31e-4ab9-ac67-0f0da62fe8ce", "comment": "Malware payload (Mirai)", "value": "2e6f832bac8675ebba90d551049f1fef4e3a13ce2bcf337016d9a1b4ceaae0c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735309, "uuid": "0c3a8bc3-327b-4c2f-92e9-7d933ac34d17", "comment": "Malware payload (Mirai)", "value": "f0cabb191a861edbc4867fa4971d7c19751df0de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735309, "uuid": "ec333d46-2489-4e8f-9c7e-c540dbc5a3a1", "comment": "Malware payload (Mirai)", "value": "b53c8088cbe786085fc81aa9abfe3025ecfc1a16acf0a044c867f56390b7219c56a219e5fed25bfc2284b40e2d1ed8a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735309, "uuid": "75855cb3-cb78-41a0-9498-f20ff2c3693f", "value": "T1B0532A52B9C09752C1D415B7FE0E018C3B6613FCD2EE72028A65DF21339796A0FFAA65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735309, "uuid": "8c96aef5-8b57-4854-9fa0-1f774e83ecd5", "value": "1536:m6vDPn+ffFlyyro5P2YkP8Y6ZvmjKV4Y+UNFxzhJL1ewFF6Ekvxfk:m6rPn+ffFlyyroB2YkEXZvIIjXFxzhJ5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735309, "uuid": "14bec9a8-982a-47bd-9e9f-110c597ab59a", "value": 63012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735309, "uuid": "3263fae9-4247-4e12-93fb-3569165757d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735309, "uuid": "42042897-12a0-4c81-9b1d-5ece993002f1", "value": "4f3e1c914bf1d64ca5efc7cab4e9829c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216fe550-0aa4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686741054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686741054, "uuid": "7130be07-c499-4058-994d-6447fe7141dc", "comment": "Malware payload (Amadey)", "value": "844d58a582d52810ffa223f3d57222f7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686741054, "uuid": "f167e161-63e4-447c-88d6-944d0b9095a9", "comment": "Malware payload (Amadey)", "value": "2ec47546daa77eb2c81393ab7e44f4f0729b81188565ddcb3436f0fb62690442", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686741054, "uuid": "2701c9ed-4e5b-4131-98ee-0ce102635c07", "comment": "Malware payload (Amadey)", "value": "e8d33adeae2b0bf1d1be28d1f0fe76510eb5e10b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686741054, "uuid": "5c89119f-4cfd-4cdb-bebf-6a5c56157229", "comment": "Malware payload (Amadey)", "value": "532597cb445f45621763719fe1ba58146614a9f86b5362c9df0b058a83490f0e698d9f98827f0029a9f3b908b99ca944", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686741054, "uuid": "63e30434-1a72-413c-906c-0eeda19a4f82", "value": "T103D41202EBDC9032DCB61BB11CF613D30B3A7D611E7843666B856A5A0CB2390E4B5B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686741054, "uuid": "6463450c-1057-4320-94be-2f3409fa3042", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686741054, "uuid": "4deec742-186f-45d2-8cb7-3c787ba930cd", "value": "12288:VMrXy90TZaS9Cz4BzOD8yPle30d87QX+HFGBwBVNZaGst3eJK9Mld:ey6/9CEBaD8l30d87QX+HoeSGe9Mf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686741054, "uuid": "0b476a90-5b91-490c-9965-5e12b023bff2", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686741054, "uuid": "f27b7472-dd99-4403-a770-59cf9d340c0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686741054, "uuid": "fdce9815-fb05-44c2-be9a-2fd3fe8c80e5", "value": "844d58a582d52810ffa223f3d57222f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a2fde66-0b0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686786327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786327, "uuid": "00d14de2-78fc-4ac1-bfd1-9b3a179a19e0", "comment": "Malware payload", "value": "d9b2448c4a4ca093104d7ac12db208c3", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786327, "uuid": "182b17f0-32fc-4529-9b35-222bf99e0b34", "comment": "Malware payload", "value": "2f05912f64642bae13c0562f48f14bec4d0f887c196ddde63aee023b39ecbe70", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786327, "uuid": "b9e4dd3b-04b1-4535-8c49-25868326b105", "comment": "Malware payload", "value": "51ce9d3ed14334a05e1b98a69502a2d82a9cc25e", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786327, "uuid": "f82c17b4-893a-4c7b-90cd-715971d9cff6", "comment": "Malware payload", "value": "8fc8b72461e91c71d5f0d3d0812197b61c78ed4ae24a52016a749e0dfece0e1558d415e28fabcc9e94cc372e2e826332", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786327, "uuid": "7d6d0098-3fda-436c-b4cf-be0aa2956a53", "value": "T1BCA52312FBC248B2D46509325E76AB119E79BC501F718BCFB3C42A6C9E725C0DA31B69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786327, "uuid": "e84d2ce5-73a7-482e-9cd5-db9425ee0bfd", "value": "24576:gTbBv5rUDkeI3/cRUGTcWnN7B2uC/EZQ/J+4k+lCj4bDtlKmoGusfdpizjnu8O:yB9vPceUcWN7snh+KlDtlKCu1u8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686786327, "uuid": "a90ce231-14c3-4cf1-84c9-1d25bd60aeb1", "value": 2228224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686786327, "uuid": "9569120a-8b9b-484c-9cd5-12150c449886", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786327, "uuid": "efe72648-00d6-479e-8b05-ee280e4362c6", "value": "nBank Details a.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8a3fee4-0a72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686719887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719887, "uuid": "c172c265-099f-4243-b6e2-e25c1ac88a1e", "comment": "Malware payload (GCleaner)", "value": "e40dc3c4b9370da1e6fe92b1654d211c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719887, "uuid": "9c3bfbc9-d3b2-4c8f-8050-f3900a22161d", "comment": "Malware payload (GCleaner)", "value": "2f0a938885c5880c83b895eb195d6a38dff5924f12fe39f2f4db7910b3bb1525", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719887, "uuid": "44edbb3f-781c-4d13-896f-6ed94e2d4be3", "comment": "Malware payload (GCleaner)", "value": "269a68e88e0f8b26883f0a321a9eed6593a31aae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719887, "uuid": "ea14b769-e2e3-45be-85a9-e4e113527b4a", "comment": "Malware payload (GCleaner)", "value": "a15a10a7733b705383b743e5a79bd29dd7a2dd0c5af7c816392558855258f06ce0aacc381c239c0530b34c8e3bd70d63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719887, "uuid": "60f15ac5-d3c7-46b1-9a21-3293c532c241", "value": "T19054C05139D0D832EAF665305831C6A42A7FF8666931C58B77A43B6B2D337C2AE74343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719887, "uuid": "3d388cb3-6da5-4b0b-9cfc-06635513c234", "value": "7c7a6cc71dd3b50d1830b62fec5ef581", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719887, "uuid": "95e5fb5b-ef24-4b6d-8ae5-76d9e258b85d", "value": "6144:F2HWziELj11o+f75ivPaEk5zDKbU8eRM35UtWpNI:N+ELjA+f75ivtkFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686719887, "uuid": "58431c1a-6d79-4a0e-bfe7-10f61000d523", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686719887, "uuid": "4df608c9-a86f-48e0-a092-f340dd74b90d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719887, "uuid": "74b88d38-5b14-4d81-b31c-0514773492f9", "value": "e40dc3c4b9370da1e6fe92b1654d211c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8c1e16-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728190, "uuid": "dd7264b6-e74c-4ec7-9631-4e5f65d7cdcb", "comment": "Malware payload (Quakbot)", "value": "f52901e8d6657ad2e529a11ac236bcec", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728190, "uuid": "5494da70-419b-439b-8ea4-25f86de8a5ac", "comment": "Malware payload (Quakbot)", "value": "2fa2ad7f8afa99f581f00dbf670d0c914ba44761a3f723aadccaaffd87d6bebc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728190, "uuid": "55d4d034-eb59-4ea1-a54c-14001ae64b6a", "comment": "Malware payload (Quakbot)", "value": "4800214a0a39f60854be927fbd3e090fe1d62c5e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728190, "uuid": "a2131747-fdc1-46f8-968e-d037eba7e3a0", "comment": "Malware payload (Quakbot)", "value": "4d62cca46f3617177c5ce3862422a9290cbf23212d75ee2445aad18b4aac7c6d4fb0f67eebecafbc58cdb276ef37c5e2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728190, "uuid": "4f4fe8d2-0dbf-4ca5-9631-8bbf67b653bf", "value": "T1406444896A54E0F08233F33BCA578410FA6B1F5B11848972B97C515D2F3D8297AB7ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728190, "uuid": "68d89e4d-d281-4056-80f8-2444dca437ac", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb1svgfUkhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728190, "uuid": "b216a46c-7e9f-40cd-bdf0-0d8066894409", "value": 317460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728190, "uuid": "efa53892-43d4-42b6-a935-2257da2734b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728190, "uuid": "b5a3fd26-46c7-4b8f-b26f-37f3fd871cba", "value": "cBsYl1SpEZRXB.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577260a6-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728260, "uuid": "f6ddd0b7-5319-4d5d-9c80-6783af4ba855", "comment": "Malware payload (Quakbot)", "value": "36a4bb5c1731416fea667c0af03a0a3d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728260, "uuid": "3668528c-af42-45f8-a77d-01abb8425746", "comment": "Malware payload (Quakbot)", "value": "2fa7b2040ac076e3788b317655009f3136cde0771ed829a5b4d18a366aa8956f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728260, "uuid": "12a920ef-a045-487d-bcbf-63bd304a9a99", "comment": "Malware payload (Quakbot)", "value": "adb5edb37bf12c084ddf231f593edccf6e894793", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728260, "uuid": "9d74aa83-4428-47bb-9c56-517ae0622d3a", "comment": "Malware payload (Quakbot)", "value": "9dd728e7df65d63f73345c765d503be31e6170aee9272341f4fb3b27139eb3e9d287fe0a6ef00024b0b38cb47dffec20", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728260, "uuid": "e96f4c5e-3a9f-4e19-9c61-62dbb2a389cb", "value": "T1716455495A45E0F18237B33BCE178410FB6B1F5B21848972B93C515C6F3D8696ABBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728260, "uuid": "31adef67-e1e7-4db7-be3a-ca3dc6c4a59f", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbwB7KVhMbSNxhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728260, "uuid": "e9cc00fa-2260-4c61-988c-0776abaff9b8", "value": 316066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728260, "uuid": "387b1d9a-86b1-43a3-b585-de18394c92c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728260, "uuid": "d7671be9-ba3c-4e08-94e7-ada39815ae2f", "value": "aRK7IDigp9Ikkr.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ed7338-0a8e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686731859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731859, "uuid": "b05b57fc-e1d0-453a-9b04-c675a055cb29", "comment": "Malware payload (AgentTesla)", "value": "f14dcf72e47d23a453145415a5641447", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731859, "uuid": "051dfd02-bfee-4e8f-9c22-5596aa57a866", "comment": "Malware payload (AgentTesla)", "value": "2fc1356f243df8144ba643965e4d7f21def7549595c6bf3d944b705348893a43", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731859, "uuid": "e0eec4b9-3037-4b0e-a1bf-22e909d828a7", "comment": "Malware payload (AgentTesla)", "value": "325e7a7467048c30b601f6652363749a066d89c9", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731859, "uuid": "c5812c20-8088-4d8e-85ef-80e1a51b8fa0", "comment": "Malware payload (AgentTesla)", "value": "c269cb74cbcc68528b61ad9e4fe9717c28becbdb04b6849d911d5f0262353af969d3e1bb59ef443bb8ffe9c20049555c", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731859, "uuid": "4c0886fb-27a1-4d7f-9326-ef2e89f6e081", "value": "T18BF4236274E4C2ACFB2FA92636047FE63C6021E11C6A26F9541BE413E7D2D7DE571C88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731859, "uuid": "7b40cf59-2c80-4f84-991f-36beed56e855", "value": "12288:hGJYztp5OoLJfNR6Z7dAUPNlmb3q2zdMFEzvOsmcvQ9uBO3WirIb1NApMVbyOI/:AYpJ1RUbWba2B5jiKoK2BEbjaKJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686731859, "uuid": "debea84e-c807-47b8-9aaf-4405aeb4dcc7", "value": 735843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686731859, "uuid": "18adb7b3-0381-4dd6-b7e2-c0356c0451e0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731859, "uuid": "607470bd-779b-43ea-8636-44a680c4f079", "value": "INVOICE SHIPPING DOCS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e937c9fa-0aeb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686771884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771884, "uuid": "73f093f5-08a7-4a68-ade3-3f556144ee19", "comment": "Malware payload (Mirai)", "value": "bb844500612e9dba34a52c983934c2dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771884, "uuid": "b9f06e70-efec-4c40-b79e-68bd714bbcbd", "comment": "Malware payload (Mirai)", "value": "2fec9dbbc3f6163735b87865cb5a8585b68f99fcda430f77ed71f6824b0df210", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771884, "uuid": "638f2715-c084-444b-b0d2-015312276a6c", "comment": "Malware payload (Mirai)", "value": "5944f2199de9545bbae656f702e1a778aed6cef8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771884, "uuid": "4bdb80c9-2029-4775-80d9-744c43885d3b", "comment": "Malware payload (Mirai)", "value": "4a4a8b8def1e63ed2602478603b3828d1208186d6aab0f6a41b9dfab08cce04723334973c8348f5ce320c489586a98dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771884, "uuid": "bff5e4b0-fe2c-4066-9076-bcf68335dc08", "value": "T17DC2D1A5B424BDD2C9306C76DAA88CC6378615BD90FFBC7741210D28AED58CB57F8186", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771884, "uuid": "325f4d7e-a725-4a0f-922d-bc0df358166b", "value": "768:7MKyhegCCMqfN11zqcEobtfUxYaOvT9q3UEL3B:QKy4qf7ISPaXLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686771884, "uuid": "bc6977a3-f76e-4562-ae1b-31a185d2c5c5", "value": 27292, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686771884, "uuid": "5ca20e68-47de-491c-9926-ed89126d21aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771884, "uuid": "d660c4f7-ec8d-4d74-a5e6-d0179b546f22", "value": "bb844500612e9dba34a52c983934c2dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b93c1464-0ae9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686770944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686770944, "uuid": "de03a38c-c986-4b1f-91ca-3cc4a1ddad6c", "comment": "Malware payload (Mirai)", "value": "02004b11ca5117baff3b884a062a1def", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686770944, "uuid": "2f351f57-a0ea-4a1e-ba73-494cffb7da63", "comment": "Malware payload (Mirai)", "value": "318c8a97c20d4b2c91ccad5f1b6a3fd98fa61da77d7d133c93316c00f2b7f718", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686770944, "uuid": "6e5008be-718b-4539-89fd-693c0e838802", "comment": "Malware payload (Mirai)", "value": "d0592683da49b76d37b1ca4a5fcb799cb4de0853", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686770944, "uuid": "b8715f18-1937-4762-856f-6191395f47b5", "comment": "Malware payload (Mirai)", "value": "2931d7b04e7ef37dad3ef23349e9b94354a9ea121280024edf93320ef8d46da1a715f4073a5e9d0b1c36cb80e4456c3f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686770944, "uuid": "9b3e3689-b8bb-43b0-a65d-59a734e5cf3b", "value": "T1C5A2D059BF1C858BCD36293442E9E9C612D1EC61B3ACDD5A0E90C0ABF5A33A57434F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686770944, "uuid": "51cdb2ad-110f-4465-a1b0-2f09aaaab5f8", "value": "384:M0sLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaz1Hb+502F2vwA9B1fKVVXThSyn:k98o08kxofBE+ZkXaVbp2F2n8VVXbn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686770944, "uuid": "793dd1e5-b7f0-4762-8b12-27ab2d387756", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686770944, "uuid": "627e44ce-a758-42f4-8307-f3cb84dc8f9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686770944, "uuid": "6242b4e9-2297-48b1-b5b5-6eb63be930c8", "value": "boatnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9fa90b-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728836, "uuid": "5b8a6a46-b6b4-4df7-90e6-cfb176bdf35c", "comment": "Malware payload (Quakbot)", "value": "aa0e5ab04699b541c10b46201787d2f8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728836, "uuid": "f9ac51c4-e42d-415a-8d4d-c5c17fe8b7ce", "comment": "Malware payload (Quakbot)", "value": "320b00d1b37b326c3ea175b31ab2f6c06d6da56545c455c1570eb902cc3946a6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728836, "uuid": "ee76984a-2393-4db2-bbc4-1532fea22529", "comment": "Malware payload (Quakbot)", "value": "fb6696237a6cc72147418fa5b90dfa7c1fa0449e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728836, "uuid": "4227ad8b-7b52-453a-ba98-2025c38d75e6", "comment": "Malware payload (Quakbot)", "value": "061aca09873160abbc7c27be385263a6391022042a2ec48491cf9a72a9123e7ed73274303aa04bd036e7fe9571fa6085", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728836, "uuid": "1d3e0037-e788-450b-976e-27c1e0bb314c", "value": "T1BE6445896A51E0F18237B33BDE178414FAAB1F5B10848962BD3C505C1F3D86D6AB7ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728836, "uuid": "9f3399fa-e040-4b6b-87cd-3cb5b5242c2d", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb4F4XX2duamxbs4vPkMGCk/8:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728836, "uuid": "d7fc25fa-8787-4b41-b340-b537e3f88f3f", "value": 318458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728836, "uuid": "784befff-e4a8-4fde-8bfb-bf90ac76cd0c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728836, "uuid": "a2503256-5e13-405f-b2ff-f5ba785908c0", "value": "OAjjOJzMNS084.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2971c987-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686750517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750517, "uuid": "964a9f13-6668-4d75-8203-96e39c4294d9", "comment": "Malware payload (Mirai)", "value": "6a4ea5a5ce74dd255ac8867b62ff05c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750517, "uuid": "8fa936c7-266b-4f4a-bba4-e6245baab770", "comment": "Malware payload (Mirai)", "value": "322b0b8cc4f129432e24a956c681fef4f8063145b0586c873fe55ddb79d390ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750517, "uuid": "70a25785-6c54-4537-a980-4c7f7b50fdb9", "comment": "Malware payload (Mirai)", "value": "886b36aad8f3de186b4cd3b01960e3f00c51ec45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750517, "uuid": "aefb45f3-d46f-48f5-8008-720d89ba2eaf", "comment": "Malware payload (Mirai)", "value": "6600be6fefe2efd42d2f4c1a11e719061fd2375b9fc14ed25b8d7e36e8333c0c6210d3ee9983cc3325308d3224bd2a9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750517, "uuid": "6fd670d8-9091-452b-88b5-603b0e129761", "value": "T1C723F122E2D208D4C2149C7858456FA79C879BBEA0FC16A649EF5F4C349350B57FEE0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750517, "uuid": "570c300e-bf55-43a3-9663-ed18a925b27d", "value": "768:GrXtCwN7pDDBxv31sbP5J2T/k4RY+s1/teyVo29q3UELatcSNaRDq6PY9uHcA:GrH7f/vlsLi/hRns5mbLJju6wYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750517, "uuid": "9287c636-7f50-4b0f-848d-88fcd492bb0c", "value": 46888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750517, "uuid": "1285c58e-5c9c-4c71-bd11-662bc28ac251", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750517, "uuid": "268b6648-7253-449c-9f2d-e7df86c81e02", "value": "6a4ea5a5ce74dd255ac8867b62ff05c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b70883dc-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728850, "uuid": "8f8221fb-9f7b-4045-b1ee-e7facbd96841", "comment": "Malware payload (Quakbot)", "value": "6a4e2f02cdfc0f80dcc97242de4b0176", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728850, "uuid": "81e158dc-ccf3-41f3-9c85-fdbaaaf102a8", "comment": "Malware payload (Quakbot)", "value": "325e486140498c768d75e86b2139832ae5fb99960c3a5e5ab1aef3940146850a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728850, "uuid": "541706e0-efe7-4df8-8c24-f77584fd1627", "comment": "Malware payload (Quakbot)", "value": "be57755e24d4da1e93338372aa21131baab0249c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728850, "uuid": "6a7cc97e-64fd-4f6d-8f54-b41b51d02829", "comment": "Malware payload (Quakbot)", "value": "e5119d84a5b824dece80c9efe6b814b5d92c7dbc0de88ada894abfbfa9065b23cdab8cee6faef60f4f666a60cce9b521", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728850, "uuid": "68909525-5a2a-496b-8b33-92b0500f503c", "value": "T1F5743385AA41E0F18237B33BDA175410FA6B1E5B20848972BD7C51582F3D86D7EF7E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728850, "uuid": "9c1370c6-4348-461a-9f23-1553e9432959", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbBKLMAbOU4P/hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728850, "uuid": "c5b9b265-82c3-44be-aef3-e6e022fbebb2", "value": 355068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728850, "uuid": "2569f406-c02e-40d9-b394-b4b9f8913473", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728850, "uuid": "4a081800-37aa-4ce1-8e55-1adf762c2476", "value": "NopY4bIQt2Z7wr.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd0d34e-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728162, "uuid": "6c64493a-b546-4de7-b3c8-e9b7aad8c955", "comment": "Malware payload (Quakbot)", "value": "8b8e67c78b69a13edf0d03f3bb015e10", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728162, "uuid": "a15a0813-3b1d-4b24-af7e-cbf2394123a3", "comment": "Malware payload (Quakbot)", "value": "3280edf0bba5b62b32a203f2786dbca78088ee6ee08de398badba5c0dbcddc2b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728162, "uuid": "f4c12d7c-ca4f-4b78-b241-fccaa455836b", "comment": "Malware payload (Quakbot)", "value": "b245b494da4eeb4e08dac8d15192117ac66ef4ca", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728162, "uuid": "acc7e472-f84b-4d18-a644-d577944e32d2", "comment": "Malware payload (Quakbot)", "value": "93cef8383e1749985045e51b50c0c21425f07af496b2d3cf27efbb9d660e3506ec422ca2a48c3fe450b8406ccda9cc33", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728162, "uuid": "17269ca9-5405-4f0f-9b73-750f8327e4a8", "value": "T1906443846645F0F09133B33BDA578410FAAB1E5B2084C972BA7C515D2F3D469BAB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728162, "uuid": "f0a52e81-8fff-48f2-be68-f2c9cefd2c95", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbE02RRiKTAlPhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728162, "uuid": "fd0d8db8-0ea0-4204-b96e-abf1cb7296d8", "value": 325952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728162, "uuid": "a3196aff-dcc1-4321-a787-13b20013a19f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728162, "uuid": "cca71cd4-a560-48d5-bf33-9b8b91a33015", "value": "cvKnmeKET0POHI.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58b7cc2d-0aa2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686740288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740288, "uuid": "d5f0985a-7f22-4a54-8218-c2ad5c8ec420", "comment": "Malware payload (Amadey)", "value": "135496e42f255eec59982b1772858dae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740288, "uuid": "d1799bc7-3651-4599-9f19-1fbb147c0ae4", "comment": "Malware payload (Amadey)", "value": "3324f59b206fa36c6e0cb5a9feaeb0f70f56efd18ade149b8877a4d9df5e0cbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740288, "uuid": "48aa601b-943d-4784-a406-75e47cd07f4f", "comment": "Malware payload (Amadey)", "value": "5613cb62a56fd21a0cf6df22d817c5383bf2df99", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740288, "uuid": "bb7fc7eb-c69a-467c-9ad0-f6022b3ef677", "comment": "Malware payload (Amadey)", "value": "b61dfacab0179763e763c718daa5a83a5d9215d8ef2e0e5a7c1934b334d93376fb2cf03ae5793193baedbca408aa6d65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740288, "uuid": "9db92c31-5760-4ec3-a73c-aaf624be9ec1", "value": "T11BF41213FAF49077DCA527704CF606830A37BDA199B5522B3B95E88F4873B84E43536A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740288, "uuid": "8f0fe3b1-902d-4e1f-8888-4b9b2e7e3e9b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740288, "uuid": "94463834-1fb6-4d6e-ad39-a1deedb4cf41", "value": "12288:3MrXy90ekoqOeGc7gUi7lnpMxmekcct08l84wVaFyBWWxKp8KpWlgS5kYR:oy5kdGc2xpMbT8e1A4BW8ADWlgJYR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686740288, "uuid": "4477a8f1-3248-4171-bec9-4ef2b66ac0cb", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686740288, "uuid": "22506c7d-c8f8-45d9-9e32-98d90138a95a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740288, "uuid": "c1a756dc-bc67-455f-ad9a-fabe0ed89df3", "value": "135496e42f255eec59982b1772858dae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14c0297-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728840, "uuid": "0a375aa1-f421-4bae-968d-e6b70408bc5f", "comment": "Malware payload", "value": "655b983f80ab28e3f278b553b79d17b7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728840, "uuid": "93f25aec-78fd-4f90-96cd-878efec06b5e", "comment": "Malware payload", "value": "33db051325f4db54cf2f56d74014a4dfc198d1ac82fa029c69c028076c3cc33a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728840, "uuid": "5cc2c8af-a888-4064-aafa-5a4f85c99b4d", "comment": "Malware payload", "value": "465c6b22501a209da528c0630d78b8f86bf463bd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728840, "uuid": "bbce43ef-2d82-4ec7-9ff8-0edb02fefa80", "comment": "Malware payload", "value": "0048141452149ff161e82f844d7552e57f91861be48367da7204930c6d418a6312b4383d4dcdae8726d975288b7cabdd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728840, "uuid": "022c2471-c763-4982-a86b-6234290efe81", "value": "T1727443456A42E4F18237F33BDA175450FAAB0E1B11849932B93C60592F3D86D7EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728840, "uuid": "e968bb6e-ddbf-45b8-9b3a-cd6ac5aa1a45", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb87X9rthS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728840, "uuid": "6176288a-e842-443d-8d00-aa1365e4b592", "value": 349111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728840, "uuid": "74d25cc0-63b5-49da-8390-d72727d4ec80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728840, "uuid": "0c9db001-8df4-4d22-91a4-66d140e8d6e2", "value": "NlEyVR9lY1Wr.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae644ea-0a97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686735540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735540, "uuid": "65b75484-e82e-4e77-b548-f140e5e11467", "comment": "Malware payload (RemcosRAT)", "value": "41cf5fd381f8330cb9ca6b2934dd86e5", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735540, "uuid": "d18c6e5d-cb38-428f-952f-2df862179752", "comment": "Malware payload (RemcosRAT)", "value": "33e9d39a875062976856f25ee877d26e96301fd9e6b0c1d206816e69b4694b70", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735540, "uuid": "a0c8999e-2fe3-447a-a92e-684d752abd7c", "comment": "Malware payload (RemcosRAT)", "value": "4b0dc7032d88ff9d7453c9916412ada527c1108c", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735540, "uuid": "ff20bae0-de90-4160-a2a5-bd619defb5ec", "comment": "Malware payload (RemcosRAT)", "value": "56305acb4ba1c6a913e8a7f332a76943838ff7b1800282ae619b9f6b98d11b200e8ad002d22e36a6fefe47fb76a6a628", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735540, "uuid": "547ddb2c-a767-45c1-9a6e-838ff66f2f9d", "value": "T1DA55AE16E2D06473D3261A38CC8793989D2ABD701D2B6D8A3BDC7D7C5B3D6422A1C277", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735540, "uuid": "adaa7f3b-2572-41d5-88f7-75f7c12d6f0b", "value": "12288:B4iyBJSbLJfaMAhJVNRdfNl6lFqZLDZGqtV6ZE:B3ykf9AJ5vcADH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735540, "uuid": "ecb1da77-5a59-46a3-b9aa-1aa4614fd850", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735540, "uuid": "4d8d5e4f-a41a-4195-9355-39ee1626aed3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735540, "uuid": "7f53fed4-a28f-40df-9ff8-1f6802461f64", "value": "Pagamento BancoBPM SpA _Swift_copy.doc.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e07fe7-0a6d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686717627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717627, "uuid": "d4a67988-e2d8-4339-8e8e-d6b9dba3ccf5", "comment": "Malware payload (Amadey)", "value": "20a011e22f7c5e4179b3359a56f8df31", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717627, "uuid": "d5a8590e-3ddb-4840-b52b-d415c2d55e87", "comment": "Malware payload (Amadey)", "value": "33f782f13421181c2c8e6b346f3025883422a73ab4fdf69eff9450877a748657", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717627, "uuid": "3eebd2c2-db96-4a27-9f7a-e1fe04c670d8", "comment": "Malware payload (Amadey)", "value": "40a2442b211e8ffcd4fdccf7ba8f809c446e5259", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717627, "uuid": "f9943cb3-c5f5-48d5-a68b-07d9f1911133", "comment": "Malware payload (Amadey)", "value": "5c93e6d91978ba78f22d2743339fce75fed4a3e04e3bf0c0b76dd7bf5db62691cffebf2b2341e478d4e5a1b320683af5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717627, "uuid": "1305149b-37dd-4915-a9df-3685905ad4c1", "value": "T1CAD41243E3E98272D9B267302CF603871B367CE15CB9525E779AAD4E1CB2194A47133B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717627, "uuid": "26a726fc-720e-4c59-9849-20963343c73c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717627, "uuid": "569fe711-6853-4a67-bdca-0a0cff583dac", "value": "12288:AMryy90mTzU81jRboGS0cNsSrHRMMIulFrVTjmC2dr6ma59rz:CyNgCLINpewvgMmE9rz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717627, "uuid": "a509e2e3-ea8c-4e4e-98f2-40a2547e8ed1", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717627, "uuid": "b63bc1d4-9861-490c-b7d7-f3880b1d27b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717627, "uuid": "2f38dcba-41bb-4eb9-ab96-fe88369ba7bc", "value": "20a011e22f7c5e4179b3359a56f8df31.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31572a86-0a65-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686714023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686714023, "uuid": "39d7a8bc-e547-4e17-825d-cc82c236cf7d", "comment": "Malware payload (Amadey)", "value": "64542027193abfcb786a3242aa4bef47", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686714023, "uuid": "dad34c74-4d54-4076-b8dd-962275610aed", "comment": "Malware payload (Amadey)", "value": "33f81db1ddb6b353e3580da8f71987e18c132b44baeff5101a45ed77dd7c0159", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686714023, "uuid": "ae9cdddd-407f-4acc-825e-f4c77b5ca19c", "comment": "Malware payload (Amadey)", "value": "278f78528557e61c166e5595d23f8a99b0bd65db", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686714023, "uuid": "40a1d74d-f582-4c66-a813-744742d330de", "comment": "Malware payload (Amadey)", "value": "110016badf2dfff19bd1c3d23f329a561b1931daef72cc8b8bda344be9b1b22f6d9aec6c9ab607a5ad98c3862e023789", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686714023, "uuid": "06ff1e9e-078d-457c-8015-3b34fb62b44d", "value": "T1E5D41323BAE86833E8761B705CF6038317397DA08EB9535A3B516A4B0DB3A547871737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686714023, "uuid": "cd2b3e68-4b20-4d3f-bc96-a7830bb7e304", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686714023, "uuid": "ef9dba70-0d9a-4f22-b5ed-ec96f765d995", "value": "12288:pMrQy90UKne2/dxRO4e5rK9bUEyhdHZ7GEZZVmDC:BylKneaS48rKofMEbVmDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686714023, "uuid": "b8f6ed18-e0cf-449b-b994-80eed01452ec", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686714023, "uuid": "a1d68d2f-2bae-47ad-93c7-328642e7aa19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686714023, "uuid": "591e956a-4002-4d5d-a68e-f723f424ba6e", "value": "64542027193abfcb786a3242aa4bef47.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34e511df-0a5e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686711022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686711022, "uuid": "99a4aba1-49ef-4b6c-8c00-82bdab1b08ce", "comment": "Malware payload (RedLineStealer)", "value": "ebfb758a20885983a742c2ebe93947b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686711022, "uuid": "e118f6d8-5d00-498f-b23e-73f05ffc21bf", "comment": "Malware payload (RedLineStealer)", "value": "3414e421b9fe7ab68dcb492c20cb6a67a8d061711acd3baff0bcd3a24eb8a276", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686711022, "uuid": "14d1d520-2b3b-4c51-aa18-68ed99203b50", "comment": "Malware payload (RedLineStealer)", "value": "b91aa25f76040ab693847b5a68e4f23e45a73f6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686711022, "uuid": "b5c5be89-6e94-4b76-9e70-bd166852e1f3", "comment": "Malware payload (RedLineStealer)", "value": "c19f10ddb053e1aaf55de12b69bddc9790ee16abc93b75bbe7c099cc8189f2f54f718c409d2e4c1e955880046bf2f787", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686711022, "uuid": "c1bc24b4-78dd-4fff-bdb4-7691206f7382", "value": "T132646DC0A91CD231E2838472E87B4263560CE8767A54C7EF2F86A57CBA766D1CD54EC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686711022, "uuid": "f4d86ab7-3540-42ca-9415-e9bce40e0d3c", "value": "5b43169544844188711b217df61eb2d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686711022, "uuid": "5ebaa146-2844-4ea9-96e4-d065fb339443", "value": "6144:6WmxfwqinLkGnlpqY704pnH7hYx7oPG5RU0nCy:TqGIGnlpqYTVYxPRU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686711022, "uuid": "068859f1-5de2-407e-a6e0-147e59b8d7b3", "value": 326312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686711022, "uuid": "03049756-e706-4c78-be3a-89918a2d11ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686711022, "uuid": "9735718d-2946-4fc4-9be8-a6c9d34050fe", "value": "ebfb758a20885983a742c2ebe93947b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6686ad0-0aa9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686743452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743452, "uuid": "094cf10c-e6ab-401d-af20-88dc6e13b5fd", "comment": "Malware payload (RedLineStealer)", "value": "96350a2e8b56b9e6f5504fd0432cf963", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743452, "uuid": "393281b6-b833-4476-acdd-529b23283c69", "comment": "Malware payload (RedLineStealer)", "value": "3465cd8736d114a18428e219451a6d7b5ece4e43e094b697d3b4bbacb63fe03d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743452, "uuid": "8a683950-86a1-4ce4-9fff-303daec75f6b", "comment": "Malware payload (RedLineStealer)", "value": "a9ef51fa0e73e6de384224fabe9274fa691ea897", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743452, "uuid": "500b3618-d0cb-416a-aa4a-757082787874", "comment": "Malware payload (RedLineStealer)", "value": "03c6af2932e9e8685d920b681c256770d7f1e18a3366196b1e2c99809c220a3622d91c74f05053780bcf8b56f3cceaa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743452, "uuid": "30a56962-4e16-4c09-b5cc-83f52c732e29", "value": "T140543AB77792DB77E9D1D0BB9B2351A9C420A8F0B2DC24CED2806B1E56201E68FF0557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743452, "uuid": "1d1c6467-0983-48c0-9d7c-51e112bd576b", "value": "bb6d69b7632b1e5c0fdd9e8372c6b738", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743452, "uuid": "46740109-d3e5-41fd-af94-2bd58f6baf21", "value": "3072:4/7y5CZ/afS3dcyPE5PQcZ6qGtKY1r63fx8h0A2aH/6oBx:4/WMZ/aa3OPQVqGr1Qf6GQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686743452, "uuid": "8c9ccfb9-cc3c-4d25-8e91-46f68a4aa978", "value": 292483, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686743452, "uuid": "180dc3c6-78c4-4ef6-b639-628aa18955d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743452, "uuid": "186fd5f1-8c8a-4c0d-a98b-2c49c3f90f82", "value": "96350a2e8b56b9e6f5504fd0432cf963.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d285cf8-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728216, "uuid": "1dc18107-0a6a-44b3-93f5-cf810f9a2787", "comment": "Malware payload (Quakbot)", "value": "69948bc0b3199d1254753d803d702dbe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728216, "uuid": "884bce11-3966-4a9b-b8aa-533d65e57704", "comment": "Malware payload (Quakbot)", "value": "34eaf742d49a5ef0b40e705fde1a2780ef70ce88d0d35d473112002dbb75322e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728216, "uuid": "4e545478-540f-4e01-97b4-6029b0070d22", "comment": "Malware payload (Quakbot)", "value": "cbb3a2af6313f53ce20701aa36dd9f69661d65c3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728216, "uuid": "e1d94357-67c5-4b46-b981-bf145f6725e7", "comment": "Malware payload (Quakbot)", "value": "521df0d2adea6820005c3ccec15cf726cfa3539c93575a1f51654dcc782a8992447de59401a36e462b573da69b2b7b32", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728216, "uuid": "79d912a4-b8a2-4d07-9896-88326fc19a60", "value": "T11A6443896A45E0F18137B377CA1B8410FA671F1B2184C972B97C51592F3D86CBEB7E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728216, "uuid": "de8b9d2e-16a6-4a60-a556-8303eb69a434", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb8e+dDX9WFm9dBhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728216, "uuid": "0b2c23a2-00b0-4015-ba7b-a9d11291d8c4", "value": 325132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728216, "uuid": "15f61078-ecf7-4fb5-9451-bb804528a439", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728216, "uuid": "1c0a7773-052e-45d8-9da1-e240ae57df28", "value": "bPlQp9SLqckqp.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31eb360-0aad-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686745271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686745271, "uuid": "57a18e50-c078-46d7-9e8c-627244b88060", "comment": "Malware payload (Amadey)", "value": "a48faefaa3dbd6f779b21ea75d869357", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686745271, "uuid": "5d5649e6-5b82-4643-904c-76bb9d679bdf", "comment": "Malware payload (Amadey)", "value": "34fbe196b82425289d8fd0bca214f48a38c06c5edcc85143faf2cebdb4592a48", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686745271, "uuid": "dd4e46d1-62e0-4357-8ef2-2c9aa8aef868", "comment": "Malware payload (Amadey)", "value": "647998dd46c5c8215abe9b641a2ac2ce987ecfb5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686745271, "uuid": "776ad74b-156a-481e-8105-14692177d55d", "comment": "Malware payload (Amadey)", "value": "5f738adbbf69ff1d2b902066ea4ed97de93b02125c9450029ed1aa89cc7c3d2feb8f1589acc44aae6ccecccfc9a08ad7", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686745271, "uuid": "0f07c4dd-8610-45f2-9ed5-19fba6003931", "value": "T193F41243BAD84072D8B567309CF603930B71BDB5AE74927B2350A85E1D73B84A5B6B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686745271, "uuid": "b2acd393-19e8-4898-ba99-52ffcfc78f51", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686745271, "uuid": "73fca9b3-e863-44a9-b562-c1aea519e1da", "value": "12288:VMrxy90kBY6AxIOpXef19QeRkCSx1eGzkpcN3522z2/:EyYxIOQ/tkClGUOQ2a/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686745271, "uuid": "47d0f090-34b1-48bb-9820-11bc4289b7b5", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686745271, "uuid": "1fe95086-78b5-4e1d-abfa-43ccf30d19bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686745271, "uuid": "569a3156-18e7-4c90-99da-4931c364c7cc", "value": "a48faefaa3dbd6f779b21ea75d869357.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "346739ae-0af9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686777593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777593, "uuid": "f3bebde3-7250-4a59-8ce5-06018120d30b", "comment": "Malware payload", "value": "14e9b3646f19796b0c5c8bca22f8fe95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777593, "uuid": "5c04bee0-3d12-4790-b153-a964c5d3f81e", "comment": "Malware payload", "value": "3507d763b8c34c9072059eb85e8f64004e44d6bc5527dd67ab8d1d42f97f1d62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777593, "uuid": "fc20f43b-db71-4e25-8517-716f96b0ae28", "comment": "Malware payload", "value": "7ae4965ea14595d33ba1c2fe057250f7e12c2b93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777593, "uuid": "c0ae79bb-2f0c-4878-bd03-4798f051bfae", "comment": "Malware payload", "value": "82febebcdcdf7a77a3ec66c8c8e390454af9bba17c24059fd6b64249a55df36888823792862d4af3745954a75f50befa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777593, "uuid": "2ef16101-14a5-4980-a99d-b0a72d6641c4", "value": "T128D502222493B22AC1C2513A5F08C475D7E9CC24263AC92D67F1FE3B777D3A3059766A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777593, "uuid": "7ef3a211-e3d1-49e2-9f8b-13d491bc1acb", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777593, "uuid": "d95de2d7-d7e8-4207-9ce8-95da016918e0", "value": "49152:X6dPJkttttt1ttttt1tPqVFQttt7bxMrUcB+0X3zaopHR1MeyoPp66WBPxjF0txG:qdPJ8qVFYbxTh0zdBLMPoPppYIE/ENPa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686777593, "uuid": "3ff832b0-319e-41ae-bd0f-eca753ea1943", "value": 2903314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686777593, "uuid": "15f5ccde-7593-41d5-abed-78eb8d08a290", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777593, "uuid": "d6a28623-08c1-4b83-a349-1d38c8c14aa6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9165b9c-0a81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686726357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726357, "uuid": "7a04511a-635c-4868-b82b-0b30540ec5f6", "comment": "Malware payload (AgentTesla)", "value": "edb083ff424f9fe0cb0ce083980600c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726357, "uuid": "6fd852ee-3f22-4dad-81b9-48fcb3bcbc47", "comment": "Malware payload (AgentTesla)", "value": "35aa57cdcb8f0117a9c9412212044222efb94d00cd74b9a0e84d79fb236585bf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726357, "uuid": "fd0d59b2-9610-4e67-acd5-95927eebd1ac", "comment": "Malware payload (AgentTesla)", "value": "f845b867cd104f1378f1d79602715b0d6a3014d7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726357, "uuid": "368d3d52-bdd3-486c-9abe-fadddb14169e", "comment": "Malware payload (AgentTesla)", "value": "32df4b3396493ef214e3ac733cfff1ab436218800e87f13bbfe6e70331d2106e2fcaecf3468b0e820445be72a7bc4bb6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726357, "uuid": "6e24fdaf-6d4b-42e0-9f05-bf9fae101e85", "value": "T143D43374FF77E0F4C565C48F974AAA8BE32A75F25293A1872BC424DD501BD8A0A34B43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726357, "uuid": "6149751d-3b7b-4ab4-8f9e-87139dbd53dc", "value": "12288:0LQJhdD8EuxpI1ZZ7gDawVz7I72VjAdLRMBQ9D3T2XHKVwSpT+ghOSqHm:0LQJMEuxpI1ZZ7gjAq5AdLR9QjkT+gj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686726357, "uuid": "a946540a-7cc1-4dcd-bb02-f120248d328b", "value": 638337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686726357, "uuid": "d61872bf-d8f9-4a47-a0b2-fa154ff85938", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726357, "uuid": "7f6aef6d-9e19-40d3-aae8-23f7eb04e5a3", "value": "PO0001_88474755959_0282836636_927373_1.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0269c4db-0a9f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686738855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738855, "uuid": "a149f8a8-0d94-436c-b094-3208d9de607b", "comment": "Malware payload (Loki)", "value": "56677d90dd57da29bab6f859ee4b810d", "object_relation": "md5", "Tag": [ { "name": "45-81-39-192", "colour": "#C80259", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738855, "uuid": "f7ce81bb-c003-4b5d-8cbc-18d4d31101ff", "comment": "Malware payload (Loki)", "value": "35cc748980e782ab4b0eef2eda48148a5bb416cd926407f7d4eb5cd527c3be24", "object_relation": "sha256", "Tag": [ { "name": "45-81-39-192", "colour": "#C80259", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738855, "uuid": "c8ef68e7-48bc-479e-9c15-288e957e697d", "comment": "Malware payload (Loki)", "value": "cb717cff2a0e3dc01f0760152d712a25b7f478e9", "object_relation": "sha1", "Tag": [ { "name": "45-81-39-192", "colour": "#C80259", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738855, "uuid": "e5398f10-e5cf-4eab-90f4-8034473b03ee", "comment": "Malware payload (Loki)", "value": "98cc7c6f4722b7011722b6bfbe123600a58dde8a68b24be1120f0ad0e2fd139316405e91ea58dd8fb54e0a4202691d5c", "object_relation": "sha3-384", "Tag": [ { "name": "45-81-39-192", "colour": "#C80259", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738855, "uuid": "b1f82090-e61c-4b2d-8271-39e7504f57a9", "value": "T13274D0022120FC47CC0C6DF2382BD5DD9D675E7006AC5B3AEEE03A5A2B71F5E9B5A191", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738855, "uuid": "abcb5523-3372-46e0-8799-028e2ba9d9e5", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738855, "uuid": "146c0376-3375-40b5-aa7b-1e10ab10fa9b", "value": "6144:t9X0GiKbdOFMybyQL/8/WicQrzJKj5leufkfn7N1pL:T0XadOe8+cD5k/7NrL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686738855, "uuid": "a55c2408-1d85-409a-b240-e79074f0b95c", "value": 344096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686738855, "uuid": "f82e454a-67ed-47fd-bf8f-c93ca139e986", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738855, "uuid": "d668422d-7f3b-4e9d-9893-60c5a2e2de0e", "value": "cleanmgr.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8a35d3-0ac8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686756889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686756889, "uuid": "4d0617a8-f638-4364-b1d3-4aa52bcf5b52", "comment": "Malware payload", "value": "0fa8326cc3135653c3362f4e5122fd45", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686756889, "uuid": "161cbca5-1a6f-4481-9eaf-028bb7a6a630", "comment": "Malware payload", "value": "3648a2e39541acade00bd0e20da6f791316635d027b3d840ce5c8915e9ca53b8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686756889, "uuid": "644084a2-ffca-4bd1-988f-8cef32f90d05", "comment": "Malware payload", "value": "497d5476b9629286997befd897088cee2eee83b3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686756889, "uuid": "d162ff12-57bd-4147-999e-30275271a839", "comment": "Malware payload", "value": "e84e7af4351147db6fba5804fe2849626f369ead4d0983e7627a08b3ad3673371b676c3590603c395058f738812e5fc5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686756889, "uuid": "19fa1d56-41c2-4ec8-8c1a-3d892e4f6343", "value": "T10D5460996A41B0719133F33BDA1B9804F97B0F2B2184C967B97C54686F3D42896B6FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686756889, "uuid": "7c1701e7-983f-4765-9edb-02fffa810de4", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbJGI3DGu3Wh/ncghS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686756889, "uuid": "4a520b00-e746-42ee-87f9-10a96ef6a5eb", "value": 283291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686756889, "uuid": "cce2fded-3776-4316-93fe-c1d79314deb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686756889, "uuid": "0d224d9e-5f73-4e3d-a4df-f38638ddd147", "value": "398dGrcvpgWDeu.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4517b9-0abf-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686752969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752969, "uuid": "4d236d88-d439-4351-9348-a11809748fd3", "comment": "Malware payload", "value": "eb6b258d01430617f3c110b3d328ce61", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752969, "uuid": "0f0bf3d0-e19f-431f-a325-731048329815", "comment": "Malware payload", "value": "37ccfdcdbe04a47f9bf6ca8c5c96c9008c95ff24936d8e5a02b45ad291a3fc80", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752969, "uuid": "4d8a3cb3-c0b5-4e75-8d2e-8681ecd9aef0", "comment": "Malware payload", "value": "148d3407e74ae8d643222c75eb7c9846951f9fc6", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752969, "uuid": "db926308-9219-4855-8141-eb6f1107d837", "comment": "Malware payload", "value": "78f4dad8e1560f9cde50958878a928d273df6c17f74a95083fca26ef55247afaf22f330806d581d30164b149f449b751", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752969, "uuid": "a4e4559d-4232-4b56-a21a-1514fcb9968e", "value": "T1C8C48C57F7C7FAB0E6BE827A82B1851C527774520260A78F764472896F22392493DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752969, "uuid": "27ceb17d-ea5d-4207-9724-210cb06b0310", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752969, "uuid": "daaec9c3-d19f-463d-a74d-998634bcd262", "value": "12288:Jn/zDvGHAykHSzLW/4+8bzbBSreM32hgFK/UqW:tzbGHAzHAjX1FcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752969, "uuid": "45f4471b-a4f7-4f61-9015-dfafbcf24b7e", "value": 568837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752969, "uuid": "c437345c-2ae4-47e0-b508-f562f2aa9a31", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752969, "uuid": "4d57bf53-68b8-483f-9c5d-2745cf16b5ba", "value": "Purchase index 398.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c7e67e4-0b0f-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686787190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686787190, "uuid": "99b16e80-c4a3-422e-980f-b2ad2284b55a", "comment": "Malware payload", "value": "4b6cc351bebafc5a8dfc4ea4aa59fa4b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686787190, "uuid": "7305d637-2a6c-4809-91fb-a4d6a21c42e2", "comment": "Malware payload", "value": "37e0b7e14eaeeb2205c87261982e272eaa6dd4b95fdd2edc7b2a5b9d29b64a09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686787190, "uuid": "a371f33b-910a-46af-b93b-0094eb4bbdf4", "comment": "Malware payload", "value": "104aaf3125ada0828f23a4424a11b6f0699bd9d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686787190, "uuid": "c0636930-38e0-4564-93ca-8614223c99db", "comment": "Malware payload", "value": "1f2b783f1a501d716f63e4d40cbe8e8c90dc778da68564cce9904ea87a75d3dd4bedbbc83ef2a374cde67c33fd2bfdbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686787190, "uuid": "77f9b965-ad71-40f3-867f-ec4fdcadc2d5", "value": "T1E094021271E18D70DBBA13318D78C6715AAEB9210F74A58B23B8476F1EB06F09F72356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686787190, "uuid": "1e81a429-24e3-4728-8ded-aba7a3391497", "value": "554b97b4ca75d054417a17a8c740d1a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686787190, "uuid": "4ee96bcf-c39a-461b-92e0-224b36189b70", "value": "12288:ga/0Bp8z2+WEhg8DKG4NHeoX5IBg0nuU:gFj8zqig84NePuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686787190, "uuid": "eef2e61a-5799-420b-b357-1fb4bf1a46a2", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686787190, "uuid": "78a9dfaa-da39-4cc6-ab60-7709cbf57992", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686787190, "uuid": "60d0039d-e878-458a-9b6e-aa1aa2cc4558", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5744d6c7-0af2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686774645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774645, "uuid": "584d8d8a-f497-43e1-8cd6-1624a227bbe5", "comment": "Malware payload", "value": "f6e60d032e2c46ded6bd786f36e1b511", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774645, "uuid": "09ff1995-97a6-4691-b575-98bb69079554", "comment": "Malware payload", "value": "37e21f41ce608899314ed4e2f75c09a12b0192e0c2be1856e3fe4cbb8fb79a15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774645, "uuid": "b13faa69-459e-4601-93d0-4becd130f6f3", "comment": "Malware payload", "value": "21fcd4b34b1026ace24ead08c740f8eabde8eaf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774645, "uuid": "38198a10-be8d-479a-bcae-1b5239edf9bc", "comment": "Malware payload", "value": "4509a64259f2425eb8d927f3688f59835804caaf9d8c7583b31a1542a89e4e7075d9acbe9f2e22a30045446fa0a9a8d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774645, "uuid": "ecc86ac0-6221-4607-b761-db0111a3ea8c", "value": "T1EC83D606BB510FF7DC6FCD370AE91702348C594A22A97B367634D828F65B24B59E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774645, "uuid": "21572bf9-c349-45e2-bf86-21c26624a4af", "value": "1536:iVLyu95KR/kj752dCexuV/8UZlDwfkJ4MYfWB:iVLyMgMFezxu5VD1eA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686774645, "uuid": "79bdda2c-3185-49d2-b803-130161c8fec3", "value": 84780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686774645, "uuid": "e0d55285-9334-46cb-b42f-09c69641878d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774645, "uuid": "2aee87a3-e13f-4009-80fb-4b3caef72227", "value": "f6e60d032e2c46ded6bd786f36e1b511", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f29639f-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728676, "uuid": "7abfd2fc-972b-43c0-b2d7-5d2470827087", "comment": "Malware payload (Quakbot)", "value": "e040b912100ec2c3de3ce13a7627a3f9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728676, "uuid": "74dc823a-b071-4500-a3d7-1d645ac001de", "comment": "Malware payload (Quakbot)", "value": "38366372c790cda6ca1c286ae922e290d34fc010d76004b18a9773f165e96b52", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728676, "uuid": "26949148-1950-4c97-9be1-efdeb304e581", "comment": "Malware payload (Quakbot)", "value": "6f8f709283d2c84059e1a63c93255af9d0ac8d96", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728676, "uuid": "2352b407-dd79-479f-8635-b45005b6e289", "comment": "Malware payload (Quakbot)", "value": "a24563de5356e2df80296420e7650dda2677bd29dcebf01f7030a0c4566fd5a6d44aa26725852db95ad3dc985fea8a1b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728676, "uuid": "17283bf4-ade5-4664-b645-2bea7fcd494b", "value": "T1E9742384AA55E0F19137F37BDA164420FE6B1F5B20849932BA7C505C1F3D8297EB7E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728676, "uuid": "4771ba96-a3ae-4b7c-9281-2f21c4567973", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbBm6Bfd2kcVpKHSOqK0DLWKd:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728676, "uuid": "12739125-d251-421c-a523-c233b31aafd9", "value": 361396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728676, "uuid": "aaf53046-75bb-4c41-bbcd-703ee69b746f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728676, "uuid": "c76792b9-e304-4168-bb5a-d1782846da89", "value": "Rmg2vNmk1E0Og.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84be68ac-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686750670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750670, "uuid": "1e6fa3c9-0c8f-45e8-a820-fda4e6501c01", "comment": "Malware payload (Amadey)", "value": "3eaf05281edd69952c5d4f6aa7eb9905", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750670, "uuid": "1b5c530c-276d-4040-af7c-2aab2c0edff5", "comment": "Malware payload (Amadey)", "value": "385a86f6367cfd1e2b27d4440f0eb3085f3f9a13ba5e068afc92c754b54c1185", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750670, "uuid": "3836efa4-6481-49e7-9710-6ed15149f776", "comment": "Malware payload (Amadey)", "value": "56095a4e628c57dbb888d01005f7df46d3579cae", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750670, "uuid": "7635dd7f-d901-4514-9638-b0d20d3067eb", "comment": "Malware payload (Amadey)", "value": "adbb6e87bce1d02c4d974b851e7f19439dfa2ad3440c4a1fda0c4dc1c9bdb1fab7fb4cd16cb05bb2c6be4822ca73bc1a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750670, "uuid": "b1bcc372-0555-4723-8713-f173eb10cd1a", "value": "T1BD052303A6E58473ED76973028FB07971E373D656E65832B2742A84E0CB2680B4B177F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750670, "uuid": "e04abe36-696e-44f7-834f-408b10ffc121", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750670, "uuid": "1d7b5f53-56bb-4bb4-b765-6d1ae0eb1816", "value": "12288:hMrXy90/7MvMxFsBlSWXBY+Iyg4iIO5Gcu00riDMSvRO9/x2G9xPbjuCAZss:6yYULaHSlORuL2MGR+NxPbjuCA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750670, "uuid": "6d39ba70-3a8a-4b8e-8500-e18686e0759b", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750670, "uuid": "188d75d9-78be-4962-8e08-58e8784a5f08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750670, "uuid": "9b5ac8d2-0b55-47a6-80d9-dc58737ea48a", "value": "3eaf05281edd69952c5d4f6aa7eb9905.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8aaea0f-0a88-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686729255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686729255, "uuid": "6c4bfa66-5a40-4c5e-8e44-821d612f68c5", "comment": "Malware payload (Amadey)", "value": "325cedfb3e4d23ddf1062ad55b6f6b6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686729255, "uuid": "2ffc56cc-e4cb-46bd-9dfa-7a0fda614a98", "comment": "Malware payload (Amadey)", "value": "38d7fbdc314f881b461c766742a26d3df72c553d25c8f1c20da1adcdbea1afef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686729255, "uuid": "6f180eba-1cd6-4318-ba62-ccfb94b7c641", "comment": "Malware payload (Amadey)", "value": "bd30d64d8dd8f4862461da3137686951870a466f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686729255, "uuid": "abcebe92-d5f9-40d8-a34b-496dc3308b2c", "comment": "Malware payload (Amadey)", "value": "f62f455a02f123ead13a23491e9de99a8f209cbdc5490371683ba8f8db5867fd4e125beb89724acf0364be05f5ddaeec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686729255, "uuid": "5cec5798-9d56-4556-8b5a-ce041663a408", "value": "T1E10633B0FFC0C099EA4375716DF7A74566661ABC570829067094C82721F0FD7BAEAA33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686729255, "uuid": "19094858-9f24-480b-bb8d-77449f4bc41f", "value": "5bd91a0f42fd0a961c30b4fc8a1545ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686729255, "uuid": "d047cd1d-b6ba-489d-b6e0-cdaa096e3e8e", "value": "98304:uSWz0m6iijzsGupvTo9GDd1HwAOiU0KIX6ksJc:Tfti2Ys9GDd1HjpU0pX6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686729255, "uuid": "8c358841-52c0-4ef6-9210-3ce4db920d28", "value": 3891384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686729255, "uuid": "bb8874d8-76d8-4e50-aeef-dc81f6625723", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686729255, "uuid": "3dbb20ec-47dd-4016-a0ef-9b73e55136d3", "value": "325cedfb3e4d23ddf1062ad55b6f6b6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba1baa8-0a91-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Neshta)", "timestamp": 1686733018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733018, "uuid": "10fc5335-78ff-462a-a4c4-67d052902924", "comment": "Malware payload (Neshta)", "value": "625b0222413f234ef2dc85f735c74782", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733018, "uuid": "fe37c831-46d0-4a35-9c3f-16eb474b596f", "comment": "Malware payload (Neshta)", "value": "393d94791809b4059141bd1d6de789b431a71eb544bc7f7b0d7a1700c042ece5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733018, "uuid": "6b46955b-af83-424a-bef0-142c768bd407", "comment": "Malware payload (Neshta)", "value": "8503534bb692b7f03beac0da33e7bbd7599aa1e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733018, "uuid": "180dd701-13db-40e9-9313-77a62d0e5905", "comment": "Malware payload (Neshta)", "value": "fd5ab71b43cf697bd69251ee7a79c1e0e9e092a3f23dfef962e796897d0829c9b8451cd1177b880eed8796a963047b86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733018, "uuid": "d6f72e2f-d3de-4dfa-b815-39f4cf3d763f", "value": "T12005CF40713A2957EAB8BBF4025052B087BA2E5B615DE6D98CF670DB51F0F43CE8192F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733018, "uuid": "fa14607e-7f93-4c1f-b2bc-2c9c253e486f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733018, "uuid": "b7c7beee-1dc6-4b7f-8dde-14581507b811", "value": "12288:ZlKnuvEXqXdVjmZdDcghPsNF1bFu4yjyLrb/npXZdFpQF7T+:+24qXdVKdDlhP2lfvDnNQ/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686733018, "uuid": "bfbdb68a-d10d-4bc6-aad6-af020953723d", "value": 872448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686733018, "uuid": "caf5d174-94e5-4c4e-bad5-5c8aff616f80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733018, "uuid": "e7757fb9-95ff-4462-bcbf-f4111efb352d", "value": "BANK FUNDED SLIP COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed0ade28-0aa6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686742255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686742255, "uuid": "051d9a96-f74e-46d1-be0d-dcd07648fbca", "comment": "Malware payload (Amadey)", "value": "32e0986f68c5dd3b283313681c0b74d4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686742255, "uuid": "08b6f0bc-56d7-42f8-8a90-4c797d339c4c", "comment": "Malware payload (Amadey)", "value": "396c7efdb10954bc477823d7989b0dea1566fad3ed070de8088f729560856d22", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686742255, "uuid": "9e9a8319-6ce8-4772-9d77-5cc73b98e700", "comment": "Malware payload (Amadey)", "value": "c60915d079deb7d747885125f53dd34405fa8bdc", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686742255, "uuid": "1e8f142b-2f87-440c-b321-9fc000af6c5f", "comment": "Malware payload (Amadey)", "value": "fa53c372be408238e82a59637f54d5127e31029df602d26bcfc8817b887bcc4b702b815f41cf89a971063d9885380ede", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686742255, "uuid": "a9c2347c-ba22-4f5e-98ce-dfcf40077218", "value": "T16B0512926BFC4022D97517B818F303831B357CA1A874C73B6B979E582C72AC8997573B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686742255, "uuid": "30febae9-a59b-4131-b495-40caa437ceff", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686742255, "uuid": "41f1c58d-8a21-4aa6-866a-b38c7ac0c1e0", "value": "24576:OysfbtuaINefdfIYWm4HZjw/kNVJwZP8oiI:dsfkaINe5IYWJZ6kKZP8oi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686742255, "uuid": "e2c70720-23d4-4e66-b95c-7225acf811de", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686742255, "uuid": "0572c85a-05a6-4079-ad42-82481d9b0460", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686742255, "uuid": "025b66f2-0881-450b-9eea-33bbae6ed242", "value": "32e0986f68c5dd3b283313681c0b74d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6066fb0a-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728704, "uuid": "3180e62a-9795-4aca-ab68-ded401b070ca", "comment": "Malware payload", "value": "fc00a188001cf7562531c11e5e11447e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728704, "uuid": "6c1e39e1-c339-4ce4-9d11-324bb47757b8", "comment": "Malware payload", "value": "39a8756e71329bbc08f4e950ea658cd64d02c9dac58531d4c9efc0cb08f71a2d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728704, "uuid": "7d637537-7228-4e17-b3e0-0bd460db7fc4", "comment": "Malware payload", "value": "d201072a8c3854a6c1a98b5e8ed8c121e5e4c24d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728704, "uuid": "9a89c657-d3b6-4102-8659-e772b1136992", "comment": "Malware payload", "value": "3247e484fa13c09e7f0ca018e026aba84e85758200f2e7e1e372f55c00b0512c66938f35b80db16078f8ce5a7b667bb6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728704, "uuid": "fe7e6185-cd94-49b7-be3b-c4d68a2f8aae", "value": "T1626443896A45E0F19237F33BCA174410FA6B1F5B11849972BD7C505C2F3E429AAB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728704, "uuid": "0bfcffc1-6fc2-4536-8c26-df258a40193e", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbsJZQg1DchS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728704, "uuid": "1f8f0310-46b6-4821-b676-44d6d0362794", "value": 324928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728704, "uuid": "11e7953f-99f9-4a8d-b53b-0f535a67b99b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728704, "uuid": "46c6cebf-c2d2-40a5-b69f-9837037e276d", "value": "S0KAnumfvmD5.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6df5f12-0a7a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686723239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723239, "uuid": "e4afe345-7df6-4d1a-b693-087bb99ab25d", "comment": "Malware payload (AveMariaRAT)", "value": "e414116650ec46b8d88e268ed5002ec5", "object_relation": "md5", "Tag": [ { "name": "aufierionformaticascom", "colour": "#F12079", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723239, "uuid": "4d4c3d07-71e5-42a5-a04f-fd7897297745", "comment": "Malware payload (AveMariaRAT)", "value": "39d52031b3b23bfe0df643388b37d553547f7ffe8b44c186af565263887e771a", "object_relation": "sha256", "Tag": [ { "name": "aufierionformaticascom", "colour": "#F12079", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723239, "uuid": "69f940a3-961d-4631-847a-ccefd18dbcbc", "comment": "Malware payload (AveMariaRAT)", "value": "077ff2aeeef0a205c3b70c39da574ff3c76ed072", "object_relation": "sha1", "Tag": [ { "name": "aufierionformaticascom", "colour": "#F12079", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723239, "uuid": "b02de294-72c9-4533-bf1d-9ae00ffd392c", "comment": "Malware payload (AveMariaRAT)", "value": "b1687c5bdfe5314c3a77016138a43591ce272879bc561e9730578e9ff238425a08cd1d8b4b843898884062111064c9b4", "object_relation": "sha3-384", "Tag": [ { "name": "aufierionformaticascom", "colour": "#F12079", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723239, "uuid": "fa11e42c-4148-4caf-97a6-192127baf160", "value": "T14545E0730552FDE5EE6B196CA40816581CA12C57AB7CE3A8FDCC02E362F6568DE19CF0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723239, "uuid": "23710d43-3ca8-4eba-b1d4-14de55712b31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723239, "uuid": "71af925c-ad49-4421-ae10-a0ccf82e9e86", "value": "24576:asS/iqJCNYiOmLVzX2sMbJNAiprjg8Gl0PvXFqOmCtKP:aaFOuV72d9drjbGlgdu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686723239, "uuid": "77d3150f-49ab-4579-a014-55037ea55955", "value": 1164288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686723239, "uuid": "4f56ac21-0ce7-4a9a-8107-0f4eca3af7d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723239, "uuid": "a22b13dc-d2d3-4bd5-9fd9-170df1b1057e", "value": "Quote_JUN75698-LD8972390\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a97f944a-0a58-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686708641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708641, "uuid": "937280a2-e33b-4d23-b7f0-fc4493c1b049", "comment": "Malware payload", "value": "fc2842ad9baeba52803c3fb16dd95f87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708641, "uuid": "f6ed0ad7-623e-4afd-96b1-7dc45b9c26ed", "comment": "Malware payload", "value": "3a14ea9470b1c715a0c38ebb588bcc0d5546e68a02a01b17cad520ba0b191134", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708641, "uuid": "99e6e51b-bc95-49fd-9efe-6dcdf4dc4734", "comment": "Malware payload", "value": "6cd033061a20a192ed0569c1befc086feb03f091", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708641, "uuid": "b6a63aa8-28ff-4516-b5a2-9edb8c71d154", "comment": "Malware payload", "value": "d89d55616af94aeb34c67ef488edfc3a2eb4abbd8e71a63b058139992540fa763eefea2703e281cb0d0aec1cde1dea33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708641, "uuid": "c2cfb783-c7e1-4cb6-8469-44ca32af41ea", "value": "T16A067D12FA418036F4E301B565BFA67E4939BF201724D4D393942EFA8A31AD17E3635B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708641, "uuid": "56f1754e-7959-48ea-a3d6-2b9cdeef6225", "value": "0c8a3e301e7ed0deb68cc93611deefdb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708641, "uuid": "5e659ca2-2d40-4cec-bb41-05f67bd1093a", "value": "49152:9Cs7YDbu5IHjb33zxEcArGc6fwTuQ3QdCe4FI8SPG7QC0yJYXL0jj4C:9Cs7YW5+L3yGDfwA0/p7QjSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686708641, "uuid": "7f8c6966-3305-4ca4-9671-95c5d9ca7612", "value": 3758487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686708641, "uuid": "d029a0c5-7af1-4211-8f21-acaaeb6e4266", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708641, "uuid": "a8e8d7a9-1b8d-454e-9aa6-3087017978dc", "value": "EasyConn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86a8a408-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728769, "uuid": "017c64a0-3255-4a86-9dc3-63b9cefb7d0d", "comment": "Malware payload (Quakbot)", "value": "c4c442f4b941e8a62edddaf47602eb94", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728769, "uuid": "31a4429e-1f1c-45da-882e-77c40e36f066", "comment": "Malware payload (Quakbot)", "value": "3bda63a1f8c60521a0d35aa8c567de92bad4caa26a67b10f9c32a40f7498fb44", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728769, "uuid": "41113417-7e52-4258-8c12-ef8039a19baf", "comment": "Malware payload (Quakbot)", "value": "6fbd7b9d34b8f72a94a0ae08ba216587f3e09b0a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728769, "uuid": "566ed65e-f247-42fc-9596-d4c92dacf757", "comment": "Malware payload (Quakbot)", "value": "e820fb700271e10ff3fc2f178cf701b487d33711e30dd4cf7bc0252161e0aab6ccd96f7a6d949a50569ab71b72f943ee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728769, "uuid": "733fab50-54e3-4ceb-b574-e5d02f2e21a1", "value": "T1A3743248AA55E4F19237F377C95B8410F9AB1F1B2084C972B93C50592F3D829BA77EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728769, "uuid": "f28b88ae-15d4-49e5-9367-b8083f651201", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbCa++0aVtiX1hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728769, "uuid": "e1bfa525-f5af-4f86-a0c7-d3029b1bd8f9", "value": 340865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728769, "uuid": "97853318-16d2-4139-850d-24b15cd8fc55", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728769, "uuid": "23c758f3-f4c1-4024-be89-e235be986c17", "value": "PKDY2uSbGkVPn.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86b0ed95-0a5a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686709441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709441, "uuid": "de7b45f8-a37f-476f-83e4-63d4d72c6f66", "comment": "Malware payload", "value": "b8cea1427508f578226714361f5c8594", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709441, "uuid": "8f45f749-b169-45aa-b51e-407811266f4d", "comment": "Malware payload", "value": "3c682c3d6488fb4d83ce6a5526c7d239bc99063e510576ad74d990f465de7822", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709441, "uuid": "4108a6c5-ac3a-4212-b3ab-bd3c3c9b4bf8", "comment": "Malware payload", "value": "d44ce9e7fab22f1ec25073d62dcabcf5b4b36308", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709441, "uuid": "7dba17ce-f963-47a0-97fb-d0db484f2856", "comment": "Malware payload", "value": "65f73ef82e60213f74c34ccb633dc7afb8d6ebc642bcdcccc586551646288675b0083593011ef16f585a1a23e55cf509", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709441, "uuid": "f2210b1f-f3cd-451a-a1bd-da9a9ce6cb9e", "value": "T115F612C3B7D8582DC07641B2884E76A5626B4D25AA43AEC7390C3BEC2DF36E45F05BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709441, "uuid": "59a3fdc4-2bce-4cca-9ecc-ce0292c5ce34", "value": "393216:Bz+B12RK1zHCrs1mRho6ol7VsAIc4hDCcfXM0hEkF:VW12Y1bC4AaVl7VNKf80qg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686709441, "uuid": "8cca43a4-d500-4321-a1b8-15d44a96a473", "value": 16116133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686709441, "uuid": "1337dbee-7768-4025-beb0-e80a6f94cb24", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709441, "uuid": "3bcd82c5-f1f7-4ffd-8b23-b65a649893ed", "value": "tv-latest.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf9461d8-0ae5-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686769237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686769237, "uuid": "c241c21d-ec99-4684-889e-46be73e65d98", "comment": "Malware payload", "value": "dfb581d475410d56964d612b27deed04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686769237, "uuid": "cab8f940-134d-491e-b8a2-31ce3661d807", "comment": "Malware payload", "value": "3c979ae1af88397dc5be34fea28050d85cd283898d71e52c8ad1db05c407458b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686769237, "uuid": "e237dd8c-dd46-495e-aa1c-f124fb471808", "comment": "Malware payload", "value": "7b442cbb69901dd4b1d8fd00334fded04ee3bfdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686769237, "uuid": "007b867b-1890-47c6-bd4e-e0cdcffb3c2b", "comment": "Malware payload", "value": "07a0074e1256f10d967e71aad9eaf4220e8f3a016a785817b3ac3dbfb5a5ffe0361cf0a15d3d9d7b357391f512b4bf25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686769237, "uuid": "bf06fbb6-a156-4a50-9842-c470e3c84f9c", "value": "T14B5418B77786CB37E5C1E0BB972356A9C520A8F0B6DC14CED2807B1E56601E68FF0256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686769237, "uuid": "2e1ad68f-ae88-406b-bcf7-9c144ed8a2fe", "value": "bb6d69b7632b1e5c0fdd9e8372c6b738", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686769237, "uuid": "ffab1ae4-5904-4563-9ffd-fce7e51a1fd2", "value": "3072:hfeKl8OErmZvy0j90YQB3IxgcDCJi8vc7rUh+28YZvt97k/pBxe:hfhl3Ermj90Ya3EdDCsmck4rSG/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686769237, "uuid": "fe27f6ba-9fd7-422a-82eb-3967b6176511", "value": 288888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686769237, "uuid": "56dea992-ee44-4246-8b60-08247c3fe1ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686769237, "uuid": "160640b8-77e4-4e95-8f54-a3b42a33f767", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c445b0c-0aed-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686772614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686772614, "uuid": "aa0f6fe3-22ec-459e-b8d5-740d7d96efed", "comment": "Malware payload", "value": "5a19f861b9701d7226cfac819baf9108", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686772614, "uuid": "f8db29d0-425e-4bba-a31c-170d4527b968", "comment": "Malware payload", "value": "3cfb326d54d88ae4da2e1263564a914e7d765a331f6f6c08d3cf9f9c05bf87ef", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686772614, "uuid": "b95a9881-4b9b-4c89-8a81-700e4fb1ebb5", "comment": "Malware payload", "value": "e06069f06e2e4e08605b611fa4d3af663834dee0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686772614, "uuid": "88d25386-7e68-4102-9422-56989b839778", "comment": "Malware payload", "value": "136f4f9ce44345cfc15f71a46cba0057b3bd8a5434f267ba8e74ca6f81fc7fc084e473bf62e6956efa4a6a322dc80346", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686772614, "uuid": "1417ddce-b9b9-4a2d-bb82-15cfcbf8e7f6", "value": "T12111EB09FCCBC0A64B27F29242A4E819E7D63144F932ECBDBF80D49510213E9963859F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686772614, "uuid": "c376a79c-61e5-4d68-a59a-d22c4e961109", "value": "24:NqLKAn8LuyRIf3Rr/wZ8u4RUq54fD+mlxoJBwH:Nq+cNt3BrOK2Vo7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686772614, "uuid": "4dba0370-b080-4d67-9026-02884864e64b", "value": 1073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686772614, "uuid": "baebde93-bdd2-4880-a392-d1742521e8c1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686772614, "uuid": "4b1c8e80-3e27-4770-a82d-2698d0a2eb34", "value": "Curriculo.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0828669f-0a81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725979, "uuid": "fe9ffbe0-7e16-49b8-8b5a-c765f888bc12", "comment": "Malware payload (Quakbot)", "value": "506f20a2e0d5050a21756d6e1c0576ce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725979, "uuid": "83531d9d-edd3-4654-ad85-7405cd2eb058", "comment": "Malware payload (Quakbot)", "value": "3e1667b0ade50d60845228578f60a6540cdbd21bb0bf6a52bc186a239d809409", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725979, "uuid": "75e02836-67bb-4dab-8d19-c1fcf9e8b868", "comment": "Malware payload (Quakbot)", "value": "21889bae36213783c179a377f472135b32cbdc75", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725979, "uuid": "55de86d0-e22c-450a-af23-cbded1c27b4c", "comment": "Malware payload (Quakbot)", "value": "62b6dc55e0b7e350f8254340bb105490284a9e7aa250e854bb0ff9c5ee083167d70eedca5b355fbdbfaf4b0080e5900a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725979, "uuid": "7f2f89c2-000c-408d-911b-7e4fa625dcab", "value": "T1597421456655E0F18237B337DA178420FAAB1E1B2084C972B93C505D6F3D8697EBBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725979, "uuid": "5b3a5486-d50f-4b5d-9aa1-fafad3ec840a", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbwONE7U72yRhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725979, "uuid": "05d78fa6-9b45-4690-95ed-d050553b0059", "value": 351111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725979, "uuid": "8a5b9213-c6b7-4396-a9ce-e0c68447a46e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725979, "uuid": "ebca6ceb-2133-4862-994d-4ad7b3180aa4", "value": "gfgztqfzPGCE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f7ccdc-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728199, "uuid": "2c466040-ded8-4162-bc46-da170a879eee", "comment": "Malware payload (Quakbot)", "value": "49687e54d7f90656fb07f62bdc3a0cdb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728199, "uuid": "aa1d69e1-eb08-4db6-aea6-08eafeb1c3f4", "comment": "Malware payload (Quakbot)", "value": "3e7f948117ef7d107ff4ec5e2598d93364a37771193927f8188819ee2a60bc0a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728199, "uuid": "7a9258d7-8fb7-4b6f-a3b4-57adf1515612", "comment": "Malware payload (Quakbot)", "value": "f32febe05222fbd25eaea8a85494de1c053e504d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728199, "uuid": "1d08f86b-744d-47a3-a191-e996ef0816d6", "comment": "Malware payload (Quakbot)", "value": "86069dcb18fd27c8c4635ba96d5be5527d43b75e965e66f7c6e360b0d7d6743c2e52574e47b5ef0ad368c76b61408c1f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728199, "uuid": "ee2f9b0e-7930-434c-bafd-194167cd20a0", "value": "T1CE743285AA50E0F08137B33BDA574010FAA71E5B20C4CA72B97C50596F3D8697EB7ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728199, "uuid": "d3c5be38-0690-4260-98f7-c0bba358c0cf", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb5qlvRMhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728199, "uuid": "2a44b3e3-cdc0-4240-a53f-7bd16b326496", "value": 353655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728199, "uuid": "46fe6312-20e1-4adf-90bd-5d34c682f8fe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728199, "uuid": "2d9932bf-c16a-4f83-b08b-d5a36bd28db9", "value": "c7uTjOcvUCN3I.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ccb2e7-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728302, "uuid": "053c90e5-39c5-4e1c-9f36-cbb0392eb5af", "comment": "Malware payload (Quakbot)", "value": "8c616c6042d7bbc7929c2d509f28edf1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728302, "uuid": "2b35544b-c22f-41e5-8fb1-86c8719aa1c2", "comment": "Malware payload (Quakbot)", "value": "3ee16b577ee32fab665db753b79031e1de22fd16c928db3f0e5000213409f70a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728302, "uuid": "7b6f3af9-621d-4ff7-b914-944dc3f4eecb", "comment": "Malware payload (Quakbot)", "value": "07123be1c12a6fe8334f13a09d2223d913b9406e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728302, "uuid": "69328b34-df77-4234-91e7-c3a357e53cad", "comment": "Malware payload (Quakbot)", "value": "3ea659ae5e0470f2c9ef588320e3ab9196315743f04a6995c0da0260320436d80a20ea9626a022bc414ce2b64245946f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728302, "uuid": "8ee3ce8a-3d78-4936-b627-cc8377b232f2", "value": "T1097443886A45E0F05237F37BDE074454FA6B0E5B10848A72B97C50592F3D8697EBBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728302, "uuid": "1d16959b-66d2-4249-a9d6-48c30e3bc8db", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbTU7CxuuhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728302, "uuid": "abd46309-87dc-4a29-8698-1c93ba2e3657", "value": 361945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728302, "uuid": "fc565ea5-a97e-4142-9ca3-096c7b3ce288", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728302, "uuid": "23570a0b-5225-4479-bb64-c7bd01f0ef26", "value": "ZcfWDkeld8r85p.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d286c53-0a98-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686735947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735947, "uuid": "194291c3-7daa-40c1-b9f9-afb27070ab59", "comment": "Malware payload (Amadey)", "value": "78f21f196a23c929cc025daceaa9f80b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735947, "uuid": "be143d63-3e0b-42d9-9911-4f16475c4233", "comment": "Malware payload (Amadey)", "value": "3f076f8d7f76b9319e751b835f2af3a1a220ee8cd29173048de12d13ed2605ea", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735947, "uuid": "8bf1d82e-db41-4800-9a37-1f7e0aca8e67", "comment": "Malware payload (Amadey)", "value": "18af8a0d286d5e6efe21c55f438e085a47754b6b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735947, "uuid": "497e4845-fd55-4f65-a378-b38443b34b4d", "comment": "Malware payload (Amadey)", "value": "af5e661832736e6ae3a64928c37ea4f64ace679a00d74a31c3d892e898a5e75434b10d8a83a4af182eac3db3a7963196", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735947, "uuid": "d6a2f698-f612-4b6c-aa86-6bed0cb20038", "value": "T102D41213A7C49123EDB02FB099F607831F39BD969C78466B2745285E1DB2AE0E132777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735947, "uuid": "410f9a46-5679-4b9e-8ea0-1875fdc430f0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735947, "uuid": "16235512-802b-461d-81cd-f113f37b83bc", "value": "12288:dMrOy90wi5aTFLs5kHhAp0POpl+3+5dU+ziPhdSZNhm6:/yxFeHTUzPHSZO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735947, "uuid": "ffaa623f-d03d-4929-a34a-cce4896f50ba", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735947, "uuid": "5dca1922-fd66-4272-8b41-77bf6eba268e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735947, "uuid": "a32ae957-494f-492f-ad14-dc4c5368fc7f", "value": "78f21f196a23c929cc025daceaa9f80b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "244fe1d2-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686750508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750508, "uuid": "151c7189-39c3-4231-b416-166cd25fd951", "comment": "Malware payload (Mirai)", "value": "09db2dfadb95e4fdc78cfea1bbfa0383", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750508, "uuid": "b89538d8-b4ba-432e-b878-85fd092237d8", "comment": "Malware payload (Mirai)", "value": "3f3ed2aad348fc524682df65d82eae55d01f3e649115ff191a313d6b8e1cb1b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750508, "uuid": "3868de67-97c8-4d3e-b322-13c9600fe0f3", "comment": "Malware payload (Mirai)", "value": "0ebeb6fc701a86ac0b9abeca109d2af41b2b1b5b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750508, "uuid": "85beab8c-6d5f-48bc-b295-4eb6b9d1d26e", "comment": "Malware payload (Mirai)", "value": "5251406c752b14e35c66d9fd207837e0247022451816ee60eac01fcacf80fab1f66621098bb02208717577afc5e732d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750508, "uuid": "462d778f-88e7-4976-9f27-7b2304484e6b", "value": "T1C3A2D108E2959930E7300A36B93982C11BFFA67C41EBB0354E3A114D9FC476663BABD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750508, "uuid": "f5dc8ce9-10f2-456d-a342-53345b610a38", "value": "384:Yi6T4hCpPY14atkkqPZBVR11L4x9TIfcg9w76josshymdGUop5h3:iTYXCatkPzDPExheXdss3UozJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750508, "uuid": "a458c090-f658-44cf-8534-d5a3991fcf87", "value": 23380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750508, "uuid": "395cee0b-23bb-49ea-a8a8-a4d59edb0ad5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750508, "uuid": "2557189c-02a0-4920-be08-f58ff0727ed8", "value": "09db2dfadb95e4fdc78cfea1bbfa0383", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150c5fe5-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728149, "uuid": "092ce827-88cf-44a0-b68e-ba9365667e0d", "comment": "Malware payload (Quakbot)", "value": "f49ed8df4640e272cf595120d203afce", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728149, "uuid": "c3feb19d-01c8-41f2-bde5-05db2ae5a595", "comment": "Malware payload (Quakbot)", "value": "3f733ad9f96e30a8aa31544d88230988680516637eeb449dca39e67053230da3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728149, "uuid": "a85722e2-fa28-4708-88fc-2e9b0ef8a69e", "comment": "Malware payload (Quakbot)", "value": "d1783a1f2e0e8bb854f661067adf9a9d42b555df", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728149, "uuid": "8a49db90-81e2-485b-907f-bf196c09d349", "comment": "Malware payload (Quakbot)", "value": "fbcd8f451b0beb320734256ea456fd9f26a91e6abf7a2dc966352e03f97ea0bb913fe40c55ddb4339a67d4308a9837d0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728149, "uuid": "d2af751b-28d0-45c6-9e44-1c88b4290d74", "value": "T13B742F496A51E4F18237B37BDA178410F96B0E5B2084C972BD7C50592F3D829BEB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728149, "uuid": "3a2def77-3719-4759-a72d-24079a98bf76", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbO+h3vpyhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728149, "uuid": "16a276d7-8840-42fb-bf6d-cfc7c7e65ee6", "value": 341137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728149, "uuid": "99cd705e-33db-4abc-af70-f5f8c0edfe23", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728149, "uuid": "776816d7-1818-4d59-8692-ed06eb38993f", "value": "d9bCXtyaSJkUz.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e3ac63-0a67-11ee-b3cf-42010a9c0076", "comment": "Malware payload (QuasarRAT)", "timestamp": 1686715183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686715183, "uuid": "97f5f757-9e33-4edd-8741-ab6eacf12baf", "comment": "Malware payload (QuasarRAT)", "value": "81fe02b22a1c5d7d2f58071929b4c6dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686715183, "uuid": "c8d4f6a4-1c4a-4dd2-9ed7-ad630dbdc827", "comment": "Malware payload (QuasarRAT)", "value": "3f88f0443415341f4807693ead6bcd3be97d7437ba10d01f7b4969dc4ca53a3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686715183, "uuid": "d3fa0547-50dc-4aed-b550-6b298d3b9d5a", "comment": "Malware payload (QuasarRAT)", "value": "12d91d12d4e7d0475b815683bbaf6311a4c5deb5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686715183, "uuid": "8cbb047e-9c38-4715-8667-e1f6ae4ea972", "comment": "Malware payload (QuasarRAT)", "value": "7f43f82c1718bcdb11b26f9097576c65399e12ec1eeb13a0ac4bb3930d8b1da2f2280348d31f3c74bfedce0bc950a6e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686715183, "uuid": "167ac5f2-d9af-4a47-a346-a8d3b132e6cb", "value": "T16A858E47FF95AC06C8E806348C97724E63A0E84574FBA76F2D4CBB349E672834DE5621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686715183, "uuid": "9e20007d-9f39-4117-a228-591ddc0da5a9", "value": "6f543444487328d5966207cb412374d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686715183, "uuid": "a0192953-5d10-437a-b47b-b4c27fa9103f", "value": "12288:wG+i1cTob5rpXuEq++p6xG5ssxODepysgSk9DyL1HUyIP9IylT8rhke6nuRs9U51:wrkcG+p6U5U8ae6n+5OaKdWq2o14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686715183, "uuid": "0679ee05-c419-47fa-b134-569564476eab", "value": 1856034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686715183, "uuid": "7e753b2c-d295-4538-882b-d1531175315a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686715183, "uuid": "be784364-dd8e-4b93-a698-a0b77d668a6b", "value": "81fe02b22a1c5d7d2f58071929b4c6dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078d641b-0af9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686777518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777518, "uuid": "ad31d788-04dd-4fa4-834d-cd94307c6a7c", "comment": "Malware payload (Mirai)", "value": "ab50bd22e88aa2494fe3c09238621102", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777518, "uuid": "eebde536-1714-4a9c-82b8-6200c98d75e1", "comment": "Malware payload (Mirai)", "value": "3fc175993372295ac8610105fd6c945cabdc9a6a20f8cdb05fbef9b50a737cff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777518, "uuid": "f6cc7769-b2d8-4689-8925-261a0cef8952", "comment": "Malware payload (Mirai)", "value": "5da3331fb3ea83ffc2651a356337a117a73cee05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777518, "uuid": "1f0850f8-37fd-404c-b529-d5614a325d25", "comment": "Malware payload (Mirai)", "value": "e3bd0fc42db855709b29967be5daa840267d57d330286afe3ac68cc9698cc7bdf2e3621454c80a4614b2d1e3159b2fec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777518, "uuid": "4134f410-7fa9-4132-abba-3fe5e272241e", "value": "T158B3BE65E0A56CE1C250023430F19A395773F809E61B5FF36888C7AEA44BDDCB65B3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777518, "uuid": "deb25f2d-13b8-4271-b31a-6bd1e6641faa", "value": "3072:lV4UT/adsuUBi0tzvpjnVsIHRElmhZb/T3t:b4UueY4zvRVO4fTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686777518, "uuid": "2d51c460-abd4-47a7-ae0b-979257ad0466", "value": 116308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686777518, "uuid": "602affea-e0de-4444-979d-0ebc84ad881d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777518, "uuid": "10b463dc-42ad-4820-bc5e-9b1abd9b1452", "value": "ab50bd22e88aa2494fe3c09238621102", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f49cea3-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686750500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750500, "uuid": "5aa32f53-0dd8-4eb7-979c-c12ed4f37912", "comment": "Malware payload (Gafgyt)", "value": "18769a6e9011efce10291f389b1a4f24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750500, "uuid": "7bcae36c-a6f4-4eca-ab14-8a710af5b662", "comment": "Malware payload (Gafgyt)", "value": "4013ea0c48d12d68a0a469e3779b01be1594fdcb3d8b2a0ce6a48fa6392a4f31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750500, "uuid": "198d1c94-6eb9-4bee-97d1-ce33c8756c4e", "comment": "Malware payload (Gafgyt)", "value": "5a43b19ed4b81fc8229b853e574c871c87cc2308", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750500, "uuid": "256ba652-ad35-4458-9c5e-8de1f2e91e67", "comment": "Malware payload (Gafgyt)", "value": "cafd39bb36b0d56929e22231948e0dd834e95ab115bcd1890ba37e12029f9db7d31cdd7e5033fde56f81ec8cec489d7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750500, "uuid": "524fc134-dc1f-4a36-a330-3049f824b6db", "value": "T1F3932B05F8454B13C1C227BAB6CF47493B266BB95BEB3302A6346EF02FC5B991D25950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750500, "uuid": "ca56d766-436e-447d-b335-9afea3670231", "value": "1536:yu5sWiQ5ftEesFfw/DrRTOsB5hOkKxX86I0mRxqQEqn/lJXfPe:jiMsGrv5hOkKO6/mRxqQEqn9JXfPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750500, "uuid": "6fa8f901-4521-43d8-819d-46c1aca8b03c", "value": 96196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750500, "uuid": "f2775e14-473b-4977-b992-d4ce45e010f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750500, "uuid": "613faa0e-7634-4d02-a1b3-dfafc7190290", "value": "18769a6e9011efce10291f389b1a4f24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a59d15-0a71-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686719189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719189, "uuid": "09a4d7df-7fc5-4e3c-a5c6-494ee92feab8", "comment": "Malware payload (Amadey)", "value": "cec38db77b3a25dc6152c3613500e9b6", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719189, "uuid": "671e25da-3ae4-46ee-bc5b-a01b93301fce", "comment": "Malware payload (Amadey)", "value": "408b193a8fcadc5e16a9d81012fcab5b79d63cd26423db4e24c8f128d086ae77", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719189, "uuid": "b8d7349c-524f-4ae4-aaa3-3dc8cd60b356", "comment": "Malware payload (Amadey)", "value": "cda7d9ccf80650cc7afa652fba199033ea24d619", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719189, "uuid": "aec16e67-9107-409b-a539-38869dcf77dd", "comment": "Malware payload (Amadey)", "value": "e6942b9a7883bcacf075680166807747f90fcaffc18c4ff64959cdedb12532165920254969a29a232c702b77f734d4b4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719189, "uuid": "e4217c17-15e3-47fd-a78e-1a8a4812e308", "value": "T104052252A6E46573D9B027314CFB07970B32BCA54E70969B3280AD5F0DB3A84ED7136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719189, "uuid": "1b4d68ec-6d59-44de-83c7-8ce90426893c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719189, "uuid": "604a942b-2399-4398-bca6-c71d3fd5b677", "value": "24576:uyaf8Kl6Ynp7alf9iA5MmZExSfI5iDt1af:9abRpYFFlZpfI5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686719189, "uuid": "881520d9-4813-42dc-a6a7-f72dbdcff0f4", "value": 869376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686719189, "uuid": "6188b26b-6600-47be-9217-b63934785afe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719189, "uuid": "ee65526a-82d4-42b4-9b38-d268063c841f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84787047-0a94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686734348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734348, "uuid": "9c4c21c2-b5c7-4278-91fb-8219fbb048c2", "comment": "Malware payload (AgentTesla)", "value": "1e8f818a8c9b3b3c753da3d25e60ff54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734348, "uuid": "9d4eb7a0-db0c-4359-ade9-e913914b6271", "comment": "Malware payload (AgentTesla)", "value": "40b0a076e904042e87b4cfae93b7ae9ac00db794675cc4bfd2ca57fe55fb0949", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734348, "uuid": "00b36eae-3146-48e0-a96d-21149cac4259", "comment": "Malware payload (AgentTesla)", "value": "1bfd4cb563dda00bcbdada885f40f456fd55ac5c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734348, "uuid": "fb144bbc-cb0b-4fe1-afc1-94c8fd9b9b5a", "comment": "Malware payload (AgentTesla)", "value": "f55c1ac7a2c1d9a31550ec29e960e9142f8b5b1d875cb807d5f8b41f29159d1401d7eda0ccefddd8e9667783f25e5820", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734348, "uuid": "f5d34c2c-499f-464c-a3c8-54c6de0b02b7", "value": "T1A705120372889B71DD6958F5D1E7053D07F6F14B2F72C29D7A8600C24E437E5AACAB8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734348, "uuid": "05dc3e45-6a70-41d4-a645-905ca3981c8c", "value": "24576:WsyU382vQERTp9LCAzxyVx19hqBjqEewXdb:vR3zg5q6Gdb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686734348, "uuid": "319f30e9-2024-4d72-8540-9c85e39808c4", "value": 873536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686734348, "uuid": "7eadcdee-a892-4ddf-9391-06c495ff9ea4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734348, "uuid": "2d1042ed-a1e1-43a6-882e-ff1b8dc01180", "value": "solm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86bfec1f-0a5b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1686709871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709871, "uuid": "1582bd22-97b2-463a-ba1f-0e8571c34981", "comment": "Malware payload (NetSupport)", "value": "877f5e83fb39de16fa8bbd93ba9f07f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709871, "uuid": "e89b025b-bfc8-4e43-b331-dbed5a0a582d", "comment": "Malware payload (NetSupport)", "value": "418744fa1ade539c280461387df87dda6bf84c7d755ebbbdc6123fd5659f9467", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709871, "uuid": "fdcb5d13-58b9-4674-b142-abd6692c99a6", "comment": "Malware payload (NetSupport)", "value": "4ccc61ba1722484042734579dff6c1a97bd37366", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709871, "uuid": "c7927a94-2fbe-49cf-aee6-4cb634ab7fc6", "comment": "Malware payload (NetSupport)", "value": "4eab59ec3695cabe817392aefe5c4d6cfc3df9bfa9ab9c21862df166aedfa43dbd21d20008985bc8afb0865ceb90885d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709871, "uuid": "c1a8b46f-1cf8-48e2-982e-f0009dba0cec", "value": "T1E4A3954F428DE173EA92E97DC8859B040D51BDC8B5B058FB11AEF23E3E3178D6B6405A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709871, "uuid": "89500eca-bd46-4c23-8cd8-9f9cbeb911c4", "value": "a9d50692e95b79723f3e76fcf70d023e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709871, "uuid": "79c43d67-2c90-4d61-a9ef-22349e1bc358", "value": "384:Jh0wV5+6j6Qa86Fkv2Wr120hZE4vtV/CptVDikH:f/VZl6FhWr80/E4vtV6ptVDiy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686709871, "uuid": "46667371-3011-4ef2-a001-856f5f684bb0", "value": 106352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686709871, "uuid": "ce3d9b98-dcf2-4f15-8afa-39e85a638870", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709871, "uuid": "ade0f38f-84af-4635-a5a6-65b3912a883b", "value": "SecuriteInfo.com.Trojan.RA.587.6199.17468", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd08a60-0a7a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686723033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723033, "uuid": "d0e079f1-9537-4126-90f6-66eb79e3c367", "comment": "Malware payload (Amadey)", "value": "600baff3b1d62f0aa2e61d4fe8cf6b7c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723033, "uuid": "62c4680f-8c32-4a3e-9503-de539c7bcb0b", "comment": "Malware payload (Amadey)", "value": "43ce833e235d033bb322611f4789a3d54037b9dbb23397748af2bf71addd4606", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723033, "uuid": "a1ad4f6f-f736-4821-9070-ff59d53c32a4", "comment": "Malware payload (Amadey)", "value": "70a8987b38d9303bc90f129e75cab6ae547f6f15", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723033, "uuid": "64364cc8-6aaa-4995-9253-fc818b01aa06", "comment": "Malware payload (Amadey)", "value": "a4869d0e0321f03bfc0fcafc18b48aef0fdd3ad45f127db51c971efee0d3b4c2d882763bde18685fd471fdd8ff7034ae", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723033, "uuid": "e9445167-8742-4522-92f5-320ee9e26828", "value": "T145051289A3D8D873E9B627B05CF70B871635BCA14834A6763754D86E0EA2ED1D430737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723033, "uuid": "ab069ec3-f25b-4bf0-9dde-c81fb6c07055", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723033, "uuid": "e79610ee-12d5-4cee-ac30-3f8787291342", "value": "12288:kMr8y90Dlln0jRTMakl1RtxHiXA1G9kNoPIzyoZ/55UJstNGLrV4U6HJ+j:AyClp0jRXkpLdp+q/5m0N6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686723033, "uuid": "afb6f917-998f-4348-99f1-a2194a7ecb68", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686723033, "uuid": "59a0d3f3-29a9-46df-8f98-27442aa120dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723033, "uuid": "2b8147df-fd2d-43fc-ad4f-3eae1cbf047d", "value": "600baff3b1d62f0aa2e61d4fe8cf6b7c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f0234f3-0aa3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686740755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740755, "uuid": "e7142e7e-7893-4660-a570-b16247fea66c", "comment": "Malware payload (Amadey)", "value": "0dbade627a61abbf40f9ea2112d70fd7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740755, "uuid": "4130ed8f-15fc-49a4-a03e-03bbbefb1b85", "comment": "Malware payload (Amadey)", "value": "43ea91a89f9de60902984248369f7a3d4fb32bd7d9c6e31695041fd608ff2622", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740755, "uuid": "bce144e5-6c7b-42d9-b9f8-eb1b20f86e63", "comment": "Malware payload (Amadey)", "value": "60d4e5dccb8ee3575df941d1a2ae1c7352cd58b5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740755, "uuid": "5661227f-72a8-40cc-acc1-e52478a6ef92", "comment": "Malware payload (Amadey)", "value": "b21a6ab768fb82cc86f3e40492d3263485c1fabc17524b3d65fb46a262f8e053df20b580c59e4517ada9715b3254f122", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740755, "uuid": "32abb5d6-f5c0-4e9e-925b-f167f3bc0572", "value": "T124052343ABDC9073D8B467F45CFB068717327DB14FB8D36B2646AA5C09B2644A83136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740755, "uuid": "55f067be-749b-48fc-b196-bddfd65ade04", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740755, "uuid": "070823fa-868e-4aea-9247-9f9dfd1e1243", "value": "12288:EMrey90aa89OD0Grm1KLgkAeCbmdvOuv32R7SngE2ThdzS32Akt33m5H/PScO:KyqBJr8NkA7ymY38SVjktm5HHScO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686740755, "uuid": "df3d82a1-d56b-41df-a8c3-71b31ec30aca", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686740755, "uuid": "ce00931a-d99a-49bb-9a93-79194c5cc286", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740755, "uuid": "6b4de587-b152-43a7-84b1-5d40e9ac45a1", "value": "0dbade627a61abbf40f9ea2112d70fd7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ca47a70-0a57-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686708029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708029, "uuid": "34c1cd44-0c22-4263-a536-41e9133d55ce", "comment": "Malware payload (Loki)", "value": "e06f6453f8f79e10faba4bcc8041cd17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708029, "uuid": "a3141c8d-afe3-46dc-8453-0efd2b953467", "comment": "Malware payload (Loki)", "value": "444a16946d94ad161477432da668856aac2ff6b3e283bb944071812f5554f526", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708029, "uuid": "be82e1ff-1878-46f1-a387-57654d49b580", "comment": "Malware payload (Loki)", "value": "1452fcd44d6823985ad822913bea041fb58d0c6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708029, "uuid": "3f914f0c-31ce-4a62-b349-b9bf73acc897", "comment": "Malware payload (Loki)", "value": "c25e32a8f8efa1792136a18470dc9bc735765616a65cc0035edc024e7003ee4d79eeb39159687309441972693f3e4bfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708029, "uuid": "6dc76805-c5f7-4df2-aaa5-0ead0997c436", "value": "T1D4F4DF8172392967EABDCBF50251627087F63F4EA25DE6E84CC2B0DB52F0F814651E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708029, "uuid": "7a8d92aa-0d7c-47d3-867b-52b253dd6ae9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708029, "uuid": "7243aa5d-46f6-484d-aa64-35a09bfdd181", "value": "12288:SlKnuLEXqXdVVLfmOixrsULlgNX6eNZKXNcM9YAC:nm4qXdVFuPr1LgX6u/wYAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686708029, "uuid": "49f66a46-f17a-4b0f-8693-1126a1edf3e3", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686708029, "uuid": "80d6505c-d599-4880-b351-6e9c08d225d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708029, "uuid": "c7cb86fa-1245-4ccd-a667-331084498e51", "value": "FedEx 72310313717.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c1183db-0a6f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686718416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718416, "uuid": "cc8b063b-5e61-46ff-9650-8156f5ea8457", "comment": "Malware payload (AveMariaRAT)", "value": "300131621ccf76718104b9ba1e10b3da", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718416, "uuid": "02e59ffc-28db-4feb-b87c-e94dc610b075", "comment": "Malware payload (AveMariaRAT)", "value": "447de9f98d9a2e15fd94809353e7489e4448a3f48aa3c8937d8dbac8ad4c11b2", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718416, "uuid": "a05ad276-da7b-475e-aed6-ed99686f9648", "comment": "Malware payload (AveMariaRAT)", "value": "2fb8ed4fa65a8106e482613768e067dd0847cc36", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718416, "uuid": "749c1cb5-ee6a-4a56-a05b-7e1caac44ac9", "comment": "Malware payload (AveMariaRAT)", "value": "f92b146eb542d1d67e5057d5f70396fe64c02aa56f4dccab7c121beb62ae64046bbda944774009d7a7630af8297349bb", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718416, "uuid": "09d30860-8982-460a-b395-6f18716e057f", "value": "T111D4E03C26AA8B2AD83E47F910B1151457F87D5B3496EB1E4EC278CF5F72B810522A73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718416, "uuid": "1a3a9c75-9079-44bb-b6f8-c1e1f3eaeb3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718416, "uuid": "878a6789-440d-4664-b245-52b4ab240760", "value": "12288:aYF7XPD/BZYsxhJ5QWyLuhsw+4ZDNoNl7ODRSLLh:ai7XPDgsV6Ha+4ZS74R2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686718416, "uuid": "42d40bf3-06b8-465a-b0f5-b4fed511dac6", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686718416, "uuid": "ba00d6f3-d0a2-47d7-a81b-b53f8095d382", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718416, "uuid": "da707964-aba6-4123-9489-db60c23129e2", "value": "IMG_1123.JPG......................................scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c52ae06-0af8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686777096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777096, "uuid": "8b6f3c5a-8651-4a4f-909e-d49db8ced7ab", "comment": "Malware payload", "value": "d1148e3d96e945249049366cb68352a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777096, "uuid": "afa6c106-2b61-43c4-b2be-c6d437944535", "comment": "Malware payload", "value": "450714f2a4886ae2ca59f8b7fb7e97a1b4c6fa6f015aa8a3d5deb4e05920e8a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777096, "uuid": "e03bf848-48f5-4eed-a856-e275c9547d3c", "comment": "Malware payload", "value": "2650dd7a58154b2f56ce01431d7d3c44b34c283d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777096, "uuid": "c77964fa-cbf4-4915-bb6d-c423ad3a251e", "comment": "Malware payload", "value": "42dae45a70de236c96e50df0ffb3824d79401fc083e9fb28f3741e098d3772e51d4f7149f4df98f787f7f30dd4197bc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777096, "uuid": "93d0f35f-7be1-4c38-92bc-c56e3214dd6a", "value": "T1C79523292BCCE813CBDC83BA559A1272ABF2942072C3E7E7554D5EF02D41369FD141AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777096, "uuid": "b536369e-e0ae-45cb-b36d-672a98ed7bfb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777096, "uuid": "693f54f7-dad1-4803-8bbf-d4052892be6e", "value": "49152:N3DoAWWMlfRTvHrq5jZFE0XwQtcbNn9+XvHzSG:GA2fRTvrq9ZPXXubRMXrSG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686777096, "uuid": "253a390b-90d4-42ac-86c1-14c238b64575", "value": 1893376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686777096, "uuid": "993c6bd2-b970-4cb5-94e5-ab3e55dd9a0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777096, "uuid": "101da809-8489-43f2-8284-e460742503dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80cb0e41-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728759, "uuid": "871f46e3-4a6b-4744-9417-c21c320ef6b1", "comment": "Malware payload", "value": "49164f8974e11adf59b70aecc05002ba", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728759, "uuid": "99a7ac53-610e-44cc-9be9-a943060b8663", "comment": "Malware payload", "value": "457a814a86507539b3cba66c89ffef0fc5a9368981ef445f27813ccb05f2743b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728759, "uuid": "dfcab867-f13e-4d68-b157-c1ea463113db", "comment": "Malware payload", "value": "494ce403e3cb5c6479f565a850fee3ffd4d583cc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728759, "uuid": "ada1083f-ec62-4ada-b111-0119a5563463", "comment": "Malware payload", "value": "563d1938267b8b1bb6ed3bf6e54c247ce53b237f8d3a6548532567d5cec8bf5440ed206f305286c6db7475f2c5819ba8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728759, "uuid": "05102ade-aa49-4a80-9ff4-181b633d30e4", "value": "T1946423896A55E0F09237B33BDA575410F96B1F5B2084C972BD3C505D2F3D828AAB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728759, "uuid": "8789a10e-5a59-459c-ba73-b32056c4b07c", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb5G7GC3Bn8vhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728759, "uuid": "13ca4951-e619-4559-81cb-82076b5ae83f", "value": 322836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728759, "uuid": "09ee2c5a-a1d6-4a1e-9a63-37c48a238467", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728759, "uuid": "da64d970-076e-4b3a-99a5-2047dfac0e5c", "value": "QP7xDOXB413d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd946b3a-0a85-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728055, "uuid": "e1a85632-e2ce-411b-865b-7b034b9b9f1d", "comment": "Malware payload (Quakbot)", "value": "5d38d0820e299f692c126eb32cc7502a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728055, "uuid": "7f14ea22-ef29-4f5a-b92a-fb495b1159ba", "comment": "Malware payload (Quakbot)", "value": "466dea06686c065a5ac52c98c45beb0fcfde21d035d466604b37245d7746432e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728055, "uuid": "4ee0b9ba-04ef-462c-8393-337848a56c9d", "comment": "Malware payload (Quakbot)", "value": "9bc3c1679937d9b4cb7130af9d6f93e14198a71a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728055, "uuid": "e56b12b4-2941-447d-9850-9535b58fa10a", "comment": "Malware payload (Quakbot)", "value": "f79a32d9b669ac44022d6f154d30b86c9c50de32bf942d99a59a4191498faa48bbb35307832c00d3421610b492b37ad2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728055, "uuid": "d015123f-ba3c-4789-825f-f39dbe5cb349", "value": "T1316453896A40E0F49137B337DA579410FB6B1F1B20848936B97C505C2F3D86D7ABBE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728055, "uuid": "a2a6ae56-71e0-4292-9df9-f64778a4885a", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb6EGn2fKaKBqPw3hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728055, "uuid": "1d9d26bb-7886-4dc2-a490-ee5eb9e69c10", "value": 324300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728055, "uuid": "1c24ec93-4d63-4237-a348-72c4f807b52d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728055, "uuid": "3f367a39-a52e-402d-92ae-9158b844f85b", "value": "fjptXj9py6ub.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a6d353a-0b0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686786247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786247, "uuid": "edacd289-94fe-443e-8653-b628407aa92d", "comment": "Malware payload", "value": "5257b9cd2aa25a2f2f7127f1b9663e76", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786247, "uuid": "cdcc8e5a-6c20-4989-8a66-926fdefdcf1e", "comment": "Malware payload", "value": "46f34cde2327b419337554aba74d7b380c82d8cfb761cb538d44b1c3e2447430", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786247, "uuid": "806ca792-12aa-4eac-991a-c2821a105f22", "comment": "Malware payload", "value": "6dfd57cf86116fc24b8184bb41fdc70b4820ad9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786247, "uuid": "6bebc9aa-176a-4040-8290-aa63f73064da", "comment": "Malware payload", "value": "b20ccffa1c094a434fd5ea9efdf010fb11135c446eb26cf2dea815064fbf3a989b0de30cc27e80c4dae2c282865d18a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786247, "uuid": "fa0575f6-21b5-4b7e-b442-27eef07de01b", "value": "T1ED0533341970930BD9B57F3A50B4F12E13F2EC142AF699174799AFB927C1A34CD2AB18", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786247, "uuid": "b67186a1-2460-4fed-9f53-2736b01d196e", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786247, "uuid": "ea2cbd27-3f8d-40ee-9d2a-eb1cc2de0c2f", "value": "24576:r9bWirn3x7wv5IZWeu0DEqsBgMdHVx2YVlX0++VpKXaJb8d:jz3Zwvz2AFdHVxVMFQd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686786247, "uuid": "4c99735f-24d8-4c91-a110-e4cff03c57df", "value": 828412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686786247, "uuid": "7b19563f-9080-4074-926a-73597acfd0fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786247, "uuid": "e3576d58-b82d-4e59-a1ca-56088ad27efb", "value": "rPROOFOFPAYMENT0224002039597720230205.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66482af7-0a93-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686733868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733868, "uuid": "63961895-9a8e-4312-9e7b-0edce077e9ca", "comment": "Malware payload (AgentTesla)", "value": "c96860ffddade9836a1a27bdf576a383", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733868, "uuid": "e361ffb0-4556-4f61-bcec-0d28223a237c", "comment": "Malware payload (AgentTesla)", "value": "471abb66ab9da6ec99d1a501a0cfcb6cb8f0b5de262f12b8f3d334bceadeca9a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733868, "uuid": "f0130da7-88a5-4ca9-8f15-4b6dcdb22431", "comment": "Malware payload (AgentTesla)", "value": "b7837094771b56fe46426d351f58e7b661114b76", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733868, "uuid": "b582e92c-1aac-4cad-bbe9-e8d57c266e83", "comment": "Malware payload (AgentTesla)", "value": "add19f8555c19bf8fc1206b90b0f1b1fb1a9f839e99791ff683b70ab0a1d88f2b263600eba7a75f92af9448af87eb20b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733868, "uuid": "90e45e42-0043-4460-afed-c666531a3195", "value": "T13354238DD3093289A01977EB8D72689E85BDB54099F834D457CE30FBE5538B500A93FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733868, "uuid": "82f8fb60-2508-4105-bf64-5aac01aa6234", "value": "6144:QLbv6NGqYZMsfnw0/yuGimcLwW0siBxQ2mwC3uqoRVjZ0xOLQzWXkZ0fKa:QLbvYGqYY0LLbcVBxVrCaVAOLQzWAGKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686733868, "uuid": "89af830e-22cd-4aa0-bae3-8b022c48c273", "value": 280348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686733868, "uuid": "358cb699-35a9-4b88-846b-e712009953e4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733868, "uuid": "cb6ce7c6-844a-45c1-aeb9-7f6327946a24", "value": "00000915862.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0f411c7-0a9b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686737456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737456, "uuid": "3be12809-7ddb-46bb-aeae-0a3961507d25", "comment": "Malware payload (Amadey)", "value": "0ecc3565040e466decc9461176359d49", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737456, "uuid": "0ae06221-cbd4-488e-a26a-c48db5969030", "comment": "Malware payload (Amadey)", "value": "4790e1eaf47ef457f0c94002ed82db7ad40322436fd80b8d2c6fe6ba6408f42d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737456, "uuid": "ca68296b-9a63-4a89-bf88-0258f90761a7", "comment": "Malware payload (Amadey)", "value": "4c7844270b377237d98725474b9ccda269495639", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737456, "uuid": "43bb2506-28ef-4f41-87db-620bc346c6f1", "comment": "Malware payload (Amadey)", "value": "9879cf7967da2ec2776b1fcc5358aeab65f579ddf477151511ad5155b4b17462f82d49db8387f5b730c83f43e89d5e5c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737456, "uuid": "c5125aac-6643-4c86-9031-755860373b59", "value": "T19324F7217D12C032D96161B619F5BFF2C59C6828ABB049DB7B800F77DA122F73961E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737456, "uuid": "36fc0bcd-2c99-4c86-8dc3-9e502c313ab7", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737456, "uuid": "05dc7080-6b92-47aa-be6a-82d06d9a198e", "value": "3072:CXkSckkHbzG1iXAt60p0zuNmnKG7peNMQbuZAIOb2y3xfbT:8kSDAzG1iciuInRexuZAIKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686737456, "uuid": "d039d5da-c448-4343-b454-bba7d0f7afa1", "value": 210040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686737456, "uuid": "139de275-f86e-487f-9cae-e83748e10583", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737456, "uuid": "028b5d0b-67ac-4785-a756-cb41dbdfa30d", "value": "0ecc3565040e466decc9461176359d49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b46e637-0a57-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686708026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708026, "uuid": "07c48c38-7078-41ea-9fe0-94f1e4972adb", "comment": "Malware payload (Amadey)", "value": "128624d474b264b2345102f59a11b35e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708026, "uuid": "1ec4efaa-9e82-4664-bb5f-98cfa5dc6973", "comment": "Malware payload (Amadey)", "value": "47e5212d6dd824f18b5ade681543e30d67820f61f37cbbe6b8e23187b5676a08", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708026, "uuid": "ac9c9077-78d9-4521-a554-c76198752c68", "comment": "Malware payload (Amadey)", "value": "2cada6ec492b2bb0bcffc49b2a50a5d145ecc24b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708026, "uuid": "9365ad72-11d2-4b1f-962e-7ec7ce852846", "comment": "Malware payload (Amadey)", "value": "2ecbc06e8f1915a1ae8b1081c83f973e05a35ce8403a165745a7ea972d6e8bcb851f82bccdc86906293379af70607f0b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708026, "uuid": "509d3a47-f5dd-4848-9bd4-bddb9c88ba30", "value": "T11AD41242B7D86073EDF1237058F722D70A393DD1A8B8565A2388B99E5C72AD4A532327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708026, "uuid": "382242b0-1f6c-4c87-bee4-28dbbe8fc22b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708026, "uuid": "5c551863-a434-48f4-82b9-bd8ef3217e3e", "value": "12288:IMrsy90dLsr4CNdqOsbXl0MOIiRWJ5Nl2z1AE748uC:ky4srPAOsChIiRGGeIWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686708026, "uuid": "1adb3b7b-6dec-4a8c-ad7e-4697a0729b02", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686708026, "uuid": "8c3f184d-f73f-4fca-b3c2-1b10cf0c533d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708026, "uuid": "c740be21-8140-4022-83fa-f759abed8447", "value": "128624d474b264b2345102f59a11b35e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddf9239c-0a6d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686717748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717748, "uuid": "0042c4bb-dcea-4488-bc0c-37a483716537", "comment": "Malware payload (AgentTesla)", "value": "e3892042bf175c73622bfaed2f873285", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717748, "uuid": "5ed4bcd5-4cd3-412d-9a53-86b7230892c8", "comment": "Malware payload (AgentTesla)", "value": "4847347facd980bb852e37939fc0c65b12e11c6e4e1070a6fe128c8124b688be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717748, "uuid": "4ed09d60-47b4-4ec2-a364-6c5f2c7d5546", "comment": "Malware payload (AgentTesla)", "value": "02213eeeab034d5f50b505e3d2c39d7035542be0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717748, "uuid": "404e7a12-2a88-408d-b601-b1353214c1dc", "comment": "Malware payload (AgentTesla)", "value": "90e8d2ebe6f9a0ec547591892849382d7b829bd866d5a8be0479e1adf72c417adae9e11e8f4075fe9145ff76e9945c50", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717748, "uuid": "4b3e4243-f159-4d9e-a9a0-0441c14eb4be", "value": "T11A850221E1945C7DE886CB3845A3628A811D7C677E8E98452745732A7333BF2EAF334D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717748, "uuid": "d79910d0-4456-447d-9f42-530bab1d0393", "value": "49152:Xuq7+urdP0guN7+urdP0EsovX5nZEX+Y4:XX7+urtG7+urjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717748, "uuid": "e94b5858-9625-4a6a-92f4-48ca8fe1faea", "value": 1739776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717748, "uuid": "96987f18-fb55-4d0f-8b37-3371c7f717d6", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717748, "uuid": "f1e5d56d-1c6f-4081-bd10-4b2c3f117a12", "value": "shipping docs.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ce2be9d-0abf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Arechclient2)", "timestamp": 1686752724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752724, "uuid": "bd29b53f-de56-4ce5-92d9-38c840bb2098", "comment": "Malware payload (Arechclient2)", "value": "4509256a05f0d4090c11f2d424a33529", "object_relation": "md5", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752724, "uuid": "c97ca7f6-dc03-4c60-9ee5-005e9d93baa5", "comment": "Malware payload (Arechclient2)", "value": "48fe1f7de453f1c52b9c1e8f16017e2a39f7cf45ba57748809196f9fd3fcb63e", "object_relation": "sha256", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752724, "uuid": "99a31617-3446-423c-97ff-ec8dcc154872", "comment": "Malware payload (Arechclient2)", "value": "a0812e84e6c423b55c771ad05695cff5e20b37e7", "object_relation": "sha1", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752724, "uuid": "9e657bd2-8efd-41af-839b-dcb39216daaf", "comment": "Malware payload (Arechclient2)", "value": "ddbb4ede24bf29bee7f435f08a9f1c287076f8350004b1579f908daa7b7e209d1d87526865240bf0ff935ba161a30f60", "object_relation": "sha3-384", "Tag": [ { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752724, "uuid": "08740c29-be77-4485-a0b3-885d65211f5d", "value": "T1D3F5338CB711A7A3CE985AB0B027DB7527B1ED618C021BD7244BBA354D76486DC22FDC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752724, "uuid": "42fd8b4c-5b5b-49ed-98ff-70923a2099cb", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752724, "uuid": "fd13dd55-b2ab-4a55-b67c-05a423851de2", "value": "98304:UPmS8VELAMoLmnXETJkK6rcfC9kUAm6yK6u:M8VwAM4cElkK6oskUA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752724, "uuid": "ebff5e57-a67a-4c67-839c-894fbb76b1cd", "value": 3467264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752724, "uuid": "2ce94979-2721-4930-898a-3661caf561c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752724, "uuid": "834e3681-fe79-43bb-8275-94a8dea4a222", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eee6e09-0abf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686752807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752807, "uuid": "265e499e-cb3f-4305-bf61-58e7d15aea27", "comment": "Malware payload (SnakeKeylogger)", "value": "fc2856bd1b502c6339d6e9beba5c0a7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752807, "uuid": "af77a104-ed2c-48a6-94eb-3b11fe03beb7", "comment": "Malware payload (SnakeKeylogger)", "value": "49307d98509c8c1c1dd733bf8c19cace00412eca43bde30607cc2a156accba1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752807, "uuid": "ace17376-854e-42f8-afe7-bf87fb7cc922", "comment": "Malware payload (SnakeKeylogger)", "value": "8727f1c74e4da9136fda5fae77350ac150a8b8f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752807, "uuid": "4c026b6d-dad0-4cc5-bf5a-e1b3f3f8b4cd", "comment": "Malware payload (SnakeKeylogger)", "value": "6f4f9db565f7affb628d8e466789392bf3fd33f0d79f30824171012192072f4b081758cb3550c86acd08f44726d5f0b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752807, "uuid": "d0e66123-f2fd-43b7-a3fa-e91a0aa6d6e4", "value": "T1B5F4DF41327D2A67EAB98BF5025062B093F62F1FA25DF6E84CC6B0DB52F4F404651E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752807, "uuid": "9982d7a8-4dc2-40d5-9a56-27ce13b6d8cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752807, "uuid": "ac544970-dae9-4735-87b6-00e863fb0beb", "value": "12288:xlKnuDBDUEXqXdVeJR/sV59nrv/YfaFtSAySgEJh4ZNKBicJTR5NeU1TYLfuK0KR:GcU4qXdVOingctSOgc4DK8cD5hc9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752807, "uuid": "76e8d770-d182-43ee-8076-b5f58ad9914c", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752807, "uuid": "3a65c025-b31d-43d1-9c3d-63ebc3731d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752807, "uuid": "20499640-688a-4cb7-9967-3c773b436ee4", "value": "MV INO HORIZON.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e1c6f33-0afb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686778549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686778549, "uuid": "72c9c514-a97e-4b57-8026-c9b619718aaa", "comment": "Malware payload", "value": "68d8bd660ae36f0dcd4df4301491a49f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686778549, "uuid": "2dc4d38a-d632-48f5-8aea-4ba5fe32f2a3", "comment": "Malware payload", "value": "497ee0244fcd1e0701229f46cc570ae2260497bb0ba0471089344a8016aee0cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686778549, "uuid": "33ef73ce-41b0-4fdc-b25f-b84db4283050", "comment": "Malware payload", "value": "a514e8a226b3db2979899d60469c500fd0562c59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686778549, "uuid": "f957434f-46d3-45f3-b0cf-8de35b60afda", "comment": "Malware payload", "value": "05e2f93212a8a1019ab7f5fec49821a02edb516544eed16057805fe7d3441822849f398531621f9562c06401c7c6f75e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686778549, "uuid": "343295c8-6fc4-4080-b414-a7a6479b24a2", "value": "T121051206BBD88832EC31AB304CB713D30B7AFC6059785B5F2755D54A1DB218878B677A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686778549, "uuid": "842bd908-035c-4b07-8cd0-4ef2a588e9be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686778549, "uuid": "274812fa-a2b1-4976-9a83-09ae31dbef14", "value": "12288:jMrEy90hg0B/wK+I0a/GNus5THgYaQ4Q2eJPoSUejGDlcUUndcwEhsli:jyH0Bl70ak5DgGdvoSUejGDlMndchso", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686778549, "uuid": "ba2afad0-e5b5-44a3-b8c4-43179624d02b", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686778549, "uuid": "cf659be2-3e96-4510-b18f-5c975e3ec806", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686778549, "uuid": "b575afec-5682-45a8-aac8-eed972111d1e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e600f075-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725922, "uuid": "b81eca15-30f4-42f8-be0c-e116d7306ecf", "comment": "Malware payload (Quakbot)", "value": "0c71e619515fd2d52375f4a80f7d9c5c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725922, "uuid": "063abd10-4f57-4a74-b4bc-e7fab9eb7f73", "comment": "Malware payload (Quakbot)", "value": "49a5211bb7c51f668aa30c23c297d96d73760b7fd6f806696b60f72e38633743", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725922, "uuid": "2e0f71eb-24be-463a-8e60-7d79770ac4b7", "comment": "Malware payload (Quakbot)", "value": "c29ac7889c10ee2dc9f83c1a2e0ed2b5ed9dbbe5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725922, "uuid": "475c7538-ff09-4700-a32e-982f84835a8e", "comment": "Malware payload (Quakbot)", "value": "078fbbe5bf558076055462ff8608193d54103a6e9fede806ff9dd8ee0a7ea95d31798143c694b332b6546d3b8c7c27bc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725922, "uuid": "f069b774-665c-4674-a426-de8ac721ddd9", "value": "T1EC7433896A45E0F14137B377DA578410FAAB1F1B21848936B97C515C2F3D82CBEB7E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725922, "uuid": "04632354-db6a-4aff-82f1-9ce3396d5c28", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbJdvNMUlOhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725922, "uuid": "172a3bfc-23b8-4de6-b824-c2c770567b43", "value": 347283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725922, "uuid": "42d7a899-75c4-4950-9104-5b9d26c06ff4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725922, "uuid": "5c9b031e-9ba5-4fb0-900e-dbe9d5f10699", "value": "hTKT9F5vsyw7Ho.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1fdb2d-0a72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686719730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719730, "uuid": "a648d1d0-5210-4df0-80a8-24cf63d18123", "comment": "Malware payload (RedLineStealer)", "value": "42479614224f2e08c61a8a4b7a78b451", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719730, "uuid": "82437418-7231-4868-9c9e-a86abe84259f", "comment": "Malware payload (RedLineStealer)", "value": "4b62c2296736f0d1d6e0f139d02d9671784b5858b7e428ad966c8162ea2be0d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719730, "uuid": "1bdfa07b-b8b5-4817-b34b-a4acffb39f8f", "comment": "Malware payload (RedLineStealer)", "value": "b18128f726ee4423415753df2319b4c07e5d82ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719730, "uuid": "19def006-6c94-423c-86cd-b54e615515c6", "comment": "Malware payload (RedLineStealer)", "value": "c0c1d36644f6d271e07a12099bcc78498269f4c3283c603135f9c4a96032b15a657d0e646d3cda7df48e33e8cf1d6e19", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719730, "uuid": "195af1a6-e19d-4ba2-8572-bb07a5dcdfc3", "value": "T1C9D41252B6E88973D8B2177018F703D70A35BCA19D79836F2355999D0DB36C4BA32723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719730, "uuid": "44521fe8-820c-492f-b5d6-f8942ca462d5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719730, "uuid": "d322ecc6-c310-41a7-afcd-6e6fe6948e44", "value": "12288:iMr0y90nwP2O9uWCNFVoNj396RlwjAlMB9E9mGyQs5:uyNING96T27E9fve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686719730, "uuid": "bb772f8c-2a1d-4007-952b-b6f2d6449879", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686719730, "uuid": "6523dfda-d42c-4a91-a543-1c3292b0b147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719730, "uuid": "529ec9bf-a109-4064-ae71-815fdc61c7eb", "value": "42479614224f2e08c61a8a4b7a78b451.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67640bae-0a9b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686737306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737306, "uuid": "da7e5f97-611f-41c9-8d75-7b61e4c4c648", "comment": "Malware payload (Amadey)", "value": "37d94513778bee0ed250413417d6b082", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737306, "uuid": "67a12302-06a9-4558-83ac-7faeb1159e1f", "comment": "Malware payload (Amadey)", "value": "4b80b9d5736600ce0c74e06fa3fc646fd11c7c92827d633ec5d0e97df1df484f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737306, "uuid": "2b84cda2-4fca-4e37-92c8-929a9cef5e39", "comment": "Malware payload (Amadey)", "value": "fcb950c13cf0103b5877d43139c0e621d0a549e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737306, "uuid": "7bd26997-1233-4a5c-b33a-8aa9c25bc9c1", "comment": "Malware payload (Amadey)", "value": "01cae6c93498199837ea37be98beca05eea1c68464593fc054f3614dd8566f1fc6b129dc9002398e3c6c4c44223591b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737306, "uuid": "689130b8-d603-47c1-8c51-00d632658545", "value": "T19CF41202EBD84573D970673058F213830A367AA5BD74175B3B9A998A1CB2EC0F93177E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737306, "uuid": "4afe26c1-e9ad-4929-a180-d903da3a11fe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737306, "uuid": "61d375e5-2658-40ed-896b-197241fc45b1", "value": "12288:eMrdy90c1ShPpy5euV+YcWfSmayOpW0UEX2GEbR8bbuW374ODG:zyBwJpy5/+YcmSzyUW0Uo2dqbbuWr4Oq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686737306, "uuid": "9497d2a1-d29e-4c26-8ad8-a8f68d3989c2", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686737306, "uuid": "20f8d928-ed95-46b8-bf30-2364e8bd7789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737306, "uuid": "54738d4a-a860-42d8-9e3a-e4d1c24b397c", "value": "37d94513778bee0ed250413417d6b082", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39af5dd-0a85-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728066, "uuid": "8ef1f97d-6e2a-4310-ad57-a16e47ba8f12", "comment": "Malware payload (Quakbot)", "value": "e39a83eb563abe62523ba32171a8b54c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728066, "uuid": "b3786a86-b36f-42ef-83d5-4b0aee94c9b4", "comment": "Malware payload (Quakbot)", "value": "4c063e82ed6cd3c69c982a2c04dfadb7d0bb03946fbe2c3736b441b49a503eaa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728066, "uuid": "97b626e8-e5ac-41d3-9189-08ffe8c2d0f9", "comment": "Malware payload (Quakbot)", "value": "0fcfe88197b90f7b0fbe6c1a8288630762e0574b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728066, "uuid": "eaed5282-501e-448c-8e1b-c1f72c9c3042", "comment": "Malware payload (Quakbot)", "value": "783263c5cd0cf68e04c41c340accc77eab2fa823b604d0ad7fee2c0c886c2da73ba25ec116a54b767844423e97c4de74", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728066, "uuid": "dcb628aa-216b-41b5-8dbf-a856c9cbe540", "value": "T17B743184AA54E0F18137B33BDA574010FB671E5B20888972B97C61591F3D86D7EFBE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728066, "uuid": "dd95a25b-af1d-41fd-8d0c-0e8616db0d78", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbdYlkORCK0cfKoqBhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728066, "uuid": "ce8a05b2-bb82-47ef-8a0c-a181a969b02c", "value": 351280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728066, "uuid": "2d61e038-b9a9-4afc-9f9f-c42c2d5c561d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728066, "uuid": "621aadd3-1c67-4792-9d8c-2fc799944b81", "value": "fST6vhY8b6kFIf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9533a71d-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728793, "uuid": "22396f51-4323-4791-a580-119ef2e2f808", "comment": "Malware payload (Quakbot)", "value": "80b76cb392f7c3765e93c66da7f24820", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728793, "uuid": "0f88fc51-96e0-460a-9cf5-03a7e67cfd89", "comment": "Malware payload (Quakbot)", "value": "4c5fddac3505a2630a208c8ea7b007e25b955aca1659036c2ef520670bf61b65", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728793, "uuid": "06bbd7c4-8f90-4465-afb8-df55d1c64337", "comment": "Malware payload (Quakbot)", "value": "69c49a9c428ddeb203ad966a44fa7e71ea0c7c10", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728793, "uuid": "13d08ac6-5cfd-481a-a194-c1548ed5f79f", "comment": "Malware payload (Quakbot)", "value": "5110cdff6f5d7d26fbfb6c0b4414f48d76bc9a37fd967d7c71ff8f37cd252180f463605fd4d2ba4b08c63922670f18be", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728793, "uuid": "3cb19e48-9260-4375-a7fb-3e9b2182871a", "value": "T1486454856A45E0F09137F33BDA178410FA6B1E5B11848932BD7C50586F3D86DBABBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728793, "uuid": "29dff5f7-c271-45ce-b210-90aff260f250", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbekv0b8F2TVLpoBU/Xzv+W0Y:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728793, "uuid": "b5ac86cd-3daa-4113-8e3d-2b894e4c1d07", "value": 317937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728793, "uuid": "e59ba00f-eaab-4c54-8486-43eaff40e2d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728793, "uuid": "ab203b83-3928-49a8-b315-b9ea8ecc9f88", "value": "P7lcXAox8qup6v.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71f3e9a9-0a52-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686705971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705971, "uuid": "3552e4a3-d78c-4a3b-8378-ab9c84c31a8f", "comment": "Malware payload (RedLineStealer)", "value": "99627a721411f4d6e697c478e1658874", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705971, "uuid": "2b8fa82e-2069-483b-a4f2-29d8b80c8ac3", "comment": "Malware payload (RedLineStealer)", "value": "4c7aca439ee1e17da2f067197025d768317dc4f0094397f8da48f33941fcaa2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705971, "uuid": "3b3fdf10-b251-4565-9df2-333b80107fb0", "comment": "Malware payload (RedLineStealer)", "value": "7ff887cae78a8951cd277ef0510eace593c56ba0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705971, "uuid": "708eb9a3-ecda-487e-805a-08120561d11c", "comment": "Malware payload (RedLineStealer)", "value": "118d7ea6cee89cf38c871377fe20681e010497a959123463984c96dc5531604dd133993b205e8e07da0a98ae55c15f64", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705971, "uuid": "c5cb2583-2f65-4b00-a9e1-ef3d2c3a79c1", "value": "T1A2051212A7EC4232DCB567B14CF307830E357DAA9939979F2B85981A2CB25C0647277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705971, "uuid": "c34e48b6-6ec2-4a13-8aee-64df5c0a3219", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705971, "uuid": "717c8c0e-f158-4554-b6f1-0bcb16d6d4ee", "value": "12288:MMrzy90dFrz8mFksDu+YEO8A9RCbfTnvxNx27ZrLstI2rW/ir1UC:PyGltZu9F88RCrTv347ZcG26/G+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686705971, "uuid": "14397c31-dd64-4866-8eca-7d4ebf5c242e", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686705971, "uuid": "83af5579-4e97-4b6f-b24c-2e7b97ce72e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705971, "uuid": "9eb6a4c1-c6a2-4273-9e1b-ecf839de6705", "value": "99627a721411f4d6e697c478e1658874", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebf4b1fc-0a57-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686708323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708323, "uuid": "8f9c48bf-8def-4717-bdc3-d8da50a8b0f4", "comment": "Malware payload (Amadey)", "value": "3b19ad2977bfcb3011e89713eb2ce9f3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708323, "uuid": "ab1912cc-c157-43b9-9572-8980ebd44766", "comment": "Malware payload (Amadey)", "value": "4cc01e8d7051494d6e9401f82cef1ff36fd573144edb8aa547d4692eb76a9632", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708323, "uuid": "61f2d47e-e0f4-41c9-8e6f-2ca23a5488fa", "comment": "Malware payload (Amadey)", "value": "7131386b9b4693d2496c9df7992632cca857c19b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708323, "uuid": "2903c6b3-1073-4b4e-a0b3-086c190a2cf7", "comment": "Malware payload (Amadey)", "value": "6f911e5e6e61c54551d0b710aa0f5e12e03120968f47eb0a4e58455e9439a784b9f070fd1efbed95d7c64f4dd30c4298", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708323, "uuid": "35151964-9df0-415c-9859-7fbe94f55214", "value": "T17A051202EBD84132DDB097B098FA03C31F32BCA5DCB596AB575559AE1C326942D3273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708323, "uuid": "b65b0299-4c2c-4a72-b78d-5fffa30e9790", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708323, "uuid": "f53aff5c-7b7e-4cf9-aa3a-18cca8bf3d4d", "value": "12288:4Mrqy90EQhIHlyjw8vMLl/OZGQvpkHZ8mKmOlpvoExmrM+dfyX2hK:Cyoh0ls9ylG7kHWmXCVoExEfyd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686708323, "uuid": "48739473-63a6-4d13-b575-ae8a05bfb383", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686708323, "uuid": "346ad802-51d1-4ebb-8d3e-a301582caa6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708323, "uuid": "ff7ddc1f-1ae3-4058-8dc4-66f95c852be3", "value": "3b19ad2977bfcb3011e89713eb2ce9f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7718b7-0af1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686774334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774334, "uuid": "03346bac-23d8-4567-b5fb-6dafd0dc98c8", "comment": "Malware payload", "value": "3b2c8f141644f519a401bb7b805fda09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774334, "uuid": "58dfeb13-30ce-4fdb-be3d-5aee654d924d", "comment": "Malware payload", "value": "4ccb4e8bd880d57278b6a75407e21d1f5bef74ec1eee6fd1e299ce5c29498780", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774334, "uuid": "a612ac85-8aa5-4ec6-af62-5f740a2023b8", "comment": "Malware payload", "value": "c9ba5923af1c12b13cb1dfd2eac8a24add78b059", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774334, "uuid": "29c3c186-2354-4ebb-85b9-314abd480bfa", "comment": "Malware payload", "value": "f9050ee3117f2f0e00463adfc6078f95eb71cdd60a395b018cc6801ef2ce98e19f942e07035180e48baa9631857abdd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774334, "uuid": "0224f51f-cd01-44f6-9f2b-f48f761cdb2b", "value": "T14F438D37E96E1E74C04641B074748EB56F23B5C883972EB61AAAC2795483E9CF504FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774334, "uuid": "d04051bb-9634-4bf9-87bb-715f90a227cc", "value": "1536:Vaa0brW/Od9hlCR3KaxKYXwKEpPDCMC2+Wt:Vv0brWGd9X5aYYypPDL+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686774334, "uuid": "75cf0c62-5e96-47cf-965b-e59beef0d046", "value": 58740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686774334, "uuid": "b42b2539-e8b6-42ba-8d2c-37f344cfde1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774334, "uuid": "91a5b23b-2ab2-4dc6-bbd3-014a53c521ba", "value": "3b2c8f141644f519a401bb7b805fda09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85f3c761-0aa5-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686741652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686741652, "uuid": "2b7f0ea9-bd72-4bc0-b1fc-3855b97e7ce1", "comment": "Malware payload (Amadey)", "value": "ecba72a3353e96dbda9595949448b0ea", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686741652, "uuid": "a1fbd974-50b8-4fa5-936c-555d7fe2f9ec", "comment": "Malware payload (Amadey)", "value": "4ccbd941e061e307c1a84eb977198547c7f20850cbdd7c1fcc369e6a2a09793d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686741652, "uuid": "9b7cf1da-3e0c-46b4-9a74-d56e894e6318", "comment": "Malware payload (Amadey)", "value": "c5816aa4c73b1d6f79ca6b986873f730f9aac795", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686741652, "uuid": "4f10e424-e04c-487a-9c9c-081641cadc3e", "comment": "Malware payload (Amadey)", "value": "12fb61de61f753c1b29964723402258acc3aa4e586bdc51150becc23456cebb35ca5faff18348e224c35acf5fcca9106", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686741652, "uuid": "e564b813-f50b-4d87-ac08-22b7d3f188e3", "value": "T11AD41216ABE854BAD8B4777068F717830F39BCB14D38826B2746A94E0CB12D1B931777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686741652, "uuid": "9c73505b-c213-4fee-8207-cd6428a32a3c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686741652, "uuid": "72bc872c-1112-470f-b858-b9d8085c5d5f", "value": "12288:uMr4y90xEemSHnsxttzGs+/eS02vhptS1OElp4:ayg0eshzGsJ25S9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686741652, "uuid": "701fa6ba-7cd7-487e-9ad6-dacf137c1563", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686741652, "uuid": "f14aa1f1-5257-4a12-b618-54a0891b0987", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686741652, "uuid": "4ed539dc-cffe-4f00-b5c1-14336a741897", "value": "ecba72a3353e96dbda9595949448b0ea.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a01f5c08-0af1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686774338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774338, "uuid": "72e005bc-1fb8-4457-b235-3c5a56d6c273", "comment": "Malware payload", "value": "9eedf5ddce3c064bc247ddc8403c7f63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774338, "uuid": "5c7e7722-497c-4182-93bd-acdae0886ff6", "comment": "Malware payload", "value": "4e267766dbdd465f416ca42fc286f166b48bead898c2b5f7ac91847481677f0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774338, "uuid": "52dc825f-aaa8-4453-ba52-f8604197a24f", "comment": "Malware payload", "value": "b59778fbef9ebb4d360c8eee498f776d97e0f337", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774338, "uuid": "174c4895-d996-4ca8-a70c-352b55a0e346", "comment": "Malware payload", "value": "011fcacfaa3e1327b589265c98b4dc1c2d9029fb83914abf748c7bdf6f4d60dc158d6ac8ef56d0761735594f3c21b8e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774338, "uuid": "67315aa8-57db-46f6-801b-d9a6a940fe29", "value": "T1DE534B02B31C0E07D0A31AB0253F5BD197BEEAD022F4F684656F979A9675E361181FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774338, "uuid": "64e4beea-ee29-478e-9b60-e70fee5a06ce", "value": "768:SEE5hjcoCkhVRGfRnbmX7/mG1nhG5UmtTy5EMwM/p9OyDQvSFRMNYL6FV+tg6wWd:+5HAdOmGyNtTAdvOyUaFRMNae+aTWOO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686774338, "uuid": "fdd4c4b9-b93f-4a08-a88b-d02ccd7aaa67", "value": 62996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686774338, "uuid": "2170efb7-8096-4e92-8a83-7d36d7425abb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774338, "uuid": "ede9007c-ef03-49f5-b4d9-ed23ba133a2f", "value": "9eedf5ddce3c064bc247ddc8403c7f63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "828e0ef8-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728332, "uuid": "b46a3461-3f78-4d41-9290-fc1649c4bc4f", "comment": "Malware payload", "value": "faf7e0af308c9237a5392f6233ccbc52", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728332, "uuid": "d5bc868d-2be0-4ad0-a99e-cb42348e8ad6", "comment": "Malware payload", "value": "4e34eb94bc4d4b80cf3a777941e563a8485e25b958e3222f3ce32908b1b6dd1b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728332, "uuid": "74938664-0401-494a-b3bf-a771d3b01da4", "comment": "Malware payload", "value": "9492b0f69a2566a3ba80fd6c91fd5d2d4f606b32", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728332, "uuid": "9cc6c8ba-c5d5-459a-9928-b20836ba1061", "comment": "Malware payload", "value": "96e606e1bde36816f235f36825d29dc053871386cae6d463e86313a620828a3332493bff2e70227b8c90dc8efe7a49a9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728332, "uuid": "82cf8cc7-1ef3-4ff2-b666-d82ecf7cbcbc", "value": "T14A743148A651E0F14277B37BDE178410FAAB0E1B10848972F97C60596F3D86D6EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728332, "uuid": "31971faa-dfbc-4ac6-9e5b-a9868368caac", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbA9KUhy6fi0WhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728332, "uuid": "0e292281-94df-458d-b3f9-4f4ea3c84cd6", "value": 365092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728332, "uuid": "861d9cb0-e8ea-4e09-adca-a8742bb6d11f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728332, "uuid": "032f9c2e-cf6f-4ee8-8499-b6ff30a50b05", "value": "Y6lN6gB3Am27YU.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3abfa172-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728212, "uuid": "e5aae412-49fc-4c95-aee3-d7ded1f17ac5", "comment": "Malware payload (Quakbot)", "value": "ce5761d5c1080422c9de7d465569be4c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728212, "uuid": "fffba80e-3b0e-40ca-b18e-ff05ba2a8c09", "comment": "Malware payload (Quakbot)", "value": "4e57148bfbd39f2bd7256784c1002c691b566dbdad8bbedbc16aff1597617529", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728212, "uuid": "9f820a26-1469-4b66-9fef-07275e99b278", "comment": "Malware payload (Quakbot)", "value": "6e7c48baed68fbfe8c47e36be6684afb1e814e78", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728212, "uuid": "9f9b4afe-2fcc-40ce-acdc-5386c33d60bb", "comment": "Malware payload (Quakbot)", "value": "e045974b8d9a2fd60ef3c358191c2542e4a39838e8cdde59dde5009fbebdaa427285ff05e36a1b725fb8eaa4c9a55a3e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728212, "uuid": "54a4c083-be9d-4325-be44-972ca2cb35f1", "value": "T1AE7420456A45E0F18237F337CA178460FAAB0E1B1084D972B97C61592F3D8697EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728212, "uuid": "b3a4aaca-1ff1-493a-88c3-a078fa819056", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbF+K64aFLhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728212, "uuid": "0c8a0272-0c67-4adc-9d63-e9e1db30eefd", "value": 350659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728212, "uuid": "f10c7b52-3406-4887-b484-8830be28db72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728212, "uuid": "74f469fa-612a-4e93-89f6-3aa48f2b1468", "value": "bQXzB3HZtq5ZcF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bc8003b-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686750655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750655, "uuid": "45ef1828-d1d5-4829-bd30-ec648e8a9078", "comment": "Malware payload (Amadey)", "value": "cb55f4d830f6d09a2bd4b7f272d8f426", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750655, "uuid": "e054e237-3be1-43a1-980b-e9969d593c07", "comment": "Malware payload (Amadey)", "value": "4e72662726e2e29dc75ff9852a25fde4bb574f06b3c147ec1be376cae17c883a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750655, "uuid": "7b45dcb0-f04b-4319-ba7a-7830c089fc21", "comment": "Malware payload (Amadey)", "value": "1f82bcff165326b26601c1c7fa837ce0d5eaa6d9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750655, "uuid": "0fbcf6c2-7b64-4280-b2ba-30ae5c15b4df", "comment": "Malware payload (Amadey)", "value": "63ab49193015003207af46adddada3adc1b38e83cf9786a62574eddea2192117763d229d6fcb25e28e1bbd7c054542f1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750655, "uuid": "e7e3d70d-256a-4fab-ae61-fdb2b8cf332c", "value": "T193D4120296D89932E8F5677058FA47930B337DE16C7C836B2781694C0C365E8B176BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750655, "uuid": "d021de44-18ec-4382-a4c7-656f49a983f7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750655, "uuid": "015a5ea5-b055-40ab-b869-ae1d20666501", "value": "12288:uMrSy90tK8dniH27Rqj3QaJN2Ckzriye2lknvSvvZ+AmUuC6kJ0ApltC:wykKiNqjAaJSrFknvO+AmUuC6kJ0iC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750655, "uuid": "358a8bba-e916-4fef-9110-0f81aa108832", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750655, "uuid": "d8b0bb93-1801-46b0-b314-aee879db335e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750655, "uuid": "dba08ea3-63a0-47b2-8e50-732672ea1c63", "value": "cb55f4d830f6d09a2bd4b7f272d8f426.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a2aed56-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728264, "uuid": "970b1a4f-0afe-4b7f-baef-2c09f92ff105", "comment": "Malware payload (Quakbot)", "value": "7a992386221d657c5cba2ec01681bc4a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728264, "uuid": "3df92419-dd0c-49ac-9944-354fa757312d", "comment": "Malware payload (Quakbot)", "value": "4e8982e4947c150330946006c0127fadaa61218145f6f113bfdaa965458924a9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728264, "uuid": "2ed1d1e2-872d-43e7-a7de-d3f073dfe0a3", "comment": "Malware payload (Quakbot)", "value": "e1cce37260e65902eb7468dc0a755a26e5526280", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728264, "uuid": "40e73b63-1588-43b9-b36a-66d0bc5116c4", "comment": "Malware payload (Quakbot)", "value": "ade1c10e648b532a7490a25587627430b0477e184bbe4957ccba3bf799b49df6f066053995aa46f40d0566ecd5ff6033", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728264, "uuid": "5078ce92-cc7d-437b-971c-1d31cbf21535", "value": "T1D17465856645E0F09237B37BDE178010FA6B1E5B20848932B97C515C6F3D829BEB7ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728264, "uuid": "6ee1a912-372e-4cc0-9325-2e8d25469ba9", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbi5X4T8sNLjXhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728264, "uuid": "b206d845-69b5-424c-a6c8-e304f9f738a4", "value": 352239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728264, "uuid": "4b9fe51a-b7ac-4ad1-a971-97032acc3867", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728264, "uuid": "05531470-a026-469a-8ce4-bc85d4da7b51", "value": "aYQa9wQyAZZ1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf995b26-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728435, "uuid": "c0bb1151-06c4-4a45-83f8-926d26fc2a7c", "comment": "Malware payload (Quakbot)", "value": "49bce083afa66a7e57598ec97466f106", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728435, "uuid": "709592bb-d0f9-4bd8-a30f-dd145e636d87", "comment": "Malware payload (Quakbot)", "value": "4ea2b569e5dc6389a3bb81ff4f84d75f4f818162238b1c9844a487674dd44157", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728435, "uuid": "e1337b3d-758c-431a-bc2c-39545f2580a5", "comment": "Malware payload (Quakbot)", "value": "a3f13a3f10848dc0c0102cdf649d0afb8d3665d5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728435, "uuid": "f41105c2-2d2f-424c-9576-b44b6700de1a", "comment": "Malware payload (Quakbot)", "value": "09e40592bb54090777b5035441a8324bd473fd27080f9ddabcf162567698502df0ff60c7330dc904f30a150c8d32220b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728435, "uuid": "48d6c237-d078-461c-9926-c6b4f8414cfc", "value": "T104643249AA40F0F19537F33BDA574010FA6B1F5B21848932BA7C505C2F7D8697AB7E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728435, "uuid": "085eeb34-a6a9-4f0b-81b2-9b032bb3f909", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbKkt898s7jYFhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728435, "uuid": "b401e473-ae42-4406-aca6-c843e24d4171", "value": 332789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728435, "uuid": "23a5c429-feab-491b-b395-2d9fa4e38486", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728435, "uuid": "88d29bba-2cf3-46b2-83c8-eb507b9509fe", "value": "ViRptsxg5xeV.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1be5cf-0af1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686774360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774360, "uuid": "ba97a656-6b49-4556-aa76-9bcd148cce6b", "comment": "Malware payload (Gafgyt)", "value": "38d1ca637046ea9c2b037a612ca27265", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774360, "uuid": "3206ace2-780e-49ea-be49-f10bc52bb26c", "comment": "Malware payload (Gafgyt)", "value": "4ea3e862a706bd17b47f6d7bf7d58297308ca69399822d4f80bf329e1307c3e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774360, "uuid": "8f956946-b710-4a29-8dff-4f33c55df929", "comment": "Malware payload (Gafgyt)", "value": "71364954c78e6d71c1f7837bd3a84a3eb759f032", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774360, "uuid": "cd329bf8-83e7-4bee-877d-84e194410a2b", "comment": "Malware payload (Gafgyt)", "value": "d9c52e7a87f249da04ccea01a8ca8b3df60d291231d60c6fb424daf333da69897ce17fa4ab1babffcefc3457bfa81254", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774360, "uuid": "8353a637-44c2-452f-9358-5fb7dc7aa987", "value": "T18BC3093B7B270A23C0D9507102E31332B9B9DE5938BA43D7A9D07D9C6F3A58834567E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774360, "uuid": "f1f17cf1-f9b3-42d8-88bc-9635b070c06d", "value": "1536:ctrv5GE2dFg8aI0DN95P8tf7PJtAxRdc0sfm7ypwYujl3IdnuW:ZP0DNPA45sfm2pwYux3I5uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686774360, "uuid": "d7e3a3e8-bacd-4552-a07f-a695d50faceb", "value": 126446, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686774360, "uuid": "67b07f2d-2260-47d6-bd43-76d56cfeac02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774360, "uuid": "ea4d5b26-6025-4f7b-b61a-ea5f27191183", "value": "38d1ca637046ea9c2b037a612ca27265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e7f754-0a53-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686706521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686706521, "uuid": "ea6c97ad-e27c-4499-a4f7-e3235587104c", "comment": "Malware payload (RedLineStealer)", "value": "2aba52c4ee65cc0ea49362b8c7d7508d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686706521, "uuid": "8cb57797-83cb-4591-9fb6-7c50f65b5374", "comment": "Malware payload (RedLineStealer)", "value": "4f5eee16fd804cefd82922d34b6c96de55a464d8462e647ca6c89115a1f43e63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686706521, "uuid": "c1d980e4-3fcd-4473-9b82-69ff7a22edd3", "comment": "Malware payload (RedLineStealer)", "value": "58012631f4308e31eaecd3bed523378c03781595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686706521, "uuid": "110cfda3-e855-4c43-af97-683fb2e154b6", "comment": "Malware payload (RedLineStealer)", "value": "0d5869ac26f924271ef01aab7d9077a2fb441c3698e32d15757d3259662d4df3662d1701eeaa348da65fc6dc2756e9da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686706521, "uuid": "7895d274-a0f5-426b-b5ae-ceec8c900c73", "value": "T1C2052213A6E5693BECB127301DF513A30B367DE0AD398367221AD89E18735D4683637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686706521, "uuid": "8e8a79e4-e430-4219-ab0b-1edc5fb6f744", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686706521, "uuid": "12fa58f0-a63c-495e-8acc-d2ed3f67cb71", "value": "12288:yMrqy90yTx4OUoWX4hmFSI1H3epawbwSZet6F+gXzGrlo:syBx4O4X6mFSI1Hk1Atqjelo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686706521, "uuid": "481cd191-4e12-408c-9cd2-e8fd8ba8db76", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686706521, "uuid": "51455d48-8e4c-4170-92f2-e2d41e023573", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686706521, "uuid": "168be858-215a-4c74-af3c-04b1c0bee50a", "value": "2aba52c4ee65cc0ea49362b8c7d7508d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f1917d-0af2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686774693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774693, "uuid": "929b30f6-f573-41c8-842f-b22731a89630", "comment": "Malware payload (Gafgyt)", "value": "995297be98c0211135485e6d96e6c672", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774693, "uuid": "e405e253-bd45-4db9-a717-f2cfca6ecaf8", "comment": "Malware payload (Gafgyt)", "value": "502850a0fa4a5351c8c762505a40e1b4298855d61d303d61ffadbd13d177b223", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774693, "uuid": "744c06b7-a3bc-4ea9-892b-baefa7746f06", "comment": "Malware payload (Gafgyt)", "value": "d4309a25193437f47864ff110a50ffa4581611e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774693, "uuid": "8bf17b9d-7623-418f-8194-1ea598c08688", "comment": "Malware payload (Gafgyt)", "value": "d147ef052171adbf7084cf33e8b1196e5907f5b0af20bff50e5b24ecd3bf6afd3ba907c4768cd1c57177e805f84a8dd8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774693, "uuid": "b74c38fb-2b1b-419d-862f-44fde0ca32f3", "value": "T103B30692F900DFF2F40AE67604C34B2566B0BF660F536A66B21739A79E721C43867F41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774693, "uuid": "2d7350c3-5285-450a-b038-d4b2c08798f5", "value": "3072:gLWUEK1FSHGfs1QbEE6QyPwWs/avcWVRm2pgYMx3IPtW:gDsGfs1QHyPlsSc2Rm2pgYMx3IPtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686774693, "uuid": "908ddd1b-8668-4f16-b676-9efb054ce410", "value": 113759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686774693, "uuid": "a448afba-d8f5-4e93-931e-26536694e0d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774693, "uuid": "3843e2ae-25af-4c0a-8b4e-4685fc893f81", "value": "995297be98c0211135485e6d96e6c672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63482cd2-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728709, "uuid": "15febe6a-1545-48e6-904d-faf2c8006b28", "comment": "Malware payload", "value": "91099ee3556eed0f65d15bd35cb69d52", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728709, "uuid": "5efa91a5-7bcf-4a97-925f-e0df24db7bbf", "comment": "Malware payload", "value": "503b1bc4852b5b89f819cc4454fd86bd282f0365d37863d9885caca8a222fefc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728709, "uuid": "7d012d9e-4529-40b1-95b1-1ab585006df8", "comment": "Malware payload", "value": "40149e2e6d27a618f9a2332fbbc86efd667d9122", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728709, "uuid": "8b03a04b-1150-4066-b75d-c9d8513745b8", "comment": "Malware payload", "value": "1b9b2a7ae692a8a810f35c7e02b5f073c6078c5fa0aec3ccf586252178121c3bde4573cd27c4a72213e6c9ffa3803fb8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728709, "uuid": "6f1ba38d-81dd-4ee9-9dc5-f3b9444c1b8b", "value": "T1C76421896A45E0F19137F33BCA578410FB771F1B11848932B97C60582F3D85DAABBE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728709, "uuid": "78bd63d8-3dd7-49f1-929a-bb5046ff7dd0", "value": "6144:DSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbt59o5jhS:DSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728709, "uuid": "38ac6e6d-163b-4c25-8ca6-81f6afccef96", "value": 307388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728709, "uuid": "81c8df0c-69f4-47c9-98b6-e1a24da4fedd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728709, "uuid": "d4e5943e-0fa0-4f62-9479-46f7b5d6c350", "value": "R8ephkEUcWjal.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3150276d-0abb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686750959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750959, "uuid": "229bb2e1-9b1b-4e54-8f61-bf4048184d98", "comment": "Malware payload (Amadey)", "value": "54661eb5e884e62532c223d24a6d1dc5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750959, "uuid": "a5b96474-7a89-4a8f-b2c2-a01edd404136", "comment": "Malware payload (Amadey)", "value": "50a1aaacf8651a32daad6fb9647380391c50d468ad6e91eb7b641926af6c4a75", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750959, "uuid": "b757e46f-f2fa-4f2c-8afe-afe7c840c070", "comment": "Malware payload (Amadey)", "value": "119b8ce051fb2f1cde699590f9415e714cf66a62", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750959, "uuid": "fd1b7e89-c14a-4f4e-a7df-8e2fe1eac48e", "comment": "Malware payload (Amadey)", "value": "8c9bd5ae79614496d5b2aefea1a542e86f70cd3dfe3348e8ab1644c81534b714468884a4578ac434f02c559f581d7c07", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750959, "uuid": "94755603-fd52-4319-8b45-7d26b04e7ecc", "value": "T1BFD41202BBE808B2EDB917706CFB13871B353DD15D79823B6387A96A1DB26915432337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750959, "uuid": "8f659420-e9d4-4d9f-8785-341970354daa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750959, "uuid": "60f9cfe3-d301-455e-b3fd-a1f8646d2a78", "value": "12288:PMr2y90uCuu0SpEibv/pulAoXqJ9jgV4q7Iu8vhPeM6:xyw0aVux2ecZI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750959, "uuid": "da7f5aa2-c13b-4acc-b31a-105af4d716fb", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750959, "uuid": "128de59a-c5b8-4af9-a715-ac0db3a25964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750959, "uuid": "fbe80ee7-ca31-4092-ad96-a479f0ec53f8", "value": "54661eb5e884e62532c223d24a6d1dc5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74680dd7-0a95-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686734751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734751, "uuid": "84f8efba-7e0f-4b10-821b-e9f6cae9ce7d", "comment": "Malware payload (RedLineStealer)", "value": "3c439171b85b4c9221a883f4d67e5ed3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734751, "uuid": "e0987b56-0980-47f8-a015-ed986baa182e", "comment": "Malware payload (RedLineStealer)", "value": "512fcdb6641b7dbc3aae92e130f78178474ba441fdc2c317f0eb5e5e491a1548", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734751, "uuid": "bdc8dd58-1416-4605-b95c-d00af207e68a", "comment": "Malware payload (RedLineStealer)", "value": "0fc6b79adb6c938ed7be2cdc080f6a41fa67a169", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734751, "uuid": "e664ad1f-44bd-4664-8717-570986c22526", "comment": "Malware payload (RedLineStealer)", "value": "636e4fa303dbe089b4a00e16ddf0da75e1c753e4753b3a6b393fec80731f3ecb5de909b16fbde83a9e7b41e586c7f005", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734751, "uuid": "a9dee0df-a110-46ea-840a-1aa06b1307f3", "value": "T12BF42202A2E84673EDB6077118F607D31F7AFDB09D75435A274698480CB36C96872BAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734751, "uuid": "b2008060-7751-463f-ab59-38a1768b3df9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734751, "uuid": "13802be8-193e-481e-b2a6-5ed8544e07d6", "value": "12288:cMrty90cCFva56HP3liOy76GOquwBoH6FLchKGjkhfFqUFRmWX7te:py5S4Oy7rNB06p8KI0fJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686734751, "uuid": "5d3d5606-8410-488d-a593-d273ef876d42", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686734751, "uuid": "f0eec6e0-bb09-4a6d-ae39-469a577ea742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734751, "uuid": "f99e298e-562a-47dc-91af-e149c1587d24", "value": "3c439171b85b4c9221a883f4d67e5ed3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b078cdb1-0a6f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686718531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718531, "uuid": "2b144430-b96a-4436-8131-2bfe2d2775f8", "comment": "Malware payload (Amadey)", "value": "3be106aaea624a6423d549f9227e1535", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718531, "uuid": "b2c7a967-37da-477b-ad35-2d19b1693368", "comment": "Malware payload (Amadey)", "value": "51a075dc2da10d7ff1553fe1e504133f4e2cb4e984f6e5127d9e81616f2a0623", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718531, "uuid": "12d8bda1-9df6-4c7a-bcba-f032c4a0826e", "comment": "Malware payload (Amadey)", "value": "aa0a3564eb9a6f9c6c3385dc92e8113276159919", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718531, "uuid": "53b3db9e-9fb8-4de9-8025-c17b1cca4a46", "comment": "Malware payload (Amadey)", "value": "c662277c26f42b0445becbec686c3285a736d3b071b952a0bb7fb17b1b3cd9c67924928c9466bb57c787f273f99971ec", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718531, "uuid": "9f29b796-0eea-4966-a933-d1c92a46caad", "value": "T14A051207B7F89137DDB4277459F903030B347DA5BDB4AB2B278A685E0C7298496343AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718531, "uuid": "b3035e47-6909-4a45-a77a-43088035fb2c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718531, "uuid": "996973cb-9997-46ea-aca1-c11798d885ff", "value": "12288:MMrRy90OskHTBvxFtYZm8vKFn902C5K1RE3E0/wZuxn5ig:Vytz7YZlvKFn98uNCnxn5ig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686718531, "uuid": "b0a2b27c-219c-4d86-abad-9e47c32e0a08", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686718531, "uuid": "67a5d26f-7057-4b18-846f-cf8b7d28f6db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718531, "uuid": "c6f5105d-4bc5-4c72-a532-7bf95b73448b", "value": "3be106aaea624a6423d549f9227e1535.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228b6a3f-0a73-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686720011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720011, "uuid": "10dcec32-83bf-43e1-aefb-b8da90408967", "comment": "Malware payload (AgentTesla)", "value": "246d85da891e5dcf768267283744727f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720011, "uuid": "e61de101-89e5-4699-821b-e52d46946157", "comment": "Malware payload (AgentTesla)", "value": "51a584528b7e6df7d03d10134ee1b11fa8131a9c250141737da3fd8b598fab65", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720011, "uuid": "ba32f928-faea-4a3b-9632-beec12b14d26", "comment": "Malware payload (AgentTesla)", "value": "c3d61bbde3aa0129d7f481b1d4dfb85a228e1c1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720011, "uuid": "5f9e5e14-654b-45b9-8884-d1c98d262581", "comment": "Malware payload (AgentTesla)", "value": "e8786822395892b0412083bf84413f3b3ab026934415fa5685b56bd067d1b96f902531f2d19e5344fbd14f5d2a95f763", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720011, "uuid": "decf4f0e-ca40-4ad2-95be-996ccf7348b3", "value": "T1941593BD2A8076AB9B75DE6241D2084BF23F772772535DA821D213C2872250F37ED94E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720011, "uuid": "a6dd98cf-8b14-40ca-8f59-4bd4805cc3e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720011, "uuid": "92d7d678-e306-4292-ad10-da6f293040ea", "value": "12288:Idr3lsb/+FSzQAeHTNX6hQnXi3JgKK+Cl:I8WyQAeHTNQQSiKgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686720011, "uuid": "9afd88af-f58a-40b3-a002-d5860f3c1a40", "value": 916992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686720011, "uuid": "e681c4fd-00a6-4d17-8fd1-b7b1cb5cb070", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720011, "uuid": "21e0d181-12a2-4059-af0d-a0b336ae7f35", "value": "246d85da891e5dcf768267283744727f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d10ae1-0a81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686726086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726086, "uuid": "3de8d552-fc73-4769-9868-f6ec9a7d3e6e", "comment": "Malware payload (Quakbot)", "value": "57d88df4b77c38a13958e4530c8b0829", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726086, "uuid": "269942a8-038b-4ebc-8f2a-133054dc1da1", "comment": "Malware payload (Quakbot)", "value": "51d66452c150941cf614cd6c61b773f05874cc69eb56b24a8ec11a9d863c9c2b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726086, "uuid": "2a95f8f3-647b-47c6-bd08-033d84cf207f", "comment": "Malware payload (Quakbot)", "value": "995a4338646ee456d629ca6229b0edc651723ffd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726086, "uuid": "a4b87f47-67f9-4663-9cb5-dbf0116c9ab0", "comment": "Malware payload (Quakbot)", "value": "a924a69b7c6dadbdbbb960bf6378d974695194a236143461bea3e842381e1965d29be9c3bebac2634d59852341c9f52a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726086, "uuid": "72aeca39-bdd6-4314-96d4-8b42a9bb08c0", "value": "T1677422496A51E0F08137B33BCA174420FAAB1F5B20C48972B97C515D6F3D8697EB7E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726086, "uuid": "8a1e44c6-2dce-4d4e-8333-527c8e355610", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbkZZeWdjt5rnIezhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686726086, "uuid": "d333ccb8-1cec-45c8-ab9b-4762953beb3a", "value": 343073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686726086, "uuid": "d6007e68-2f11-4d8f-b0d8-996a802057db", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726086, "uuid": "c474c361-9ca9-49a4-b6c3-9b3dd55708bf", "value": "fsFOUbz8EWS4u.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c807f345-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686725872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725872, "uuid": "1973362d-82f8-4bf2-b76f-906a2b063304", "comment": "Malware payload", "value": "922a10ab57f8cdc5ab2e27f6db73a9b5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725872, "uuid": "fd0ebc45-eb9e-4522-8be1-fb44117f0a10", "comment": "Malware payload", "value": "523f42198c5795cb4d2edf21a6100c80ebb78fca2362434da765c28a5fc0cd82", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725872, "uuid": "1f458a63-53c6-4a14-aa2b-0b0856b2ce8c", "comment": "Malware payload", "value": "04d80ff9d0efa5af284b00517319a05c3ed57513", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725872, "uuid": "8f3f2000-6c32-4c3d-a361-5546b108335c", "comment": "Malware payload", "value": "6935e0275cc5cc38beef96aa45af5b6ddc5375040da011f08a4c36a3af270483ded08b00c38c84cdc0b92af734bff7e5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725872, "uuid": "a195799c-af2b-4874-8b6b-787c2048f7a3", "value": "T15F6442495A55E0F08237F37BDA178410FAAB0F5B2084D972B93C515D2F3D8686AB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725872, "uuid": "d094f6f0-5592-43b9-b7bf-7f4016149bfe", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb4+F+uJrClIdAlFhLsJghS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725872, "uuid": "2fcb0bf5-f8fd-404b-9398-177ae886c6a2", "value": 336438, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725872, "uuid": "c15023ec-18e2-488c-a324-6b7ac238d694", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725872, "uuid": "9e540e2a-5d3c-4490-a693-a8f31a8c2169", "value": "iOLTrAvIB7xN.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0eb9059e-0a96-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686735010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735010, "uuid": "c9ef6547-2a5b-4684-8246-7d93cc33941f", "comment": "Malware payload", "value": "4dee7ce39400f23813015413668012fe", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735010, "uuid": "35f06a94-72f0-4d97-9cf9-6f9b84163c57", "comment": "Malware payload", "value": "5277405cc3e0e80710f7b33ae9ae0c92ca67112502d6c6bfb7f90080cc92a302", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735010, "uuid": "9fe94e3e-96c7-4133-ad7c-f1a7ba0697a7", "comment": "Malware payload", "value": "5a2d496fafc4c18a670fc7419b98ab7096bbbd10", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735010, "uuid": "30cd9728-cce4-4ce0-a2db-0530e6b2b400", "comment": "Malware payload", "value": "c40d8b331dc60910e597f839d05763bb3d9c7892927ceab7116bc3b98f1f02ce60e7ee61f9671274532d4e7eccdc882f", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735010, "uuid": "49260536-e478-45fe-9959-8c79ac7a8a4e", "value": "T173B633EC0BA0779D45188F2F2ED3A952F2D3987B10C9461B5C4E9327EE9B86CDDA4443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735010, "uuid": "73cffff6-2ccb-4f6e-9d23-bcbb347ef49d", "value": "196608:jckTATdbDH6lGd/E+ykGv4qETBK+57BH2bd8zhPsKJuc1KTZfo+L0:dTAT5Dal/xV4qETYEPsac5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735010, "uuid": "4d12c6cb-c8a6-4945-b4d9-a4185c6a74eb", "value": 11309319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735010, "uuid": "4204200b-fb9a-4888-a617-cf03964c9109", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735010, "uuid": "1f03b7dd-7e2f-4f54-8825-8dfb46373fe8", "value": "4dee7ce39400f23813015413668012fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8955b089-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728773, "uuid": "9127de57-4706-4fde-8db3-ea5e57c6dc77", "comment": "Malware payload (Quakbot)", "value": "9c09632667688045383b1d5c74a127eb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728773, "uuid": "57444b38-4ae5-4980-8d2b-4d7798c13b93", "comment": "Malware payload (Quakbot)", "value": "52d7a3eb1a87e1844d40bddb7c30f0a99000d0e5aa997c8e2b458821bc79f123", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728773, "uuid": "9068d7af-49de-4365-8a19-00ce7eea26fd", "comment": "Malware payload (Quakbot)", "value": "0e7a6adc56ddd619f70c66aaac793d15fa39cbb4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728773, "uuid": "1b43eb58-9264-4d53-8b08-d83b9cf926b5", "comment": "Malware payload (Quakbot)", "value": "fe50008b3fa902a2ec750b4badd6830a48bca0465bbe65696134c0cbf88db723e4e3892926bc20af24a9c1614bddedd3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728773, "uuid": "57639ba3-a64e-4f2e-b89e-4f1a5c4ca543", "value": "T1A17444496A55E0F18237F33BCA178420F96B0E5B20849972B97C505D6F3D8297EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728773, "uuid": "444feb59-7d53-422b-a77e-8e6234cc7b88", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbJ+YjN1J2mPcBqtff/hE3FhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728773, "uuid": "8cad1ae7-df51-4fa6-b2ab-92bfafa52310", "value": 339867, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728773, "uuid": "a924bf7f-704a-49f4-9fa1-dc29ca31ce5a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728773, "uuid": "5daa0799-b47f-481b-b36c-495dd4dba3d8", "value": "Q3GWnvxJLjkGX.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "248fd6ab-0a59-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686708847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708847, "uuid": "87c992ef-4df3-4d5a-904c-9bcc336c7c8b", "comment": "Malware payload (Amadey)", "value": "09f56f3fba2649527dd397b44d3fc68f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708847, "uuid": "178d30af-adad-4f90-9626-b60e8ec1c58c", "comment": "Malware payload (Amadey)", "value": "531697738693f86a82f61cd051b0d6281e6fe6d789791525c35c3ada991a7f31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708847, "uuid": "3894bb53-c190-4037-9486-6befda4a7e6b", "comment": "Malware payload (Amadey)", "value": "e97971111a6f118836a18528cf385ff5021731d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708847, "uuid": "4b8bfd51-be4e-46e9-8363-5b910b725297", "comment": "Malware payload (Amadey)", "value": "0a6b89c5d8172056f15db77fbd2fe9521e0e01e3ddd12fdf1cf0af17d16e9a3ec89a71c2ad224d23932a1d92641f10cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708847, "uuid": "a2309075-1953-4285-b9ce-f6bb9a572b7e", "value": "T10205125397EA4031DEB127B069FA07831A37BCB74A74469B3781686A0CB27C47972737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708847, "uuid": "edeadccf-6a9c-4de6-a978-1aac6f4ad973", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708847, "uuid": "85122b4f-65bc-4824-b6c5-cc370105f101", "value": "24576:AyR5wLvSYE3VkrprjabqBsuDJ5cqxQFyBGh8I:HRVYeoNabqKuDJZxiy9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686708847, "uuid": "7f55fd57-a65c-420a-896a-8367f451365d", "value": 795648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686708847, "uuid": "288501e4-c97a-4bb8-8030-b9a74f0f9472", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708847, "uuid": "1590b10d-1a81-44cd-b93a-2a658e1d8d0f", "value": "09f56f3fba2649527dd397b44d3fc68f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14e472a6-0acc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686758213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686758213, "uuid": "57e751ac-1137-4731-8031-1314942b498f", "comment": "Malware payload", "value": "56c93e2f25c7513234e40f6d6a1d3b44", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686758213, "uuid": "08e50d2e-9d43-47ef-adf8-efdc53599e0f", "comment": "Malware payload", "value": "537591540e2f92f3f5a9f4685229c2c8da3f5272df26ac37cc21847f565e4f50", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686758213, "uuid": "672ec4c3-48c5-4ae0-b2e6-4ce394c90565", "comment": "Malware payload", "value": "711095e3d40f43fe3d67a099cab53ff02a4bf3ef", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686758213, "uuid": "8d0d3fb0-7a92-402e-aac7-bf856d8b53a7", "comment": "Malware payload", "value": "cec00c4fbee3a815d91c9158fb96ae1e45a8010c0733ee1feba35b9c577320ada535d67c3103c1ca850740e83e003db3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686758213, "uuid": "91e11ba0-e0e2-40aa-937a-b6d289992739", "value": "T1236473996945F0B09133F33BDA1B8800FA7B1F1B1194C967B97C5428BF3D419A7B6E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686758213, "uuid": "4420e54b-a70c-48b6-b874-b9ed3557e5a7", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbFyt1sU1MwQv2Dck1hhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686758213, "uuid": "96a8e873-0313-48a5-be75-a66cf450a463", "value": 307655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686758213, "uuid": "461472c8-87f7-40ac-8d4b-32eb9db6647d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686758213, "uuid": "55f73a87-ec03-4de7-abbe-4c5762d03cfe", "value": "2dtjpyPlbhG5r.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb8b091-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728458, "uuid": "1e01b203-6be2-4e21-bfe2-ecd34e93c6c2", "comment": "Malware payload (Quakbot)", "value": "54678f2e1d83ec37552445bcd4492601", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728458, "uuid": "ec33f353-da82-4c8f-b68d-5ce6506659b1", "comment": "Malware payload (Quakbot)", "value": "53c1fa6e950d5688bb7ecd26f397579a37fcfb28d12869a0b7f7c4899a9d6cc8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728458, "uuid": "026a755b-298f-4550-a2eb-6433ed96f791", "comment": "Malware payload (Quakbot)", "value": "28ca1c89d4bf02431781c60475f4c4326dc92d66", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728458, "uuid": "864fc5be-6aae-4152-a94e-7e3c859c520d", "comment": "Malware payload (Quakbot)", "value": "74ecddf58db2aa287cb3bd9f04f5bf1a4667cb8226837853461090fcfacc246eb38d5b066a41cb7b816667109f7496b4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728458, "uuid": "04b96abd-ecb9-484b-b081-ff3fb71bea9d", "value": "T1F8744185AA54E0F05133F37BCA568010FAA71E5B20848976BA3C50596F3D85D7EFBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728458, "uuid": "d2a31791-b846-4479-be98-d69c70720524", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbdRQh4aorhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728458, "uuid": "a1cd7f61-60aa-4a13-af9d-521ce871de22", "value": 340353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728458, "uuid": "44200ea0-feb9-4dad-9951-b8086ff279ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728458, "uuid": "a4bcd11c-8806-4c19-98a2-d71933334605", "value": "VQcIIfuRUCWi.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7cc9c8d-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728395, "uuid": "d27612d1-0ee2-4e35-93eb-41a6821bf81a", "comment": "Malware payload", "value": "fc010a57a312146977dcfa5b9ba932b7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728395, "uuid": "c184beaa-2c33-4ce7-8ff5-075542965668", "comment": "Malware payload", "value": "54373fa75a0dda2c7fcd65b3fd408617b4476fff9c36c456e3eb3b07961404fb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728395, "uuid": "6919a1b6-0a1e-439e-85a8-35ed7a231fdc", "comment": "Malware payload", "value": "8c26808e4b93310218b825760eea77003ade4ba6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728395, "uuid": "6120ca1a-c7f9-4dc1-a706-581d69d17e7c", "comment": "Malware payload", "value": "f93ec8163aa43ba8fdc58532fb22e77b93b8ec3adbfd4273a86eed65f52e4845e23354c2122c0e2507e9ddee836f06a8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728395, "uuid": "9083f589-4a21-4819-9401-72f159ca1d80", "value": "T1B86434896A45E0F09137B337CA578410FB6B1F5B21848932B97C50582F3D85DBEBBE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728395, "uuid": "2da6a907-d42f-43a1-b2ac-37c97fb8f4c3", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb747dr4QS0gusHUthS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728395, "uuid": "a7bcf011-8489-4565-baca-5c43e72032a5", "value": 323775, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728395, "uuid": "972d6a4d-13b4-4361-b0b9-45d242fdd87b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728395, "uuid": "743c9139-53dc-4142-9386-eee8a7db14bd", "value": "XMxEMIYY49oF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17550e90-0af9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686777544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777544, "uuid": "f50fbc07-022b-4e7d-a29d-5779f6b12e41", "comment": "Malware payload", "value": "01b736742f30d371ebddb802fec2f5de", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777544, "uuid": "fa4eeca4-ba42-451f-b6ec-2dcf535ab543", "comment": "Malware payload", "value": "548cd7612b9273303ff47dc001c39ac0f33dc3f15388648d8e10845e6005de89", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777544, "uuid": "390867dd-3921-4f89-9223-1b30792efd03", "comment": "Malware payload", "value": "b2d0349fba377f1caaab59fee787fb0e8df77284", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777544, "uuid": "17d84b18-3f0e-4204-bfd3-a1a245c4edfa", "comment": "Malware payload", "value": "87ad6350c8218d3bd3328cabd09e1f66717ed34abea6d5fe96fa16126fda6fd1ab04af0b75bb79cc363c3835fb2899a7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777544, "uuid": "72f08d4d-9127-43a1-8ddc-8adb2e4978a7", "value": "T16AB633EC1BA0779D89184F2B2EC39552F6D3487B10CA8A1B5C5A9317FDDB87C8DA5083", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777544, "uuid": "28b41d0a-7b7f-4f0c-a949-5ef91ae592ba", "value": "196608:jckTATdbDH6lGd/E+ykGv4qETBK+57BH2bd8zhPsKJuc1KTZfoQSoh:dTAT5Dal/xV4qETYEPsac5aoh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686777544, "uuid": "8cadedd0-109d-42c3-8769-f2b174d610c1", "value": 11316489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686777544, "uuid": "eb17dd70-5375-414d-9bf6-7f8424d10eb3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777544, "uuid": "55acb7a0-8605-4c1c-b86e-eaf41e350940", "value": "01b736742f30d371ebddb802fec2f5de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ad0a643-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728561, "uuid": "2a8d3a8f-a709-4b07-9914-dacefe6e99f5", "comment": "Malware payload (Quakbot)", "value": "323cc7aa199701e966ad1ef166f59d27", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728561, "uuid": "3ce47a82-1004-4594-bb9a-002a919bc0bd", "comment": "Malware payload (Quakbot)", "value": "54ad7bc778ce3705b7ac15f9b97d5772ba4c4cc997ca79f3b8f510f7ffd01e3c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728561, "uuid": "a76c2b6c-88fe-4024-aad7-9b2e387d782f", "comment": "Malware payload (Quakbot)", "value": "5364896014b333bb9fe33fa86c63c91f907f6248", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728561, "uuid": "753f2088-fa02-41f0-8f69-ba9db7679b85", "comment": "Malware payload (Quakbot)", "value": "85ecfda987832a22fddb6375fa212bd32554fcee2aecf6c3e42479ab18d46d14d4c325f8c542fa967c0c41806155e902", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728561, "uuid": "2753960c-ecee-47f9-973f-226ef37f917c", "value": "T1FC7410849A41E0F15237B337CA179010FBA71E5B21848936B97C61586F3D86D7EBBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728561, "uuid": "02c52739-8099-4e97-acca-e4a373d341ff", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb9n8gh6swAXWCZ7scXkD+MhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728561, "uuid": "82f5d56f-125d-45ab-9f08-d89703f60b2d", "value": 362137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728561, "uuid": "ca64b064-7b68-4783-8392-222968152b39", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728561, "uuid": "4e938598-e6c5-43af-95d9-4f0b6ea0a9d2", "value": "Tz5uPxrleG1li.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b8fc806-0af7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686776666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686776666, "uuid": "801b680f-ca85-4fcb-9071-eb0d5477c100", "comment": "Malware payload", "value": "10aa536061b7213f28e6e47f44f102b1", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686776666, "uuid": "bf9d2489-2ce7-4473-83ff-e0c16eeebbb9", "comment": "Malware payload", "value": "5531810089c077fd4d5e1c42b228675ac63c28e8bd4cd4d9a64d0c5844130ebf", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686776666, "uuid": "9267346b-1a2d-4ee3-a2b0-b9f9af802bb3", "comment": "Malware payload", "value": "916f767de7411f99f8b3bb9e7ab68da7eecfedb3", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686776666, "uuid": "3735545d-b4d4-4f10-86d0-7271eb74b3ca", "comment": "Malware payload", "value": "65bec055d0ef51579161ee8af4ea037772615e999ac8f3a60af82303df77d88a6582896581e0e3e03bd2775637fa307b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686776666, "uuid": "a4dd25ee-ba66-4151-8139-6f9c7e7fc418", "value": "T1AF236C4037E88136F2BD47B5ADF2E60182B9D6676903CA5D6CC814EA1F13BC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686776666, "uuid": "7bdfd10c-7120-417b-90f5-38369a05216c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686776666, "uuid": "2d286429-6763-4c21-bb65-eaa749d086ea", "value": "768:dOEuILWCKi+DiBtelDSN+iV08Ybygez7vEgK/J9lZVc6KN:dOtmBtKDs4zb1WnkJ3ZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686776666, "uuid": "fc27172c-28cb-477a-8d4e-be0ce615da27", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686776666, "uuid": "d8ae3b5c-8e95-4baf-b70f-243dbecbfa7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686776666, "uuid": "25248baa-dd30-48a5-b288-6424c2627789", "value": "xAUFPwuWUd63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcf4d791-0a81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686726336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726336, "uuid": "24c88bf7-79d5-432b-951e-8bcdd7103199", "comment": "Malware payload (RedLineStealer)", "value": "70bf95ab8e025a9776bca48f47eecd16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726336, "uuid": "bbe70798-5c29-49b1-8f6c-b1e5f89ff73c", "comment": "Malware payload (RedLineStealer)", "value": "558df7f274fd168e6db46ae7f686b6a0a1e6b6220627db79051a1948ec1d84a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726336, "uuid": "d824398b-f338-499e-8502-c2f992770e9e", "comment": "Malware payload (RedLineStealer)", "value": "a6f7192b053c50dda3d6d874f61e1e51105a70c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726336, "uuid": "940edfdc-8dea-4fa7-93b3-3f527ec00df4", "comment": "Malware payload (RedLineStealer)", "value": "6cfb1b885f3f44fffa66fd3a96a618ff3e54f0560c7eb59757bed6e8f329f33ed509fc231455231666ec863fc90d30e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726336, "uuid": "48084a86-4fec-49d8-9581-912737bf6a14", "value": "T1F105120269E8E936C9F127B055F702C31B76BDF19934872B2351AC2E0D331A9E53276B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726336, "uuid": "c242847f-d7ef-48da-b99e-ce007b31458d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726336, "uuid": "c378475d-6e3c-483a-abda-5ddba2a5c58d", "value": "24576:iytoO5DyPJ283d7QvYh0XakTn5kWbyXcM3/eK37:JtoOH07QvwdcJbo5eK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686726336, "uuid": "5c18684d-909e-4614-a4f2-fcac72e24104", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686726336, "uuid": "327490d6-aa02-4722-847e-4af5b9c05346", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726336, "uuid": "eb854713-02e3-4969-8600-6148a316a399", "value": "70bf95ab8e025a9776bca48f47eecd16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a540cbc2-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728820, "uuid": "8f1dfe3c-e88e-4cf3-80de-0916f360a9ff", "comment": "Malware payload (Quakbot)", "value": "832f8e447faf9b7efa93567a5490f347", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728820, "uuid": "f28b4c2f-8c98-4e92-bd98-b14fb764b273", "comment": "Malware payload (Quakbot)", "value": "560a5ab4cce6e9d0734472d58f8bf3852a5298769bfed40509ac71dab225d411", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728820, "uuid": "45c1b1cf-bd41-4162-b75c-5a7015796268", "comment": "Malware payload (Quakbot)", "value": "2ed83d49cf30901d473a3ab2104715c82d9da4e6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728820, "uuid": "f8f05dc7-dceb-4ca4-a478-e2cfaee1694c", "comment": "Malware payload (Quakbot)", "value": "2dae8e4be16165d3a46633b7649313c4637c7b1cc03fc678b142bcd4bda64ed91e5f9f9f49a02c7497beb2ca6494caaf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728820, "uuid": "b9527a4d-bd96-4537-bef0-b5766dbb5b64", "value": "T1E1745289AA45E0F14037F337DA178460FA671F5B10849976BA3C516C2F3D8297EB7E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728820, "uuid": "f1298a43-ca37-4ae9-b7d6-37ac33b34e0c", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbMragjpUrqthS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728820, "uuid": "0303a58a-aae0-4c78-b711-39cf08677084", "value": 345398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728820, "uuid": "a0e152be-a14d-41b0-bd83-81656a574d61", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728820, "uuid": "02984d34-5f81-4f20-bfba-17f2a1529c4d", "value": "NxBtyBpf8adSsM.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3af1fd2-0a92-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686733649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733649, "uuid": "3cf562cc-74dc-4055-a3ba-950b78fd5a87", "comment": "Malware payload", "value": "79c60a5f1de11172b82fae31dcf073af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733649, "uuid": "e7155379-244c-424c-b58c-da65133c9414", "comment": "Malware payload", "value": "566c7451c25c87a09550fab03b6024967828694d2da72206c14a02ff122eb4b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733649, "uuid": "a5e97483-959e-4717-9141-ba6df89e90af", "comment": "Malware payload", "value": "d6565c4995afdad40ad09d1da0ca4ef5cec3cc76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733649, "uuid": "9db08941-9624-4bf0-bca7-390afe91b462", "comment": "Malware payload", "value": "7a90a503a66dd3d763732830b9adb08f43ce2dfc6936d1f5260ce410abd0fdfe898a448d201ecd402f34b5de8940fd80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733649, "uuid": "f31f94c0-576a-43ab-a7a4-de5b37511c55", "value": "T151646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733649, "uuid": "aa42a9b8-266c-4a9b-8d85-dd3b0d884b0e", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733649, "uuid": "78d662c8-2bc5-4f5a-94cf-cdbf8ea12d96", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9mY:5xb8ZqekwkJPaThgyDChXohRRwJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686733649, "uuid": "88267f6c-8665-41e6-9fd7-e3a8003366dd", "value": 320531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686733649, "uuid": "1c129f47-246f-4624-82a5-b56da7c16dcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733649, "uuid": "31f07f98-aaad-4ba4-99a8-fceff859b549", "value": "34324543.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "450fdbd3-0ad1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686760441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760441, "uuid": "2038ed8a-ae33-4ddf-bc48-e59869b7ddaf", "comment": "Malware payload (Quakbot)", "value": "cbee0ca40e066aba258c5f215955bb5b", "object_relation": "md5", "Tag": [ { "name": "obama268", "colour": "#C8D754", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760441, "uuid": "f0f1f5e9-e4dc-4537-a644-91aaf8e5ca00", "comment": "Malware payload (Quakbot)", "value": "56dedac45f41f69dbe0412ccfc655dcd4bcae37c65ffef094c1eb515aa0d8e66", "object_relation": "sha256", "Tag": [ { "name": "obama268", "colour": "#C8D754", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760441, "uuid": "7e415551-f4bc-4eec-8599-0a5c9831a914", "comment": "Malware payload (Quakbot)", "value": "f6cce59f5e4f15926a8db631241640a88c5dbdb7", "object_relation": "sha1", "Tag": [ { "name": "obama268", "colour": "#C8D754", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760441, "uuid": "d62cfd24-3767-4a72-9a59-808666962209", "comment": "Malware payload (Quakbot)", "value": "58d6e4b889e339f5b81fb3ad6df3792a5153418588caa0991c4f8482cd9cf56518d7cde6043a0a11939574abb238e413", "object_relation": "sha3-384", "Tag": [ { "name": "obama268", "colour": "#C8D754", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686760441, "uuid": "14fe3729-4c8c-4ee6-9727-d9e3e61779c6", "value": "T1F5A37D6DA84CC688C979EBF2F712F4C9A54D732B5ECA94B571AF0FE61243C25E943801", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686760441, "uuid": "ff7850af-04eb-4bec-acd9-734be7a372f2", "value": "1536:wcs2UwcsB+csvVcshBI2L3RLYm3RE3MSLVMXLHtSR1GWBZD7p8VbLi6ofW:jmBL+MeVoHtSXGml6ninfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686760441, "uuid": "e2fa73bb-6b6d-49d7-b2a9-e3c94ee405d9", "value": 106903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686760441, "uuid": "3efa5ed5-21f3-42f1-803d-1420a71345e9", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686760441, "uuid": "5183ced3-c25a-4345-921d-74d091bf220a", "value": "CalculationOfcosts-1337.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67eb7d0-0afa-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686778241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686778241, "uuid": "d478103f-148f-4cb1-bb00-0c23699d1f1b", "comment": "Malware payload", "value": "7b33644c82ab1b9e710300182ff15048", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686778241, "uuid": "4c0379f1-33fc-4d9c-a77f-5b1e049a790e", "comment": "Malware payload", "value": "570170dbb9f7dfdc324283240ccc3cf7c329744038b785252e61d6f1774542ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686778241, "uuid": "b044e84c-572f-4de7-a589-5283274f9834", "comment": "Malware payload", "value": "a757d10fb4662e7300e51cc554ec1172cb2704fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686778241, "uuid": "a4f3577e-3019-4e0a-aeaf-5f77f33232e6", "comment": "Malware payload", "value": "e1101400d6e3f3924086c134624f170e8dbe9c921a072371ba5a4c5f3b3380941851c114141de566beb9b2b2536cde15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686778241, "uuid": "f31a0e5d-feee-4c47-8cf1-f9112d5cd9ec", "value": "T1E204CF1376E0E472D5A797318CB9C6E02A2FF9120F3466DB37581B2F1E722E09A76345", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686778241, "uuid": "053383e7-96b0-4577-9fe4-1b3cf2d8fdf0", "value": "3865ca37561d2aa29b9e83d3d87488fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686778241, "uuid": "988684e5-2e4e-4a38-98ef-013f5e81902a", "value": "3072:BZ3xa+IhicdAKdR+42YXqLFzISKKipPEMsGD+Lm:L38JYh8+4gLybNE6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686778241, "uuid": "c56b132b-ec93-4e9a-a6ca-e3416b8664be", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686778241, "uuid": "3bc812c3-b0ee-4366-8fd6-2f19d5b2cfca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686778241, "uuid": "9e46e2e9-e73a-4ec7-8610-77332e7f6379", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f3a75e-0a70-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686718862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718862, "uuid": "6c07ef2d-6c9d-4457-b95c-1f52db0aa53c", "comment": "Malware payload (AgentTesla)", "value": "389b1ceb54ef9b29abd411ecc34a81e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718862, "uuid": "9abcf5dc-260e-48c5-99b3-77b319e27c91", "comment": "Malware payload (AgentTesla)", "value": "57191284c75940f3a637266acc38d3a503ab97a52c9d99a0a85ff61d27420b6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718862, "uuid": "6aa54202-0a79-4cef-b25e-303c7a08eb6d", "comment": "Malware payload (AgentTesla)", "value": "10d1d0b6079b473cbc2f80fae531c5249d869b10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718862, "uuid": "1089cbcf-346d-42b8-bf62-69bd167757a4", "comment": "Malware payload (AgentTesla)", "value": "4b2d8893f97f6c50e42be7280fdc9c07c7900ec5e3897a4ed24f7847c53ab98e225f624b30dbbe30f7ce6bd7e21586e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718862, "uuid": "a9701256-3afc-4bf2-8abe-75aaf4ec4563", "value": "T16F35B23E1CBE523B95B4D6AACFD58827F480E5B731226D39A4D353864316D8239C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718862, "uuid": "462e9a2f-9dac-47e9-bcfa-4e95034fc699", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718862, "uuid": "d419957e-3bd3-436f-88df-9a31ededce4c", "value": "24576:x9g5RKfkbB7XrwQVAv4OagvtRejXSWfJ:Q5R5BXEQ+4OagKfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686718862, "uuid": "80ac4e0e-be91-43f3-ade6-1e6ef382526a", "value": 1152000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686718862, "uuid": "d9b6b800-a44a-41d4-be68-2f8fb60320ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718862, "uuid": "79082085-f335-4042-b16c-405a1e38afad", "value": "Maersk BL 208268807.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "226a2514-0b0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686785723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785723, "uuid": "b2dd1f4c-7eb6-4ade-9209-275a37db198e", "comment": "Malware payload", "value": "be4644bf49cdc95ee7428d3a70d3de3e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785723, "uuid": "3c30ad74-c7ee-4fdb-8760-ca95b547ffb0", "comment": "Malware payload", "value": "5734fe117800c84df85862b35f584f0533bcd05fbdb3a534a05c638439a7a68c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785723, "uuid": "0ba600f6-6aa5-433e-b2c8-954a59d4cabd", "comment": "Malware payload", "value": "4a389281e32af298f1387447cb60e8bf136599a7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785723, "uuid": "51ae52e7-bde9-4140-b62b-50f30c6ed947", "comment": "Malware payload", "value": "a8624ed7d3a8be3da2d8a84cbeebcce9b89046a01b4fbe632626cd5bdf8bc5e5ee04bdf0e8abae4bd76ae40a6ac23beb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785723, "uuid": "6f8769f0-a39c-44f7-8da5-4d2727d93833", "value": "T1BB23F27B372215B0F732D5BD22898B906D625EAA4613ECC4A1736A85CFD205CFD633C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785723, "uuid": "7fd73707-9e6b-4f8a-9f7c-ca62c5be88de", "value": "768:P5576lLpPZQEq8kO3FR+fjhk91Zzq6TmuU+eafHFAXjuR36pJgGlzDpUYs5h:PT76ldPZaqv+rW97zhnUol8u5EVqYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686785723, "uuid": "e9dc6a07-f34a-4a3f-a439-454c506bce5d", "value": 46176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686785723, "uuid": "16e76cbe-d048-49f8-9da9-79eace87025d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785723, "uuid": "9b0f5dd3-e5fd-4e9e-9d75-e638011c17df", "value": "SecuriteInfo.com.Linux.Siggen.9999.21435.23433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984b0e15-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725792, "uuid": "3651c9c4-a44d-478d-8292-e05c82d29ae8", "comment": "Malware payload (Quakbot)", "value": "07453e71ed1adbeb70a09b83e1926399", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725792, "uuid": "1e08979a-1efd-47f7-8556-3107356c78c4", "comment": "Malware payload (Quakbot)", "value": "5753f55c05a68b834cdff1ebfd4d028b671668cecc8be172dfa396148308a296", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725792, "uuid": "3a634f08-8f0e-4612-8b43-d2f5f7914b10", "comment": "Malware payload (Quakbot)", "value": "576e832f204a25a9652d5e63e08274efccf93fc5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725792, "uuid": "7f334162-afc6-46e6-9b25-3e18965c9d91", "comment": "Malware payload (Quakbot)", "value": "93bf1d78b561b16e4f0f6bbde742e9bbe631dce1d5a1b01141c78ef5ba81e9e12d1d9cb3da1ba9ff2d672b28b351af33", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725792, "uuid": "247696bb-9203-46ee-8e3e-403001eede7f", "value": "T1546443496A51E0F09237F33BCE179410FA6B1E1B20848972B97C51591F3D8297EB7ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725792, "uuid": "f01005c8-b93d-4415-8506-e552d5a4d4f5", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbaiEe3ulh/m0hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725792, "uuid": "ee2502c0-b492-441c-b818-c2b5edd15500", "value": 334823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725792, "uuid": "6e73d30d-7be8-47cd-87a3-9a4f6e52bc09", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725792, "uuid": "8969af60-6681-411c-9758-7d76511437d4", "value": "kQSkj5jcc83xWU.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf54463-0a6f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686718255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718255, "uuid": "a37a1e88-9f43-41b5-930f-c0a4ca58bc92", "comment": "Malware payload (Mirai)", "value": "e3df379a4e0e8ea4377a9e248f5feb6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718255, "uuid": "e091485f-45e1-4628-872a-0b1358ed0aa1", "comment": "Malware payload (Mirai)", "value": "578f231f43c27224d5f43f5c04985778523e287ba8f1ba33efa804748613a98b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718255, "uuid": "3a2e98fa-7767-4f62-b22c-e1f91b201c68", "comment": "Malware payload (Mirai)", "value": "d7036a91124d0fe28bea6fbec536df72ea11fa8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718255, "uuid": "7136fabf-abeb-44f3-bb7a-5b9878874ce8", "comment": "Malware payload (Mirai)", "value": "3abca2c9aebadaf61e6efb73aa1053171fac2b51abd25da98cb4d6e39f23da775fb0911961beab1ae0e6038942964301", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718255, "uuid": "8362b958-b3e2-48ae-b6b7-f7400c914730", "value": "T1E0E34B46FA818B13C4D5177ABAAF01493332A794A3DB730689285FB43FC776E0E67905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718255, "uuid": "22c51aa4-2b91-4689-9fbc-f017c6ebfc31", "value": "3072:ARCjRqaA5wA0yzChj/bl1PoGu+2VmDRdibRPfJyFlSff0M/9pxG33l:uCjRqaA5wA0y+hjnoVmDRdibRnJ4Sfcb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686718255, "uuid": "5efddf05-54ba-4445-a5bb-eec3c8bbf0c2", "value": 148933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686718255, "uuid": "a89057cf-35ed-4524-a014-12216e9ad2d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718255, "uuid": "a907a52c-fec8-4979-ac70-43d6756eba10", "value": "e3df379a4e0e8ea4377a9e248f5feb6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0fc101b-0a72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686719847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719847, "uuid": "e2946c74-1e86-497d-850f-07201b145eeb", "comment": "Malware payload (Loki)", "value": "66b8276b77ea82836593586d2afbeb2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719847, "uuid": "e3ac90f8-fd71-4fb3-8614-8c9d2590c2a9", "comment": "Malware payload (Loki)", "value": "58036d338d5e813b0143524d21a140f38d8b58f1a531b72f7ce4a82091380185", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719847, "uuid": "bf1e228e-fa02-44be-8dcf-97416affba85", "comment": "Malware payload (Loki)", "value": "57885385d02723dcf94484fd0e0751e9c143a6ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719847, "uuid": "31e9a19d-60b1-4b11-81fa-13906892a8f7", "comment": "Malware payload (Loki)", "value": "610df1e5b937484c6aca47c87db191fced67e4ca452bf35f445375f8ba61a31e60b5b64ba6e3ea417ab12a842e6ca744", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719847, "uuid": "df5d29bc-deb7-4dea-9f80-a3f85d25fc48", "value": "T163256F3E1CBE123795B4D6AACFD5882BF440E1B731226D39A4D353964356E8239C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719847, "uuid": "90be1632-c337-4b3f-8447-e39c3c06e25d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719847, "uuid": "f33d30c8-28b9-458d-8d97-809d5e83016f", "value": "6144:dg7qrb0EoGPBDF7iG4Xu23PHkvvzkrVpkeZy7KKw02oMlOcpPRskbwLnRjn5lo6v:wqrAGJDo/p/rVLINIllW556jBP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686719847, "uuid": "13be4d8d-e75c-4793-bc4a-c1a14583e5a9", "value": 1024000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686719847, "uuid": "4e333574-4338-499a-9774-c44f19dee4e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719847, "uuid": "a7f2752c-4e26-496a-857b-48882e1a5292", "value": "66b8276b77ea82836593586d2afbeb2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "937b035c-0a6d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686717623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717623, "uuid": "16becb61-d7be-44f2-9aa6-cb08186d20dc", "comment": "Malware payload (AgentTesla)", "value": "bee4228379337219946d60655bfa9341", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717623, "uuid": "625eac95-2b82-427e-a685-2d45952a1994", "comment": "Malware payload (AgentTesla)", "value": "58e573b3f5001e4f262f0f56cc08391390a10e9fedd7e46b054c3a6197991b32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717623, "uuid": "7f392b0b-2380-4bad-9310-cf7fd348c2e1", "comment": "Malware payload (AgentTesla)", "value": "9cc3d9f6b31732f5a64a2f377ac804a0fa1ae8d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717623, "uuid": "ce8e7a88-71a5-4556-99e8-bc7c7ebfcf1a", "comment": "Malware payload (AgentTesla)", "value": "89ef26a266e31db30cf3801237f2c4a1543edfc4e976609306a4a38163ac284075a66b5ea92cc97a6f9faacfafd5d7fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717623, "uuid": "d1d4db88-0938-4d22-98f0-0019dcac3ac8", "value": "T178F4F10A72BA8F6AD03EABFD0A151132C3FD19297423E6165FC375DEAD11F440A90E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717623, "uuid": "7460c4bc-5030-4f75-8507-459c09f7a764", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717623, "uuid": "5421b641-9760-4613-8317-ddc58f16ae92", "value": "12288:Er2iNyOe42KMu/N3mWhQmwmJCMpUGv7ohmT/w7AWwSznMwFXhxJiIfc0Hvtg6zci:m1wOV/NOafv7o/gSHhxhfZJzcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717623, "uuid": "1d834107-6c27-4f03-8440-da032b158082", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717623, "uuid": "2a6d06a8-5a95-44a6-af14-f639f8678127", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717623, "uuid": "f0330823-d7b8-4815-a14d-22482fad7e5c", "value": "bee4228379337219946d60655bfa9341", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8feb448a-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725778, "uuid": "cc7d6cea-3302-41cb-8bc3-00169a6449c9", "comment": "Malware payload (Quakbot)", "value": "95cd9f9b72ec6019d9b78ac8dc7d5399", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725778, "uuid": "0dd038ef-0c42-4ffc-9ed3-a839785b0807", "comment": "Malware payload (Quakbot)", "value": "58fed3a739c1ab3b03f9eeb11efae107dcb008eb920fe897eb3a9672cf263917", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725778, "uuid": "1e6bd954-0657-4dae-a891-2d65984839e0", "comment": "Malware payload (Quakbot)", "value": "fbf3514a0c686eb398ef8887f48300733d04a211", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725778, "uuid": "844c196f-37bf-40e8-b6a7-19e984e91e16", "comment": "Malware payload (Quakbot)", "value": "72f1ef3fa5e4506c64d1099e531a8e20c1be0a38808439ddfe719b4fbe009bb63d17aee4a363f709cf7f623fc70d81f4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725778, "uuid": "a4298a7d-8810-4414-ae6d-49684835d277", "value": "T1EE7421895A41E0F08237B33BDE175414FB6B1E1B10C48922B97C61595F3D89DBAFBE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725778, "uuid": "b4d62801-e513-4f22-b6aa-c1ebb2481fbe", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbwltAo7Iqlrb9psYCsOMThS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725778, "uuid": "49de5c8d-e153-44d9-8d59-97d23a6750a1", "value": 344025, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725778, "uuid": "7a106f48-fe04-4e12-80f9-32097119a08f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725778, "uuid": "d95c2051-0518-4090-ae20-7861cc13b44b", "value": "km7QHDTSaY3UQ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5f133d2-0a8e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686731962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731962, "uuid": "c8ea1b4a-7ba4-415f-916c-4e0ce643432b", "comment": "Malware payload (AgentTesla)", "value": "2781a721380fe9407f7d159b498eaf93", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731962, "uuid": "ab884c0d-0beb-4efd-8753-111cb9016848", "comment": "Malware payload (AgentTesla)", "value": "5930dce2e28222e38cfc257cab9cbe4cb65ae0667c9464bfab073f4f9fe815c5", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731962, "uuid": "add67c82-3d9c-424e-b071-f7c997a6f927", "comment": "Malware payload (AgentTesla)", "value": "7043f9d7a187ff1a5d18254678d581e1a518117a", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731962, "uuid": "e9b2482f-bb98-421b-814a-12d4c5cf6542", "comment": "Malware payload (AgentTesla)", "value": "21c703cb9c942c0a05f78eca64dbf847a1e8e5758e786e9ad09df0a71189c1f2400626e6975d3be0c5b9368a23b69455", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731962, "uuid": "40d39f45-74ab-49c2-b75a-1e8626c3aa90", "value": "T1E8E4237A09450F424DD51930B854EB4332909A56CE135F3BC85C91ABA3EB82F2DEFB97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731962, "uuid": "0c133223-82bb-4bda-acab-28cdd76de268", "value": "12288:1MOkt/eEWO8gFaYQG0ETRkHGCUKVUHFSwzksy3ERCzNDC81C03mRmbM:1MOkt/enYomU0lHyzlvJ3mRmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686731962, "uuid": "4154c200-42b4-4117-9be1-3307d2176ca5", "value": 663254, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686731962, "uuid": "5354a22c-ced0-4556-88cd-081972bbf5c8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731962, "uuid": "6b155b4a-11aa-4457-94d6-b336acdcabcf", "value": "Purchase Order.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acafc05f-0a74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686720672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720672, "uuid": "30698a93-5659-4435-bd9e-927757bb4d43", "comment": "Malware payload (Gafgyt)", "value": "91836544bf3fb94d3236dca996f54522", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720672, "uuid": "8e9db9ac-b112-4f56-9928-e603e8f1b430", "comment": "Malware payload (Gafgyt)", "value": "59b828cd7b3766c459af58beb287947fed325c72ca1ef49929259f5db50b2dfe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720672, "uuid": "5637ee33-3594-4b18-b490-30adc885e294", "comment": "Malware payload (Gafgyt)", "value": "7c1dd802788ca54cce366a160f0a0ba2aadfb96c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720672, "uuid": "e8021283-26a6-403f-8417-a3589824c969", "comment": "Malware payload (Gafgyt)", "value": "e9cdc4137ba01d90dad3fa7d635921db2de6d29ef79469fb1ed1ea10bf242c95f049b5a10b2fdc54549594e86f9c9dcc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720672, "uuid": "fc73a260-82a2-4544-b961-08e2811fc18a", "value": "T1B8046156448CD6E7C02266B975ED9F3ACF3EB6C62B0A8E017CE415704A4AEDF780BD44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720672, "uuid": "930f70df-a064-4622-845c-e34fd4f25308", "value": "3072:C6HDxfSUm3Ox5J5hRTcQyLlTJRTDmtg2Sq229+Nu:C6jxfSTK5J5hRTcQyjTDmtg2Sq229+Nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686720672, "uuid": "ff4c66ba-1767-4dab-81f2-9383ed4aff59", "value": 178656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686720672, "uuid": "b0cf1a3e-c8ac-4e59-89ef-76583245988a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720672, "uuid": "671a98d4-bbd3-446c-85e8-bdf468e79db5", "value": "91836544bf3fb94d3236dca996f54522", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82980218-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686750666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750666, "uuid": "58bcab1d-709c-4792-8044-f94a25c308f0", "comment": "Malware payload (RedLineStealer)", "value": "7ee71d379a64fc7f582323cd7e3df086", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750666, "uuid": "049ad2c4-2d1b-4076-a1cc-642580561273", "comment": "Malware payload (RedLineStealer)", "value": "59c67ade4ac8da3ab9d24e5a96899b197f3245071eb2b4506d40f816b5db7057", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750666, "uuid": "dfc9f803-3180-47d2-af31-1be007bf4753", "comment": "Malware payload (RedLineStealer)", "value": "2379c1428ffa0364fd8973d2af6b0697bd8ac5fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750666, "uuid": "6ae00a09-957f-4ce5-8950-9e6363aff851", "comment": "Malware payload (RedLineStealer)", "value": "1aaeb35a53a20ac95dba3d15714490d16817eb9b64ef634b6596de3ec74679c220143d18f0067c676557308a51e3829f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750666, "uuid": "9dcb19e8-ca60-46c1-b449-512866c45077", "value": "T1A9543AB77792DB77E5D1D0BB9B2355A9C420A8F0B2DC24CED2806B1E56201E68FF0617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750666, "uuid": "41e34421-9bdc-40db-91e5-a027f4f4d2d5", "value": "bb6d69b7632b1e5c0fdd9e8372c6b738", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750666, "uuid": "a2efe049-a8fb-4a8c-bba0-3b4c9ad5ba08", "value": "3072:hROaq8EEMYqOmRA9cCCyPE5PQcZ6qGtKY1r63fx8h0A2aH/itBx:h843MYqLA9hOPQVqGr1Qf6GQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750666, "uuid": "aa228d16-1926-4fe6-ac70-9a91eb2d28e6", "value": 292479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750666, "uuid": "e5d328d4-c1a6-471f-b49c-98b1fc97301f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750666, "uuid": "7a53e416-6502-4067-87b0-907b03a05689", "value": "7ee71d379a64fc7f582323cd7e3df086.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743505b5-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728308, "uuid": "3016c6a2-583f-4581-8abf-2772124bf01c", "comment": "Malware payload", "value": "5289063b10f7ea59f76981a6b707686e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728308, "uuid": "6bfb0fdd-09d2-4274-b447-405e9691ac74", "comment": "Malware payload", "value": "5a652761cdc46fb64dfac6c2d3d9ab2bd6108ccef5860b411746c8de1c6ccf59", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728308, "uuid": "de168f0d-4f70-49ac-bffb-4dcbb380f833", "comment": "Malware payload", "value": "68db8bb4d19ba1c0cd997f9cd37497b91524c76b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728308, "uuid": "91239410-a603-49d8-a263-a5b5d45eea1c", "comment": "Malware payload", "value": "851d32ba468e2558a1ed88d7c007da98fecab78ce288f713aa7f011fd57732b97010aa0551bb875b87b755ea35777837", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728308, "uuid": "a8900142-7474-48be-aba2-ff130e0b2775", "value": "T1896433896A41E0F08137F33BCE579450FAA70E5B10848966B97C60586F3D85D7EBBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728308, "uuid": "b8fb803c-ecbd-4206-bc63-7e007dd9b9c9", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb6mfk/hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728308, "uuid": "7f4416ac-50b0-4a72-a561-8429fa6bf752", "value": 330595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728308, "uuid": "5221421d-aeef-45ba-a253-7731bb0486d8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728308, "uuid": "2115abbe-d5f1-45a8-a70e-eadb668123f3", "value": "ZTBmezckK5Cp9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1af77b-0aa3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RustyStealer)", "timestamp": 1686740614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740614, "uuid": "f56a5bf8-7296-449f-a5f1-86512a4a94fb", "comment": "Malware payload (RustyStealer)", "value": "56a9efe9332f88915447ee88a4e97e64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740614, "uuid": "8f3fd962-bf94-4724-abc2-2a16a3efc70a", "comment": "Malware payload (RustyStealer)", "value": "5a6acfd8a17346d26454cfa6db6724dd4629753b2e36bd6777bc96b7922dea95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740614, "uuid": "8dd42be3-5053-4444-81d9-f29a3e1a4ce5", "comment": "Malware payload (RustyStealer)", "value": "81bd384bc0ed8ab00dda922d329cf17dbf270267", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740614, "uuid": "03f88a44-20b9-44d3-90ed-3550bd04a5ac", "comment": "Malware payload (RustyStealer)", "value": "b455aefa8390ebd9003f048f518c75d8fa5a7dbcdad1f66a605f92017e38d1b41c3c5acc502aa7acd8c70d1129b0dfb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740614, "uuid": "7ff56b7e-c745-4105-b2cc-7a488a18c22b", "value": "T18666D61AA76D60D9D0BFC078D2879F22B9203499073977F7899096652F20EF8BD3D364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740614, "uuid": "35ef6b8d-336d-483a-a017-1c7dd7cfe9c9", "value": "7ae1295b569753b39507c7d5f8e24e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740614, "uuid": "1689fe2a-0fbc-4f00-902c-052c47464553", "value": "49152:9KVlhANbkewy+LPsx3x5lxrMiwWWrtRQ7VN4q46OWOPk0rtXbviB/3Va0rYsbeHr:VOy3CLXNlM8Kng/kCjr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686740614, "uuid": "172d49c3-b6a6-4f12-94a4-f0789445a8d6", "value": 6939928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686740614, "uuid": "6bf7703e-8c57-47c0-9f6b-0749afed8a9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740614, "uuid": "81b987ef-aba4-436a-944e-e8cce1c2e998", "value": "5a6acfd8a17346d26454cfa6db6724dd4629753b2e36bd6777bc96b7922dea95.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6460a081-0ae0-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686766936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686766936, "uuid": "baf8da2c-0e5b-435f-929b-596da8c90a31", "comment": "Malware payload", "value": "dca90df826b6480abf70e86501026fef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686766936, "uuid": "a8ec033a-b958-4139-b662-ffa4dad6a71a", "comment": "Malware payload", "value": "5b9c530caaf6fd3bfc8244985d1e88c03042a73c55dd97745ea749c32ca6b8e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686766936, "uuid": "96114c9d-b0f1-4ffe-bf9f-dc681454d5e5", "comment": "Malware payload", "value": "590804a9ff46cd741d744c08b1b3206d6a1d174f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686766936, "uuid": "78f7d6dc-959e-481e-9ca2-ed426392400f", "comment": "Malware payload", "value": "ef54395f19b75067848a9fd25bfe35d8fcac9feec60953c672d9b1d690e90b2b367d7868ade739fd7e721a14bd5c526e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686766936, "uuid": "693b91b8-5453-4a9b-be56-6873b8184aca", "value": "T1DD941849FB7408B5D096C531CDBE8376E272BC831B25930B8641FF5E2FF362169A9681", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686766936, "uuid": "e5478653-6058-471c-8aa1-2d892ae510a5", "value": "67b7b2d1b0bb5ded11518dee2d176bb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686766936, "uuid": "7b515993-8376-4598-834d-8ee08047ec25", "value": "6144:fywNPsQLwc3HMp4iT4MKLz3I8JMGxerEhgVIXFM:fX1Uc3eFrKo6DerLIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686766936, "uuid": "c307859f-db1c-4934-86f6-2b73ca0bed3c", "value": 425472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686766936, "uuid": "05645d03-1131-4d18-9d5c-b84f217b95bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686766936, "uuid": "0a4a6563-c9cc-4996-8ff6-375f3edf8cbd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a38e427-0af9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686777522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777522, "uuid": "98bd789c-bc90-47c0-9ca0-93dfcf47171d", "comment": "Malware payload", "value": "cbed212d214bfcc68b2fa4866bc861d6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777522, "uuid": "6e0d5470-fe10-4090-8a73-7195106dd4c3", "comment": "Malware payload", "value": "5ba6eb91a1873f9dcaf163267f353b9c9968dc02a127084c0b4caa194ac18b15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777522, "uuid": "8c637bfe-f31c-4e31-8184-72b03c5cc0ea", "comment": "Malware payload", "value": "d1773fe85ff0ec2ecd6ca352ae07c6f70e49f13a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777522, "uuid": "164787bf-bee3-4eb9-aeda-aec7f47c70d2", "comment": "Malware payload", "value": "ff72b478fc844d5934bb907f184b9aa07aa51ac68d6aaf2f1a7a1ca4e68634bf7ec050be9316c27384406444ee3d0929", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777522, "uuid": "e3ab3e8f-a35f-4558-be37-f8781e635a2c", "value": "T19723F19BC3A0E14CC57D8F749A517FCA9D54D2C4363A8B4C9706CC8DBA6D19B2A2C839", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777522, "uuid": "d138c1fd-d71d-4362-8609-fda47ea2ae6f", "value": "768:LYXkFIuHPS1G1+i7cM46WINsIn/7I6jzNFMXwLwIS0xgMpdsxeRGy9MVqUWMH:NFvPNkpQ0mMXwL40eMUxQlWUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686777522, "uuid": "0d35b5a5-0b04-4997-9d1d-68b77edfa281", "value": 47412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686777522, "uuid": "fcba1368-d4fe-412c-a6fb-dc8e9b4207ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777522, "uuid": "887a9ee4-f66c-431e-9787-8ffaaa504b1e", "value": "cbed212d214bfcc68b2fa4866bc861d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df889d7-0aa0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686739491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686739491, "uuid": "679a2872-db36-421d-b6af-c9161e006a97", "comment": "Malware payload (GuLoader)", "value": "73057c3da2f019f73cea4f5ee98ee870", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686739491, "uuid": "70435b54-e237-44d4-82da-b2cf488c1419", "comment": "Malware payload (GuLoader)", "value": "5be0fd1cf2a356622387ab505bc774cabd9efb6547d605b98fd394273219e543", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686739491, "uuid": "ae4f84e3-1e72-430c-b5ae-d70cc7b4e7ed", "comment": "Malware payload (GuLoader)", "value": "11e1f6c80859badc6dbb1cdf5a797f2a3e62b376", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686739491, "uuid": "d0f91c3e-7a06-4cc5-a676-dc57f10a5271", "comment": "Malware payload (GuLoader)", "value": "f85dea5548879400539060c7c81173e0fca4454af09344b7795e0c9fa1f596fe57d66f8d84542d44f658c424022cdaf7", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686739491, "uuid": "1cb0e2cb-ed6e-4979-904c-b55f8bb9842b", "value": "T1DD4502127760D933D26E0230C4276EF24AB19D51E9505B573BAC7E077F7A3C18A3A25B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686739491, "uuid": "107c12dc-d62d-4d6c-819a-dd7b8c6f83b2", "value": "6144:4x4vyP05yb7EuugWVZ+oYZ4X8IvMTKdfdIj+rmdd6ArMYiJWPY0I/9cC:a4dcTbsYoYZ4X8IvtdFtodrMYjf29c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686739491, "uuid": "f3bb5641-d7d3-4583-ab35-643d11fe0cd8", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686739491, "uuid": "b770c4b0-5c04-4338-a240-1d6146270ee5", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686739491, "uuid": "baf21e4f-759d-4efe-b839-5285beecaf0f", "value": "ANALYSE NR.jt001-pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd83161-0b06-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686783115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686783115, "uuid": "a396a1d8-c737-425c-a572-29884b44903a", "comment": "Malware payload (AgentTesla)", "value": "1147eb3ba3ef4e124070ea87488b1aac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686783115, "uuid": "e6f6ccae-7e31-4ef7-bc57-e04f45592199", "comment": "Malware payload (AgentTesla)", "value": "5be7807089d9c16fd4531644189948b6c5ccbfd3c69a749470e0b5f17cb25e5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686783115, "uuid": "d3060dbb-6e89-4bce-a374-314d40dd7a1e", "comment": "Malware payload (AgentTesla)", "value": "b857632528378ebc708e8a5a7c0a42b34831f2a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686783115, "uuid": "f12a7dbc-fd1e-4487-bf98-15c18601d633", "comment": "Malware payload (AgentTesla)", "value": "ecef8072d7ed4b05c60d0db16978454b6cd71f0f5a4f650debea0b75846d2ae2bd5b93d97192ab8c623bc49275ff2ec3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686783115, "uuid": "f0df50bd-9d9e-4ffe-a89c-ebf307acfaa5", "value": "T13A22EA31731C8533C52A0B7A7893E3C1077AA31555A1CADDDCC811AD9EA37114A637BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686783115, "uuid": "e3c04f2e-771f-4247-9b35-67be147a7fec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686783115, "uuid": "4784a5f8-1f83-4feb-bd6e-b9280f9f4b14", "value": "192:FlfffffN0lkRtEJ1l9HeAVLzx+aqNRt2yLQLaLZLaLDL0QdzmIwF:FlfffffiTvl9vLzx+9NRtXLQLaLZLaLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686783115, "uuid": "871a5f75-2c0e-4a14-9eb9-2f349183517a", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686783115, "uuid": "8f3217b5-e92b-442b-bc8d-4271b8aee9da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686783115, "uuid": "c2e0bcea-f2f3-4fb3-abd7-c8f51673de0e", "value": "Transfer copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e444ca4-0a6d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686717427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717427, "uuid": "717fba02-d6e9-49bc-98f8-df64a17091c0", "comment": "Malware payload (SnakeKeylogger)", "value": "e0376007e3910c34818777a73cf7ac1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717427, "uuid": "36b7ba40-9799-43a8-90b1-22c67cb5289b", "comment": "Malware payload (SnakeKeylogger)", "value": "5c0f9b792a93d6445bc4828d26e1a22723276efc19e6e97b8c8548c890bd0f00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717427, "uuid": "0b205810-30fa-4098-9679-2badba888b2f", "comment": "Malware payload (SnakeKeylogger)", "value": "8aa5d5e3ea1dbc4dacb3bb4f43793447edaca7df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717427, "uuid": "e5f12882-864d-4851-bd0b-73dc52a17f85", "comment": "Malware payload (SnakeKeylogger)", "value": "677a120681530d2078e5b498e06f953dc2198b416bf6c57a00ae01a6513277a56b7a882bb77cd91ee8a331dcac6e4b38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717427, "uuid": "49e3a126-f6c1-4298-aaaa-2d9ca1ecd32c", "value": "T164F4D081717E1963EABE8BF5025156B087F62E5FA65DF2E84CC270DB62F0F414A41E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717427, "uuid": "f22e9768-d76f-4a0b-b790-ac05411e5a98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717427, "uuid": "564af9cd-0c1b-454c-a0d5-f4d55c5146f2", "value": "12288:0lKnuqI7gEXqXdVa6tEaPPn+PpJLiQjdtWCr7daH9UDJgF1:Bf4qXdVzBP+DLAisH9UDJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717427, "uuid": "0cc11b65-6ac1-434d-80ed-b69e741ec88e", "value": 770048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717427, "uuid": "3a41403b-a7fc-4167-ba0d-65031473f803", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717427, "uuid": "49c465e9-33a5-4c0a-9cdb-45323a29d7e0", "value": "PO IMO No. 9243502.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0021d81-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728408, "uuid": "44a8b78f-657c-4629-a566-826ce6387ff6", "comment": "Malware payload (Quakbot)", "value": "3cf01e40cc36eef58d26de969c1219fc", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728408, "uuid": "3ff473e1-67c8-4f6f-b8f5-d7965b88010f", "comment": "Malware payload (Quakbot)", "value": "5c666d42ddbf63e7b6e5256e360b9b627a8f6383db3b040c888ed662123ca8cf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728408, "uuid": "30b65dbd-05b6-46a5-a408-ac2fc15316aa", "comment": "Malware payload (Quakbot)", "value": "fcd13b3c8f0e8dc0012bb236b3e1cecbfc38a28f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728408, "uuid": "c6c5bd9b-0a09-4939-9fef-c5e2a16fb655", "comment": "Malware payload (Quakbot)", "value": "049235d116a4d6d5f4bc234baf2ef1fed55c1695763eac53f395ce119c79704156b402e8c550b4dc1642506005bcb7bd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728408, "uuid": "665fd0fd-f4af-46a2-893c-3dbbeeeac291", "value": "T1C85454856A41E0F08137F33BCA5B8410FA671F1B2184C972B97C515D1F3D86DAABBE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728408, "uuid": "af5ec0b3-62d1-4339-a48e-c87abb16831e", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbpyuhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728408, "uuid": "12aa4ce6-0c7b-45ae-a903-146d5c66836f", "value": 305958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728408, "uuid": "85ae0063-add2-48d8-be28-1d0d2e18bf20", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728408, "uuid": "68ca7965-c40e-446b-8cd3-321e51653bf7", "value": "WJGd01YkiHTz.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c911103-0a97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686735516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735516, "uuid": "b16d6e9b-7453-43d2-bfe1-2f4fbe9b3e58", "comment": "Malware payload (AgentTesla)", "value": "3f1f50c331ac3ff133b6d39f4f199217", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735516, "uuid": "ef406439-27c1-4f22-b090-5113fa94fc23", "comment": "Malware payload (AgentTesla)", "value": "5c8d12a92afd80bf3da02561845aa8feb8734440fc7f293bdf428e0f8cced1f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735516, "uuid": "8af00b8b-d50d-4f63-b83f-84a760ae1a76", "comment": "Malware payload (AgentTesla)", "value": "330ab8a08deee6428157b454e5fe66820f363925", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735516, "uuid": "c1c9e54f-d559-47f1-b261-1c3ed27f2d30", "comment": "Malware payload (AgentTesla)", "value": "7de9a16982d0799d2aa2db2bec5897dcf3485da626c777d2c6491a6b8577c36ebdc344456c80c15b09b7f2ff44ce0262", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735516, "uuid": "5b4ef571-d95b-4a27-ae49-33239c172965", "value": "T1E305E081323A2963EABACBF50251517097F62F5F665DF6E80CC6B0EB56F4F400A41E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735516, "uuid": "59f665db-99d5-4d56-964e-dffbede795bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735516, "uuid": "e4224c40-4cd9-44a3-99f9-64dddb6a2778", "value": "12288:clKnuXEXqXdVKjPJPydCFExXbrqV3aaZBO1PSv4KyNF8W1e0uJHmRSK:ZS4qXdVKMrbqNAc4Ky7OMN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735516, "uuid": "0b680787-1927-4463-8f16-9c34b3fe5110", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735516, "uuid": "21c420a5-6956-4ce8-b587-e2210536645f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735516, "uuid": "77851761-0b3f-4659-a759-199fde90408f", "value": "Product Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c75504b-0a72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686719732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719732, "uuid": "0ad0e3da-c966-48f9-9604-39920968ed1a", "comment": "Malware payload (Amadey)", "value": "238cf0497d12aea92673762ec42afe13", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719732, "uuid": "3c51b708-4d96-406f-86ba-2c27f6142a5d", "comment": "Malware payload (Amadey)", "value": "5c9ea289c31164343a0fa158ca1cf8b428f3dffc9dcbac10d1fcd1672371ec4c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719732, "uuid": "459a06b1-5d25-450b-9866-039c6bf15cc8", "comment": "Malware payload (Amadey)", "value": "5c49e7f61d2cf3d86a6f4bc67078832bcb4a74bf", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719732, "uuid": "35475bde-1ab4-4d83-9e4c-df78d0dd1ca8", "comment": "Malware payload (Amadey)", "value": "0e3ca5b2e5e44d6b24a7b6a21017815a5aa598bc54be51183781c415019ab364a2cfaeb25c654bccc0cd717f7b6506af", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719732, "uuid": "c057678c-79d1-443e-b30a-711e45ffbf91", "value": "T16DD41252EBE44077D8B2537058F707930B7A7CF29E68839B2746981A0C727C57932B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719732, "uuid": "02732bdc-7230-4ea7-b7b3-f33c25c91ab3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719732, "uuid": "ae87e5bc-811e-4c50-80f5-e60daef3dbd3", "value": "12288:vMrly90JTFXNTmmlfQZrAZd3m3H90u8gVUlpP5wLYFsolWmIaqpa+O/1Ts7u2:6yYvTZQZrAZI1ilpP5ZVjv1T4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686719732, "uuid": "65ec0be5-5fec-4370-b4aa-d8fdc0dd821c", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686719732, "uuid": "d289a113-e2b9-478f-be27-8a8e8aa5a795", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719732, "uuid": "b6ed22c4-f48d-45ac-8a7d-e71085630539", "value": "238cf0497d12aea92673762ec42afe13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a267196c-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728386, "uuid": "1a89f18b-a890-4510-8f27-e60b0626cd44", "comment": "Malware payload (Quakbot)", "value": "2b1ab4a95916b8706f1e84dde184c6fb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728386, "uuid": "21d19080-238f-4af6-a3c1-9f50159ed650", "comment": "Malware payload (Quakbot)", "value": "5d08881aa3a04ff8fe738c44d7b2cccd96603a5c02629ce83036c6280774e64d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728386, "uuid": "afada418-b25e-4065-b8f1-a210e7d8f448", "comment": "Malware payload (Quakbot)", "value": "44754d4eb7272116709c2c58e7948af72d7cca1b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728386, "uuid": "c5ad0e4c-1e01-4161-9f79-dd21ffcc949c", "comment": "Malware payload (Quakbot)", "value": "2a8f7378c6d3484729d2374dad05a94404327635820bd97ccb755cc569a06e9e398ceb8ba4d71366958dd271620f9b7a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728386, "uuid": "9c7ec33a-7db5-4bfe-b336-48636d5ad5a9", "value": "T1487443456A40E0F18237B33BCE078410FAAB1E5B11848972B97C61595F3D86D7EBBED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728386, "uuid": "83dc2539-0db6-4e73-93ef-1f115e3e3f4f", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb/UFdMigmzMJhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728386, "uuid": "57ff5934-7d7d-4345-b69d-8ca2e20e6b19", "value": 353955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728386, "uuid": "0d0fab71-1400-4119-9db5-1f05b4c2630f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728386, "uuid": "f0c54e61-7298-4f6d-9f8b-87eed5dc3c73", "value": "WuFbcLqsftEkW.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13c5fac7-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728576, "uuid": "c52a5b53-59b2-463f-b43e-30ea02fa3c22", "comment": "Malware payload (Quakbot)", "value": "5aab1435e6416aa3c3216f403798ef64", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728576, "uuid": "388f6a4a-26f0-42df-8f5c-fe898fa4dc3d", "comment": "Malware payload (Quakbot)", "value": "5d448744eb1582b47ff56c53d927f417f5587776f097b1813bf325f8f6e98eae", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728576, "uuid": "dca653a1-6767-4460-9706-ae1977d3b89a", "comment": "Malware payload (Quakbot)", "value": "77a2b18853c92e7c870b550e9b817bf619d37c0f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728576, "uuid": "4d400051-fa09-4a02-b2ea-5b26b348b934", "comment": "Malware payload (Quakbot)", "value": "21762a37f7c51d979e48f35468e2a39302a7ae8ec27374cdf9b8a4ce373cb4ed93ea23f8dd2f6f34084d62dfd675966a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728576, "uuid": "a69eb3fd-b067-44ad-bbea-a7ced73ff93d", "value": "T1D67442486A45E0F19237B37BDA578410F9AB0F5F20848932B97C50685F3D8697EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728576, "uuid": "2127a6f1-ddd0-4e98-a916-9f2d119b0694", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbTkhxY9zphS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728576, "uuid": "073dc4ed-b049-4194-b886-ccb6ea16247f", "value": 349770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728576, "uuid": "f609f88a-f0fe-49f0-a06f-74426d5a004f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728576, "uuid": "8d71338c-149d-4e7e-ba03-d396e241ac5c", "value": "STk4TfpanD9A.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea47993f-0a81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686726359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726359, "uuid": "64cbfd65-9382-444b-b8f1-984392ed7842", "comment": "Malware payload (AgentTesla)", "value": "afc5e7940530bbd86ce718484d40487c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726359, "uuid": "bf8a32c8-297a-4326-8edb-19ae2a497103", "comment": "Malware payload (AgentTesla)", "value": "5d9023550ab2c666d9361bb72940be22b4304febbb93f21e4a93ea93748f33c8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726359, "uuid": "946577c0-d57f-488b-ab45-3d4ed35ab21a", "comment": "Malware payload (AgentTesla)", "value": "8bf13a8b058f579ee0ccccce5d97aed4919dcf53", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726359, "uuid": "0cb22d75-c6df-413a-9ea8-c5a7d8c2f44e", "comment": "Malware payload (AgentTesla)", "value": "2614b44d6798d5f330b8ae92c1cc227d717ef76c4cccd6db9ace07e5b0254874ca1ad01a489d24feb3d7cd813ed28b10", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726359, "uuid": "b2c3dc8b-4d03-4924-8246-b88e8f8da459", "value": "T1A735913E1CBE523795B4D6AACFD5882BF480E5B731226D39A4D353864316D8239C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726359, "uuid": "11c9afbd-93ee-42d0-9b7b-4bb505cddb0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726359, "uuid": "9bf38cdd-e0d0-4fe6-94a9-cc328f5cbb9d", "value": "12288:nqrOd/z8fe43vS6jsjVMZYDRq5F37Pozq03knn5oK:nrd/zJ4fSksjVmPrUzf3kn+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686726359, "uuid": "d629e840-0b49-4895-81bd-1256fa69f50f", "value": 1096192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686726359, "uuid": "6d531968-cd89-49ec-b0b4-0191980731b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726359, "uuid": "e7346c1c-52d9-4d77-bbde-8fd8539f71a8", "value": "PO0001_88474755959_0282836636_927373.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bdfb56f-0b0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686786276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786276, "uuid": "bd5769f7-7224-4ac9-be1f-513d50c00c2a", "comment": "Malware payload", "value": "9e4f9b78743e3abfaae69aa1e7984e88", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786276, "uuid": "ee3ccfcc-9582-4f66-9db6-3edd7f4b455f", "comment": "Malware payload", "value": "5e457e5fcf123fbfd252fa4380502e04fd32f80c9f64e6ed58343c4fd517caf7", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786276, "uuid": "5cdb338e-c484-484d-b974-0b8d40479fbc", "comment": "Malware payload", "value": "f018b994ffc53e926736b5174a0e86d9a92300da", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786276, "uuid": "6d8d3fa8-ead8-4f98-812b-9841bea2e7b7", "comment": "Malware payload", "value": "b8b64a6cae6190dc65ce49e831dea566691f466ee04221ec9b71ea76f3b2bf689d65b2302bc7e6668264aeff1a032880", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786276, "uuid": "beb868ef-d4aa-4fad-be93-746e36d03f90", "value": "T1396512173B948B43C5188674E5F32634A3B2AB4713B1D2933A5C42891F437E5CEEA7DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786276, "uuid": "fff05446-b649-426b-a8ae-f8d12606cec2", "value": "12288:9F//UucQc5DBtUKSwsXl02mcjh1zQ0o6x8WzjY0OXqWJmNhidriY7UxS9Md:rbcZRBGKsWZcXbhrfnjWcGrigUxS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686786276, "uuid": "3688138a-48b7-4b63-a5c4-d3f740a9c5c7", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686786276, "uuid": "f91ec2cb-4f59-4c57-9c71-5adad2d0d70d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786276, "uuid": "dfe5a585-0d53-4542-8193-cd41b3f8b41e", "value": "nEQSOORUEEOEOE0984.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7347c56-0a96-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686735346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735346, "uuid": "e72c151f-2fe7-4e73-9346-ff832d1e7118", "comment": "Malware payload (RedLineStealer)", "value": "df77b35cb83c6c05b3c5cdfa6a0f175b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735346, "uuid": "5e171790-724d-419f-8926-7fb009f5954a", "comment": "Malware payload (RedLineStealer)", "value": "5eabf21874d47792f7fd601e87fd8f98f1e9a98370e6fa3e85acda0e0ed5b5fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735346, "uuid": "a91fbc6e-8715-41e6-a362-4b3e7089a85c", "comment": "Malware payload (RedLineStealer)", "value": "27470173b004fb4d4fbb67c7edd6120772eac46a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735346, "uuid": "c49309ca-ee72-4e76-9492-04bb877118f6", "comment": "Malware payload (RedLineStealer)", "value": "e9c5c889a5c05e52af3ee56aa9758f03549d75390cc9377d62e8803ff08f66603c61b2d6b67166ad4c7c4b61590d9fb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735346, "uuid": "5ba4740d-a79d-41d9-a34a-a8b5cdfb8a9f", "value": "T1B5543AB77796DB77E5D1D0BF9B2351A9C420A8F0B2DC28CED2806B1E56201E68FF0516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735346, "uuid": "f01d61e2-f47a-4df8-bee8-5ee364291a11", "value": "bb6d69b7632b1e5c0fdd9e8372c6b738", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735346, "uuid": "168579ae-ec8f-4fc6-8d4d-d88983efd8b0", "value": "3072:uVettQwhsqzwyPE5PQcZ6qGtKY1r63fx8h0A2aH/qdBx6:uV65sqVOPQVqGr1Qf6GQCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735346, "uuid": "b043305d-8260-4bb6-8867-b74a1167f896", "value": 292473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735346, "uuid": "6968f742-ed54-4ad6-a34a-30f57efd6b7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735346, "uuid": "a85b270f-3ca9-4dcd-9001-91e7d11dea47", "value": "df77b35cb83c6c05b3c5cdfa6a0f175b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20edf575-0ae1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686767253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686767253, "uuid": "a9177b34-e2e6-4d27-b686-686c1f6719d9", "comment": "Malware payload", "value": "e5fc17dfc918ff243634f8b4570d113a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686767253, "uuid": "b0604124-c0f2-4ee3-814f-1e7105f48fa7", "comment": "Malware payload", "value": "5f309917a54b2e25b90e9efe9f69ea76ffb2374ca80729b81fd8398ff3feb6c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686767253, "uuid": "33ca6f56-469c-4a37-9064-23fbf82e6b83", "comment": "Malware payload", "value": "0f4e5a7010473384e43eec5330daed605d0b5c0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686767253, "uuid": "e5d0bedd-afa9-4f6e-8277-99c1512ca4c4", "comment": "Malware payload", "value": "d5363acf05c770adcfbcc8d96dc171527469f49defa7a60e92ed8f562a435836ba957738ec20db1ce4cbb44ed788dbbe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686767253, "uuid": "185ff117-5d8f-476a-be6d-dcdf2ecaae4f", "value": "T1A604CF1332D0E471D6725B324C79CAE46A7EF8121F78568B235C1A3F2E732E18976356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686767253, "uuid": "edbe9c31-3f54-4682-8834-a92c2436a929", "value": "770f7b0ac2b55bd6301ae3ba09608ebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686767253, "uuid": "adde6990-eb38-4c37-a52a-14065fe123b9", "value": "3072:vaDIBA9fgZvNCXw8atedWn+CR/Thrl1Gl4KZ8tcbUnVPLg:SDZg5f8ap+CR/1rl1GbKqbU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686767253, "uuid": "9fd05635-eae8-4450-9be0-797b564d744d", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686767253, "uuid": "96ceb734-f574-4985-8891-ff8fe9f4d690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686767253, "uuid": "3bfea745-34b1-4bfe-9f9d-5ba66f1797f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4b7ca7-0a75-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686721020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686721020, "uuid": "fafc2996-b77a-438a-8095-4a9d5e34f29f", "comment": "Malware payload", "value": "8d23a28705d1b85bcc9053efa5807f1e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686721020, "uuid": "aa60f9fe-039f-43bc-b522-cc561014808f", "comment": "Malware payload", "value": "5ff5c206d037458d33405184219f3001a1b58287b1bb0916115b8095ba85971d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686721020, "uuid": "47e8498c-d3a8-4cfd-95f9-dd061dc2e7d9", "comment": "Malware payload", "value": "700f3a13cd8a2699fda128b7bdfea47bec9775b8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686721020, "uuid": "a0df8eaa-3a9f-4d18-81a2-f7c51247547b", "comment": "Malware payload", "value": "02d15c0a066b5386bbb06904f421530c127f2a70b6be6f72ca4a8ef7da6b13950523231bd90d2c3c1b3f403c98bd617c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686721020, "uuid": "96b5c126-ebe2-4533-8e1e-625154e89cd8", "value": "T10646E153F853AE23C9C02839F5694948F31299BCF3C6B21B6714567DFBAE6A0C9B5700", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686721020, "uuid": "29133c63-e8b7-45e0-996c-8397461cbc10", "value": "98304:on3v2UOp/P/BNLsOATqAUpuzFD60Mq5C+:rp3/rsOAmFuzg0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686721020, "uuid": "c22cfbf5-fc15-4d82-b639-8abc2b547a87", "value": 5495204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686721020, "uuid": "8e1743ce-6ced-4a73-a2b0-3812fc59a686", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686721020, "uuid": "88a032c5-90ce-4f3b-8f80-b514294e237d", "value": "SecuriteInfo.com.PUA-Monitor.AndroidOS.Trackop.1428.28644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc6e42a-0aeb-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686771781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771781, "uuid": "8f719f17-f698-4970-999d-c5df4ca8e355", "comment": "Malware payload", "value": "489de9dbc0ef75a6979d899a8b3ada67", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771781, "uuid": "d2439f48-6054-4294-bd4e-3fe2f06bc6ae", "comment": "Malware payload", "value": "606228b3b0a422af0091f88c72420377eef80f38918187b70cd1a717d9e3058e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771781, "uuid": "ad49ed44-2863-41ac-908f-3e7736ea430e", "comment": "Malware payload", "value": "71fea119741c3ca22d63298bfbf0c943c1d54fce", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771781, "uuid": "306d871d-1364-4315-bfa1-9adc855b4479", "comment": "Malware payload", "value": "5a7a4f73004bbd5a607b0be9815b260ba779712da510211aa8b5a054d86c5540911c59c6334eb53e5ccc4c094266ae4e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771781, "uuid": "6d44873a-4d54-4bb3-a77a-b2c5fdf0005d", "value": "T1CD436BC4F643D8F5EC8705702077FB379B72E1E922A8D647D3B4D932AC52652E606A8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771781, "uuid": "8ed83a2e-b499-42de-8ac2-ba8a44ba3579", "value": "1536:JeESt/basV2rcZhG6ySN7naMRe9xzWOIaEjrqMds:JeESt/basVTgS7naMw9BtXESa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686771781, "uuid": "d4fc2895-db6d-477c-9ea9-decf91a0bb08", "value": 55632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686771781, "uuid": "cbfa87e0-f813-4813-b669-3c577d4d4174", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771781, "uuid": "b1306a73-f0f4-44a5-9af1-b30ddb2385d4", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8b0444-0a85-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686727844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686727844, "uuid": "651b5374-f5af-4466-8666-a8686c5a9342", "comment": "Malware payload (Amadey)", "value": "52407d3204f371d4ac92fab46954e187", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686727844, "uuid": "76f3adb5-c6cc-4203-b7fd-216e6d29e598", "comment": "Malware payload (Amadey)", "value": "60d2cf2c913b15b31d23cb2f16bed946692a82420df61d037a356b9b35ad2f7d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686727844, "uuid": "63181968-e0fe-4af9-a6fc-b18680d592bd", "comment": "Malware payload (Amadey)", "value": "0818eb9468cb48ce82f3aa43d8db36fb1ef68c1d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686727844, "uuid": "64e0371a-bb24-4710-a4c9-e3a099985816", "comment": "Malware payload (Amadey)", "value": "5ca4d5fa503522f26a2175827b556c4463223233327cadeb9d4fe45119dbc740d0c0af9f6e7af0bdcb1318ef79c72552", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686727844, "uuid": "7d4bdb82-553a-4804-9730-e5390bb64f57", "value": "T123051207A7D8A072DDB857F06CF712C30636BDA26574836B2B14661E0CB3A885D75B2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686727844, "uuid": "7635fbc8-bf1d-4dbc-a94d-79c5cac8c16a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686727844, "uuid": "9a6c2f94-9643-4e13-829a-afd1c2a58b1a", "value": "12288:KMrNy90Maa7ZprXSsqRgeClNXaFxWe7WFaV1JLGP4Er2AJyQEg:bydnh2geClNXarTSFaJyPyoy1g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686727844, "uuid": "2b09139b-1d50-4fb7-a3f8-a1f7ec25ebb1", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686727844, "uuid": "e89e5aa2-dae4-4217-8154-c82f0e5628ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686727844, "uuid": "55e51445-0198-4be0-8ec8-7c7bf942b75f", "value": "52407d3204f371d4ac92fab46954e187.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4322d333-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686725649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725649, "uuid": "4df5b0c3-a951-41bd-961a-da11f1d572bc", "comment": "Malware payload (AgentTesla)", "value": "63497d6424f2e225e77293f30c8f8239", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725649, "uuid": "dce94a76-8969-4a50-8e8f-72560b328dd2", "comment": "Malware payload (AgentTesla)", "value": "60e1ed8c3c6bc9d9ef48d6e2129a75c8d39deb97844ab5b17944539e4400f24a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725649, "uuid": "ccd8b31b-432e-4652-85ce-77d654cf5a98", "comment": "Malware payload (AgentTesla)", "value": "ec12986600ae5eea2a36376679da5c471812a6bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725649, "uuid": "782c91a3-0a6b-47c1-9e0a-d4a208c8c2df", "comment": "Malware payload (AgentTesla)", "value": "7801c5e671a195b7b0caa9e7b5b3cf5d51f05c21b5a7364954cbc9cfb25edff4e89dbf05a9f5edcc6d05316fec8ed0d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725649, "uuid": "3a074d78-2d61-4000-9705-5bc59a54fe9d", "value": "T1DF35913E1CBE123795B4D6A6CFD5882BF480E5B731226D39A4D353864356E8239C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725649, "uuid": "fccb9290-da71-4580-a290-c7f424368611", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725649, "uuid": "b6f37ebd-7591-4a7c-a553-59bef8459849", "value": "12288:sqrourHsI5XUJRFsYOAqIzLCY+CZH+quKi0lK:sm4I5XU3FsYjLz+CB+9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725649, "uuid": "4e727040-a1dc-4a29-b3f8-0cb2aba26372", "value": 1094656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725649, "uuid": "1545ac63-411f-4d05-9f92-78b0ba6a8791", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725649, "uuid": "f0d9af61-d27f-464f-be62-26b68b90e29d", "value": "ORDER INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53a5c7fd-0af2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686774639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774639, "uuid": "107f6266-7f63-47ed-95e7-40753b845f37", "comment": "Malware payload (Mirai)", "value": "31ec4a4c06d05388b25153b7951d5a12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774639, "uuid": "d14582b8-4b8d-4e6c-9fa7-c9e16cfffdce", "comment": "Malware payload (Mirai)", "value": "614b7412a7043820c7e0266904aa736222c9a6c8f41b8e263fead8c4121032b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774639, "uuid": "845db36f-10b0-4155-b7cc-651ba714d58a", "comment": "Malware payload (Mirai)", "value": "d48398e45efca3e91301d28fd0c1315a5b112b84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774639, "uuid": "5325d2aa-3632-4940-9439-c0ec9eac6cd5", "comment": "Malware payload (Mirai)", "value": "e8a16e5ad1593e726e675eeb4b7b1da329e26a24fd9a5c0d475b5e551eacc52c224f32c6953b1348891b06978a64056f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774639, "uuid": "0448bfcb-a23b-4833-9dcb-75d357e6fbf1", "value": "T1F3632851FC819A13C6D1127BFA6E028D3B2613E8E3DF72179D225F2037C696B0D27A95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774639, "uuid": "90c5ab02-2487-4030-b39d-b8dfe42f2b10", "value": "1536:ONKlxkmiig51kRmO//kWUztEiAsDwY8rNRuVAvvWF:ONDWzk1JEiAsDHaJvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686774639, "uuid": "965b8830-7710-41ec-ba74-349288acc83e", "value": 66920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686774639, "uuid": "d6000ade-56f0-4733-b994-2d8eaf1a27aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774639, "uuid": "6b024cbe-be1a-42d8-92d2-679f1cdfbdcc", "value": "31ec4a4c06d05388b25153b7951d5a12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc3d50e7-0a81-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686726335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726335, "uuid": "e0a887f0-15d1-4a55-9ea1-14c003a01d32", "comment": "Malware payload", "value": "0fb471b837dc537fdfe1e7b37997404b", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726335, "uuid": "21b7cef2-f553-4889-9cfb-b26f2a1a8c2b", "comment": "Malware payload", "value": "615cc7448da7e0be6ebb77fe630d28a94a195bb31afaa3952bd1f457128e4ded", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726335, "uuid": "21c7537a-df18-45c4-82ce-57ccae5adfc1", "comment": "Malware payload", "value": "c3b26000066ef07b9b705838c339aa0b3d80bb82", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726335, "uuid": "d8ddb337-a672-4cbe-aa49-2217ed9d2dc8", "comment": "Malware payload", "value": "91fa468a4e8c625bfa8d246015372d0216cf64e03ee69e48aed7ceba606cefc5c3853a43f654acfdfe6c9b5756fc3577", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726335, "uuid": "b0fa0fb0-5861-4b91-904b-164dc31b907e", "value": "T1AE940229E78045BBF44A4278F4A625AB104ABC337965ED5610C7721F2B73F33AD32D92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726335, "uuid": "75a944ca-d9e9-4f3d-a273-4fc1347a8e41", "value": "12288:K31qUu9VneR0qUu9VneG97Y48SH5qSOJn2:eu9V3u9V97Y4/Ul2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686726335, "uuid": "932be285-0895-43ad-86aa-a3bfecb84991", "value": 436224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686726335, "uuid": "5da28589-1c7a-4934-9cfb-f9098f3c486f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726335, "uuid": "54b806a2-b819-4a3b-b529-0bfc27d55387", "value": "Arrival Notice_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa332580-0a85-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728103, "uuid": "e33c6eda-91b5-4025-8e03-d26d3f4f8dcd", "comment": "Malware payload", "value": "10e0007ef54385966831f8f812b010c9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728103, "uuid": "e02b2786-511a-4f64-ac3e-4fd74613f0d0", "comment": "Malware payload", "value": "62425ee91a39bbf3e27e00b2de9c4f744bd0acf61268fec06c642e4a2ae7b97c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728103, "uuid": "8bf122ae-2040-43fd-a306-e3e3b4dd8afe", "comment": "Malware payload", "value": "57144a06df1fc53dbe6db928a10b3ded0157e6e3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728103, "uuid": "de177273-f9ae-464b-b33d-415cd2bb92b4", "comment": "Malware payload", "value": "2a162fa09a9ae0f43f8d0db554ce7f6fd659217aa8bb96f65338a7bf095ff17b18d8a658403f14d9b5426aaa000379a2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728103, "uuid": "388b7995-e631-46cb-802d-4cd8e00b3b0b", "value": "T1DF643189AA40E0F09137F33BDA579410FA671E1B20848972F97C51586F3D85DBAB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728103, "uuid": "ef347ea7-8bfb-4ce7-a6c8-6f5b91d4a8b8", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbcaKH+xhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728103, "uuid": "9177ed50-b410-431f-82b0-d20c924946e4", "value": 319696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728103, "uuid": "48d15398-fb57-4cb2-9fbc-0a27ab725604", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728103, "uuid": "ad839ca4-f0d1-445c-a2a5-4c6e846ec43a", "value": "ejFsYXhVNXm5Mx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2286030d-0aa1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686739768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686739768, "uuid": "e2189bfc-6e85-494f-b16b-b10b5196d563", "comment": "Malware payload (AgentTesla)", "value": "0d5c9c21accf41c27d556f5b952ce01b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686739768, "uuid": "11035232-1ad0-4629-8bf2-400127d7a080", "comment": "Malware payload (AgentTesla)", "value": "624d258bf73ce1512a710f417fe9bc09f649feee82527c55de7364fcbc4a9e07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686739768, "uuid": "6a8b3557-e478-4931-a8ea-c5b8b501b09b", "comment": "Malware payload (AgentTesla)", "value": "c5e0580ef43a852e2ea105c7f7d154f68e228893", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686739768, "uuid": "2b63651b-e798-4fca-b972-219147263844", "comment": "Malware payload (AgentTesla)", "value": "08d8a78a63f384b9360cb50e50970e28676088a237f1237cfafe2f65c8b04ca850a6b09f1235532eaa1223dea108cec0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686739768, "uuid": "45f2bdbe-3c4c-49bb-9d88-61c32bb06dcc", "value": "T1C6D4232C3F10053BF8EF38756790DE076FEAC9B631C87AE65E17566953E11C3A20849A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686739768, "uuid": "3e74155f-1e4a-4abf-b9d7-f69eb2809c68", "value": "12288:ri3v1ATO9bqHePK7WQ+HKlLMh0NOgbgeQFQT5JB6xU:rACTYq+SqQ+Kloh0fdH5yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686739768, "uuid": "990d9382-6456-4cce-be4f-6461d2e5d71a", "value": 634253, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686739768, "uuid": "891b724f-0bc5-43c0-a71f-774dc951d6b5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686739768, "uuid": "a540cf7b-ef6e-4ba8-9a10-b77f957213ab", "value": "open-order#456789.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04016356-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728120, "uuid": "b1d8f4c1-b27a-4e06-a4b0-428937249a3e", "comment": "Malware payload (Quakbot)", "value": "9b728245a106333434cc599adfac2de5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728120, "uuid": "8366be8c-c5fb-44c7-b604-542760dff5f6", "comment": "Malware payload (Quakbot)", "value": "62e499d8eaa32fec9c47a5c4420cd7c145f5b0be484c9f1b18334bbcde8f15aa", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728120, "uuid": "98eedeaa-a261-450f-b96d-6ec5219f8103", "comment": "Malware payload (Quakbot)", "value": "1b8244220a7f6f7bc4141489caa4315962174915", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728120, "uuid": "dc68e15b-af87-43c6-af9e-c6964aa439ba", "comment": "Malware payload (Quakbot)", "value": "6bb0215f78e7a616ba5d5c33e9029a5bc245a46f0d10408ab8d439be2094d933d6a1971d48e1f140f13e35e33ae99caf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728120, "uuid": "21d2fe0b-9eab-43c7-ac47-58288f666bfd", "value": "T1917442496651E0F19237B37BCA174024F9AB0E5B2084C972B97C505D2F7D8687EBBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728120, "uuid": "f175ecdf-cc9e-4402-8ce0-142a5dffbe31", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbctcVNkJDL7we7hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728120, "uuid": "05a610f6-e733-4cec-96ba-c7544375df31", "value": 361367, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728120, "uuid": "cc9089ac-8b52-4e83-9147-819204be6f6a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728120, "uuid": "3ac2f8c3-e2f8-4962-9357-e4a4518a22f7", "value": "e0RDWV3G9aAC.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e53038f-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686725748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725748, "uuid": "0c04bcf3-aa3a-41a3-bb0b-bcfd2c9f3fcd", "comment": "Malware payload", "value": "bf4163eaedd238e661d98fd4cfa0c3ec", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725748, "uuid": "b24968dd-250d-469c-b80a-9b48a5761865", "comment": "Malware payload", "value": "62e7f25b6d8353f0a3d466d94d6b1a107d843470def495ee8190dcab14dfd396", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725748, "uuid": "115e4bf8-f256-4c45-84af-e8232f0571d2", "comment": "Malware payload", "value": "acf4cdf2140e2ccf7344c9f2639f840ff2b22d9d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725748, "uuid": "9613c23c-78ed-4722-9628-5764a6190ee5", "comment": "Malware payload", "value": "271df0385c78a6e7cde6359e5a1ce374f610540c0c98e36aba38eb13b4e990328c661f5106346c0d61d302c008fcd1db", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725748, "uuid": "c07f4d8d-527f-44ea-abcd-61f51d92142d", "value": "T1DC7443896A55E4F18237F33BDA174410FAAB0F5B1084C972B97C50595F3D8286EBBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725748, "uuid": "d9d462bb-10f0-4fe4-9818-2e28ee7c05d5", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbNBLRiUe1UhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725748, "uuid": "6740e65c-083e-4ba3-a949-a3e65ee4efa5", "value": 346317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725748, "uuid": "3eb3a8cc-a8d3-4a35-8b51-b945c4d75066", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725748, "uuid": "db14188f-b088-4cc8-8ec2-b04279be7ce1", "value": "lFCT0hzvyoX00.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d7f541-0a85-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1686728069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728069, "uuid": "b3839311-a04e-484d-8db5-42b01ba926d5", "comment": "Malware payload (Smoke Loader)", "value": "87c01edf054abfc30aa9b3328d92e1c7", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728069, "uuid": "46ef870d-d3fe-406e-9a51-76fe84245355", "comment": "Malware payload (Smoke Loader)", "value": "62fa2bb550dc64e7768fc2da9954182675ae3675c008daba18e0fe4a4b7af1de", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728069, "uuid": "2f7972c9-15d0-4524-8f0c-a9a835b7870f", "comment": "Malware payload (Smoke Loader)", "value": "34b15a1a3f9c6c4c050d9ed636007924f173379f", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728069, "uuid": "d99b0e33-80c4-4bbc-a89c-10d5b5a0a092", "comment": "Malware payload (Smoke Loader)", "value": "9e0d6e432de53e667bcd2be0a7dd74403789bc437fe90e20cc2849452c6a38642e5dd58c10f92b1c2c402bf4bf2c2234", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728069, "uuid": "15319a95-e01d-4978-8c94-08c56c683ee9", "value": "T15B34236033205C91F586797868154EF6CEDA4B296CDE0871F9F29001AD6CF0B939BB3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728069, "uuid": "d91fcf70-a473-49f8-bf2d-6489e78168bd", "value": "6144:dJYeWP9ABZj0EesS0G2ANfJZVNwzK7WVOztJ054rg2yAI:d6HEeJ9DVNqUWKDJrdyp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728069, "uuid": "30638257-aea0-4be2-82a3-72b56077a1d8", "value": 252421, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728069, "uuid": "404cffb2-9a28-4a76-9a4b-d1533ed39163", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728069, "uuid": "e33e6418-dc54-439d-a975-43e50a8f4028", "value": "ORDER-11.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c928e576-0ac8-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686756797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686756797, "uuid": "85e2e56a-6291-483b-a759-faefbf5c11b9", "comment": "Malware payload", "value": "71bda7eea00c51262ae0533f4d5b9031", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686756797, "uuid": "ae9c89bd-d655-4263-b23d-7a68a7272cec", "comment": "Malware payload", "value": "637175bedfe6852886341e15c4d48241d7a58083a45272df0aac35469c653f6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686756797, "uuid": "a32f639a-2d26-4753-9960-69f58d8ee51d", "comment": "Malware payload", "value": "841ce84f48038933f9ea9e89fbd68a44ad120b50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686756797, "uuid": "2c396e0f-c197-4d10-b378-8fc1c1d5371f", "comment": "Malware payload", "value": "fd49d1d11f7416e7e24bc715db10e4fbb311700e510e1e3640671aaa9a9ecabddc86c85178eb89684880ee78f72caec3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686756797, "uuid": "54c3aaab-3766-45da-ab8e-4882f590a9fe", "value": "T1CF43D0D39B086B41E9458A3051EFD9377F70F680AB44879739A8A04DAEC43F1FE6850D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686756797, "uuid": "4bb2d76e-cbef-44fb-8fd8-224c0ac5f7e6", "value": "c867f86950bcf79ea0eb4d407204d6f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686756797, "uuid": "c4589305-f740-483a-be45-a3359392ab8b", "value": "1536:x36S/Ls8eLZr2eZ3VubEJDH6UsFcFHZbi9:3s1xMEJ+UsFcPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686756797, "uuid": "87aea361-ba8f-4b5a-83d2-e7ca0cabd58f", "value": 58576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686756797, "uuid": "2572f175-3879-4926-89fc-d132423512cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686756797, "uuid": "b61b420f-c5f4-4849-9749-25c78e0493a2", "value": "WirelessNetView.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a89401a-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728131, "uuid": "6719d607-afbf-4725-957c-0f9b633ffe25", "comment": "Malware payload (Quakbot)", "value": "96734daa4714b984707553ad04b4b17a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728131, "uuid": "dda630f3-2278-4558-89f7-99df8e7d218c", "comment": "Malware payload (Quakbot)", "value": "63858de90c1486d4ed0fd0bf91ddb45d8623040cd5d3c6643eddf7f95251d03d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728131, "uuid": "aed349ae-28e7-4dd6-a70c-beae33a1a5a2", "comment": "Malware payload (Quakbot)", "value": "a3770e8756aa77b268b4cbd827d3ec8c7c5006c8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728131, "uuid": "0519aa99-12ea-45ae-aa6c-412fccb1411e", "comment": "Malware payload (Quakbot)", "value": "83bcd2d770f6d229336b12d956370f8ae0c96eeea8a1341c64e589d2a224f6fc0bb34522b94a0f867ba281408bb64b64", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728131, "uuid": "070a8df5-ef68-466d-b662-b3bd1a63186f", "value": "T1A77421446A41E4F09237B33BCE178410FAAB1E5B2084C966F97C51585F3D8697EBBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728131, "uuid": "12a9a159-51ed-4e94-835a-90e83999c5cb", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbCouURxSFaPNwwhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728131, "uuid": "6ec00703-bf94-4d2a-a08f-9579af14377e", "value": 349987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728131, "uuid": "029005e3-1f89-4d19-8b4b-efeda44d14a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728131, "uuid": "c2d2bd90-c95e-4d57-874b-1cad2caf409f", "value": "drtrztxNyObC.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ff3392-0aa9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686743154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743154, "uuid": "d5996acf-9737-4e01-b59c-afac5bd4349d", "comment": "Malware payload (Amadey)", "value": "6b20dde469028ace5318ed6a9b2fdbba", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743154, "uuid": "3aeb4c7c-a8a0-4031-bcc8-08aec1c5ea9e", "comment": "Malware payload (Amadey)", "value": "64da12f22f9092d1abbe200ad1df2d5979ba687a5531c7e80517e8d11b7a3540", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743154, "uuid": "a2a67a3f-1914-434b-bd7a-7173aa4d382f", "comment": "Malware payload (Amadey)", "value": "0ebc4e35633ddebe0ef81f593dfb775cae95ee21", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743154, "uuid": "ca688972-54b7-4112-bd1d-f49e7929c133", "comment": "Malware payload (Amadey)", "value": "a24d7c247eda228d356fdda96d348acb947d75e5090b952564aa623b12e3b45d52e6bb97e4466b8c50427f8414e86551", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743154, "uuid": "68de90a7-84d0-4599-b289-f7452732d190", "value": "T1C6D41247A7C98032ECB61B709CF603830A35BDB159B8936B2386991B4DF39D0D57277A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743154, "uuid": "3e62dc0b-81fe-49bd-b1f7-602083e842b8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743154, "uuid": "e78f8158-9514-444c-ae78-db8e122e23f3", "value": "12288:8Mrcy90uT98YzoGD7+8ei5wTY14W/6P08u+GFwZJT:IyrqeoiS89j4o6P0b+GFwZJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686743154, "uuid": "14289c7d-684c-4990-88b2-ec0cb82299cd", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686743154, "uuid": "83a9c34a-5ac6-4563-974f-a60d968afe55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743154, "uuid": "90fa0761-d131-410a-ad85-b7c484d3bc12", "value": "6b20dde469028ace5318ed6a9b2fdbba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "956967a4-0abe-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686752416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752416, "uuid": "8b9eb5a4-1ac4-403f-9ea1-809b2c4420f6", "comment": "Malware payload (Amadey)", "value": "0de677bb4c9cbf4990257e4b8505a005", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752416, "uuid": "444efeba-7b54-4550-b5d3-ea1dfe2a7490", "comment": "Malware payload (Amadey)", "value": "64e512bb23bbfc6ad7f1e877eb71c5de7a9ce47104754b3575a03ae5af762ed6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752416, "uuid": "f90f7d6d-5343-434e-9197-069310c71b88", "comment": "Malware payload (Amadey)", "value": "995458b9f8a6bb6608903fabaf6929f9059f34ed", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752416, "uuid": "1ffcc69f-5098-4f3d-bcbc-a1409554c4f4", "comment": "Malware payload (Amadey)", "value": "33ef5b53d1f22585166ee6b0c52ceec0284636037f02ece4f850c8d0aa60c04cebc29e8e56213bd35906b0c98a96e132", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752416, "uuid": "db931de7-af2d-46dd-a855-94d386cd2041", "value": "T1E2F42226EBD8A861EAF2577048F213930B36FDE18C30936B2795985D6C32196B57133F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752416, "uuid": "8784da73-35ce-4bf8-ba21-b4c6524745cc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752416, "uuid": "4821409e-07a6-4fa6-ab9d-36cd5bf262d7", "value": "12288:UMr7y90HK+ugEHVxWglIjLp8qqdbgSkWG5tRTLtNYihDOztS1snDb:Py5+ugWVxLlGLp8N81Wo3EgT+Db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752416, "uuid": "b08adf8a-cac2-491c-8c3a-6a90a6110048", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752416, "uuid": "84ca4018-e899-4882-9a91-77650113e1be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752416, "uuid": "68ce02b7-d43f-48b1-bb98-3c0998774a08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80ac0cc4-0a94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686734342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734342, "uuid": "62f6329a-2bf0-472c-9d9d-f649c6a62487", "comment": "Malware payload (AgentTesla)", "value": "e8b738a2b416d5475af76ec6cd3600ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734342, "uuid": "296bbd1f-3a00-49e3-bc61-0b1e05291079", "comment": "Malware payload (AgentTesla)", "value": "65ce3474d918eead0e864e0836c87c571b545054a06b021009b20978e6c8eeeb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734342, "uuid": "db7f5790-0505-4437-bebf-14c6804eb74e", "comment": "Malware payload (AgentTesla)", "value": "0c497d2b959c861e2f28da33afa56cdb809b2f77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734342, "uuid": "bb7d3422-237b-4175-8c18-10cca93ad945", "comment": "Malware payload (AgentTesla)", "value": "6e7c335daa0988fedf47a476150a415c57447e2c9eba6055f0ad690ed1449812655a9dd985cd185245d0b21210a65c17", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734342, "uuid": "d0a28881-fac1-4d83-afde-ad3aa1f7caf1", "value": "T16AF433EFFECBD09EEE071D3926E91EB67C00BB21CC7615A9C610D2A81A48914D74E54F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734342, "uuid": "96428653-3730-4220-a9e5-a8b11730b951", "value": "12288:dAJG1VOwqL1WCcJHUebBwgX2+UPGhNnEeHsJslAph62Dx1vYwX3k4mA:dd1VW1WlvRmVY9suApY2t1vp04d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686734342, "uuid": "27da7c73-2cf1-41f6-b9b9-9cc192eb856f", "value": 747874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686734342, "uuid": "5fdfb182-01b2-4113-89ae-96009526b626", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734342, "uuid": "01b4e21a-8119-4b14-9ea7-ddbee4355f9f", "value": "MV GOLDEN BRIGHT VSL DETAILS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea7af37-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686750525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750525, "uuid": "8879febf-6d22-4aca-b13a-ca7d9da988e0", "comment": "Malware payload (Mirai)", "value": "f4483ef0683479dde35056ea818fabc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750525, "uuid": "7cc0a929-b330-4a2e-b4f0-f9541d28daec", "comment": "Malware payload (Mirai)", "value": "661e37e01b3bd6317d4e2c1c464dbfcb6c30796953b46f426a2ae74f6bfc5600", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750525, "uuid": "9d5f366b-e21d-48bf-b875-d4669bacc9ca", "comment": "Malware payload (Mirai)", "value": "2442d1b8dee416a1d5e9d406520ec2cb1c3d1ef1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750525, "uuid": "d271ebdb-d041-49bd-ab5a-a0e3d34a395b", "comment": "Malware payload (Mirai)", "value": "40741b873db8fbb2f97a1165da108b67f5663a699dfddf53c0911b5ec20ad58d6f428cd625d261c65e1fb115b2839743", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750525, "uuid": "c0685274-25c1-4da4-8ad5-8647ed4b6554", "value": "T125138EB6D479AFD4C51486B4A8288F781F93E4018B576FFA4B4985928047EFCF6093F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750525, "uuid": "63ece178-e3ea-49ed-ae38-24317e4c0b5a", "value": "768:6abs77wtLrg59RDMNe96waVlBOLcfZydh/qj2PCzogaPCKK:6a67wtfln7BOL8ZGh/q6PPTPCKK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750525, "uuid": "2ad96b89-2b3b-4e45-b298-4c347d6815df", "value": 44832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750525, "uuid": "29cc3eea-30b2-4516-84e4-1787aeb0bc32", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750525, "uuid": "07ca707c-5d5d-42b1-99d9-4035dd8fb74a", "value": "f4483ef0683479dde35056ea818fabc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "680d624a-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728288, "uuid": "86e78bc3-45a0-4695-9143-3d63e1a25e9a", "comment": "Malware payload (Quakbot)", "value": "2df55ce4ffe230bf329069d28189bd64", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728288, "uuid": "790d29df-341c-431f-8f5a-906323d21726", "comment": "Malware payload (Quakbot)", "value": "6638b909caee457d91654eceae92ac782dab981bd1b4cd9bb433b143bf5a8d39", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728288, "uuid": "21d2bad1-f0fe-4288-bcd3-1814d6536436", "comment": "Malware payload (Quakbot)", "value": "9882afefa233ddc3a7a90816ca42d84c1875a6e5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728288, "uuid": "9e7bc8b5-1020-48f2-9373-efda209ca599", "comment": "Malware payload (Quakbot)", "value": "d24890cdd1685a4b9d7e148bd3074c594b634a15eb151e2f47f850395df0bdbba3811b789a2a29c4ee223ac85852d51f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728288, "uuid": "3ca0991b-b675-457e-9a55-867bb750cbd4", "value": "T17A7443486A45E0F09137B377DA578410FB6B1E1B21848972B93C60582F3DC6D7EBBE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728288, "uuid": "93744a34-7169-4fe2-a588-cbf0f1b9cb6e", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb01JGhlMZyxAknRbLgpFjRhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728288, "uuid": "59c044b0-d020-4bdd-9d2a-04f29bb70910", "value": 346487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728288, "uuid": "7edb562b-5732-43cc-8bc0-bfd5c2059877", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728288, "uuid": "f99bcaa6-d3b5-44c9-a7bb-3e79302edd55", "value": "Zm5xOg7p7dDy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880831cc-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686750675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750675, "uuid": "72ca766b-fc57-4ecc-bbea-3bef0cd41da7", "comment": "Malware payload (Amadey)", "value": "d1013f5516431a19f6b45c085bb411d9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750675, "uuid": "be9df26a-962c-474f-bfea-f4f2ba8d99f8", "comment": "Malware payload (Amadey)", "value": "6680d911a733c4386a223223e590b8ac3d7e087789f636e774d543e7758f1306", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750675, "uuid": "5a7530c7-2c84-43f6-a9eb-227abd9a405c", "comment": "Malware payload (Amadey)", "value": "2c8147115dbc8a530c509054f85f0dd8c24ef918", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750675, "uuid": "0bb26056-9e69-4194-80ed-68bcd7a8fc48", "comment": "Malware payload (Amadey)", "value": "97461e890d977403d53b87df25394543ecacf72b5db50a8e8ac51f23b718c5f2a4bd0d87ed864c4b0ab9e7b5dc96036d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750675, "uuid": "02da079a-d07a-48cc-87a6-a9b6d4509a07", "value": "T114D4128772E4D032D5B517B098FB13931A32BDB15AB083676788994F1CB32D1A83977B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750675, "uuid": "0cbd0e19-9b19-4928-ae3c-f2cffeacaf9f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750675, "uuid": "05715fc0-7bc7-440d-8bd4-86076a98c58b", "value": "12288:jMrRy90PF7h7GOC8vcehR5H2P6EMgpmbS4wx97r2Cp5J:eyKYeL5H2PHEbSP1r2C7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750675, "uuid": "429afc5c-55a4-4897-8275-94b66f07d88a", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750675, "uuid": "1ec2b1c4-95d5-4480-afdd-75aec9d600be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750675, "uuid": "ec437b6c-907f-4742-a9e7-69aee4aeb10e", "value": "d1013f5516431a19f6b45c085bb411d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6777d509-0a62-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686712825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686712825, "uuid": "866fb421-fb28-457f-bf08-d818429136c6", "comment": "Malware payload (Amadey)", "value": "d12791c2ec6d94b0dbdc2df317e7d3d5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686712825, "uuid": "38dd73e7-315a-498e-b075-97fb1a2aa0dc", "comment": "Malware payload (Amadey)", "value": "6684f491928b560f256ac470dfd05414b2ea43b08fd294fee9e524ba7fc2127e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686712825, "uuid": "5a541f0f-ec29-4045-a55d-fc49e0f6b0a8", "comment": "Malware payload (Amadey)", "value": "88f301e6c4f7e15ec3a186bfe735db383864eea6", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686712825, "uuid": "3c8acda6-ea81-4507-8be0-b7da9f7e62e2", "comment": "Malware payload (Amadey)", "value": "a6b6e9cc9cdfe9e06047a35601c1fbc04ec78a510311f99d96883d6994eca5217ad13ade957b8c724b3fa07e75edc865", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686712825, "uuid": "965d3dda-2b26-4a3f-a05a-fcd459086bbe", "value": "T1E80512427BEC8033E9F517B08DF706871B36B8A16575D36B2288995E0DB31D2A4B472B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686712825, "uuid": "3f6cad12-1fec-44ca-b45f-52f2425d47e8", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686712825, "uuid": "9f700956-e700-47c0-94cd-3750af5a3485", "value": "12288:cMrcy90PhmrIOIUhV8oD3ZpFkbpDkjr/OMLb6QXEnG5GOrJWhWe/li4FWHK:Ay+hmMOIEDhmInLOQXEnbOrUHiNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686712825, "uuid": "684f03a6-25e1-4a97-9d32-bd06065cde5a", "value": 868864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686712825, "uuid": "dc77d8f8-9211-4d80-af01-137d43cb0a8d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686712825, "uuid": "93e9b5d3-8489-4ded-848c-3920c6cb6342", "value": "d12791c2ec6d94b0dbdc2df317e7d3d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcca0266-0a74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686720699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720699, "uuid": "41c07915-7bde-42ae-bd3b-22244da4fa13", "comment": "Malware payload (Gafgyt)", "value": "ffa231c60e47d3b9ad804e71d08fac90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720699, "uuid": "325c62f6-eae9-40ed-a244-e45a438d2940", "comment": "Malware payload (Gafgyt)", "value": "669bfdc2d8ee16d24836d56911a95a182fd1d9f44e45d08f6ccf235618457bb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720699, "uuid": "789b8da0-6dd5-4f4a-a107-4c1a2dd1b742", "comment": "Malware payload (Gafgyt)", "value": "df7e2dd8c85e206148feafcebd05198009cbc320", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720699, "uuid": "44753627-ab01-4a77-99de-b073c3ad9175", "comment": "Malware payload (Gafgyt)", "value": "88898e72fe4964d14718bd5965cb23c9244fc6a48bd673b0b7a585e47ed07b2981005db170c4cc72856f82ff02f7c6de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720699, "uuid": "2e68cb4a-6d13-4c03-bfe1-5f30d8db3391", "value": "T169730213F502382A8AFE1C9BF8114846152D1570C6E37AB9336319B27FE7A79C1F75A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720699, "uuid": "15664a8e-263d-4ce4-98a2-29c01013583b", "value": "1536:bPSKvC9Bt3aVVKiFWvs4LUGtTw8DJBVTUfvutR6dxvFUG3W:bPHqzt3a/KiFWvNLLtTZzRaIcdx9UIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686720699, "uuid": "eee784c8-8585-43ee-a482-dc8a579b532b", "value": 75880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686720699, "uuid": "a5970148-6869-4db5-9a47-880583a71240", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720699, "uuid": "a47598c6-6d4c-40f2-ada1-eec7c81c985e", "value": "ffa231c60e47d3b9ad804e71d08fac90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7138eb-0ad9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686764054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686764054, "uuid": "653ae61a-a7f8-410f-ade1-3bac093fd1e6", "comment": "Malware payload (AgentTesla)", "value": "148f2e0eabbcb2ff549ca462cdae58ff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686764054, "uuid": "14ad88a9-a756-4156-98c2-7c956902b9cf", "comment": "Malware payload (AgentTesla)", "value": "66b4079397c29474bf588016a173ceb34a8969942bb98f1fc3e32b80a43c8866", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686764054, "uuid": "1d6fce35-46ca-4f5d-842f-fad498e891e3", "comment": "Malware payload (AgentTesla)", "value": "7097bd53d997b6f78010547883f3147733d80772", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686764054, "uuid": "0a9571e4-004b-457b-b960-b0fa4b30568b", "comment": "Malware payload (AgentTesla)", "value": "46fb84f7a05cc36b864d61275ed89a02609f115210ee1496ff621896a3ce17692b45b6d929d2f24a987b95902593792e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686764054, "uuid": "adbe970b-00a7-4f6b-935a-fbc381583c5b", "value": "T11945D43D9CBD5237A674C6A6CF94B826F094D3B731121D39A8D35285862BD4B3AC313E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686764054, "uuid": "e34fd271-060d-46f9-98ce-5690ead2f770", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686764054, "uuid": "0acb273b-90df-4f62-8332-24d78c14044a", "value": "12288:ST0WYuEfq3kSmHY/97GuvKWdB0p44Iw7r:Syi3kTYw0rHq8wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686764054, "uuid": "999d0b0b-8940-4104-832e-aa9b5bec87b6", "value": 1185280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686764054, "uuid": "2cc7f8b4-ba0d-4344-8cc4-40f54f943e32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686764054, "uuid": "f7fe7f78-344f-46e3-a6fc-067ca425f611", "value": "SecuriteInfo.com.Win32.RATX-gen.11177.12998", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8daf85a5-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728351, "uuid": "97fee43a-bedf-43db-86c1-668360be2c91", "comment": "Malware payload (Quakbot)", "value": "02c92e6a6f3e11bc62d7b3ac3e16eff7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728351, "uuid": "e46712f5-5ff5-48d1-ae16-223996354377", "comment": "Malware payload (Quakbot)", "value": "67076bab342d29b913071be1cd29b60d1800fda7c0f4379f8f5adfb4e3b6f0ce", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728351, "uuid": "db3dbd3c-20e8-4bda-9a9a-cd17b7235729", "comment": "Malware payload (Quakbot)", "value": "30d5d72868c0bf4427a65f2b7859f528170865e5", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728351, "uuid": "0175b58e-bab5-4fd8-8c34-a99b559ac9da", "comment": "Malware payload (Quakbot)", "value": "36d912de0b9151341d5723866aabffab15a3bc0011e77b58d7d43c7abff8d858b2c4675c6ecb0aa5ffd4e36b52d33815", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728351, "uuid": "4c66f6e9-911f-4846-8ea1-5a1bd4f29146", "value": "T1E8745388A655E0F18237B37BDA168010FA6B1F1B2084D976BA7C54592F3D4287E77FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728351, "uuid": "eb3e7777-66c1-47b4-9ba9-bcfc9486b8a1", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbeGmhFX/vQVp+0+4hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728351, "uuid": "39e0563d-f649-4d6a-8e8b-14314f457b31", "value": 366817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728351, "uuid": "93ca294a-4cb3-4fc3-9c28-811f4ec42845", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728351, "uuid": "5703f811-c7b0-484e-b926-2c09f83bde42", "value": "YXNz2mhU2naQPU.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c97fcdd-0a73-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686719974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719974, "uuid": "32830771-9c76-4c86-8437-1281bf874bb6", "comment": "Malware payload", "value": "ca2ec7f1086f12802cc9499090a6d658", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719974, "uuid": "1f4a6b05-9377-47b6-8cc6-57dda4c27921", "comment": "Malware payload", "value": "670bc9a86f72af2ab43a89c576a4e1874ce188b35a1f5656ea27f4b7ac3d5f09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719974, "uuid": "5b6e8b64-bfd7-40a9-b2ea-1a7d830382db", "comment": "Malware payload", "value": "caddc59b04c4ba58c9bee34994ea2b16bc059577", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719974, "uuid": "ad0d4045-88a3-4c52-8555-374307e461f0", "comment": "Malware payload", "value": "4719ba52b730fb611e90b2a1389fd33be9cfcbc9ec2de75f5bd27a76b244d8d3c36b796e04bf1d8dc2cc410c0d3aa44f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719974, "uuid": "7cf2251f-a41a-4462-a65f-69d61b34a7ce", "value": "T12015C4807050E520E9AC32F65C39D4D0136ABF6A2C00D356B8F9BBEE6C75617CE5726E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719974, "uuid": "3ffa4cf7-ef5f-435a-8f0d-70f562ae4098", "value": "12288:S+09gGdGmG10cByPWYC8b7Vn3Q3mBnJPyg:oA32yg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686719974, "uuid": "f832646d-d8a1-49ba-8d21-a50ae2f17047", "value": 877568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686719974, "uuid": "5e3b2801-4bd2-46ae-937c-755c2ac92d0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719974, "uuid": "40fb1648-8bdd-4660-b7ef-f536daed6f61", "value": "ca2ec7f1086f12802cc9499090a6d658.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7bf4257-0af1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686774351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774351, "uuid": "c270b0a5-69aa-41f9-a3b8-9f69d56e9c77", "comment": "Malware payload (Gafgyt)", "value": "7386b5bcdfcf19fa99a9be5fec357daa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774351, "uuid": "345bb22b-fac6-447f-b1a8-69128adb2d5d", "comment": "Malware payload (Gafgyt)", "value": "673cac37538b6876753f1127fcbff6e9d503016594c05968de93e82d4864ba89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774351, "uuid": "9d70ee9f-5d9e-449a-b42c-0436d27af545", "comment": "Malware payload (Gafgyt)", "value": "6f1cfa3e94972119c865f1ce2acc32db33eb91d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774351, "uuid": "e23022ed-4fa6-421b-a051-de22412bea21", "comment": "Malware payload (Gafgyt)", "value": "149dde2a1dcc6944ad384b96490caaec4d17d58c249facf15a2d4dc7e78d15a7b92ef585d81df4be0301cef11432f7c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774351, "uuid": "eb7452fb-361d-4c8e-8178-2d7c7fe2cec1", "value": "T149C30A45F941875BC3D327BAE74E428C37355E2897DB33156A38BDB42BF2B982D29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774351, "uuid": "e87eddfa-677e-4467-8487-b693b6eac362", "value": "3072:hQrFRNfuLrGhEPOD07g3gNlmBoHQuQekQnYW:IFzuaEGQ7g3CmBoHQuQekQnYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686774351, "uuid": "d2d5411e-2903-483f-a5c3-ec5cbdda9a09", "value": 120177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686774351, "uuid": "ffc42ba7-da68-4cbf-8402-98e31f788217", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774351, "uuid": "7212e189-dfb0-4f5e-9972-30c8291943f2", "value": "7386b5bcdfcf19fa99a9be5fec357daa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6eedcb-0ac9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686757019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757019, "uuid": "34811ce3-9e52-4e0f-af92-4ee795284b22", "comment": "Malware payload", "value": "7451900e208450b6eb8298742bfec8f1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757019, "uuid": "f4b05a84-a450-4ddf-9214-540ac4bb664b", "comment": "Malware payload", "value": "67a1f4a1072a3e852525a29a6d0068dd54633fe2be42e10f15d07caaeb9b2b8a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757019, "uuid": "e62f5b62-0074-4e79-a535-d07eeea0bb83", "comment": "Malware payload", "value": "264d61de53b38ecd153e829d97fe5cf03689dad6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757019, "uuid": "8b927f43-0929-4b86-abf7-37ec4daacae5", "comment": "Malware payload", "value": "50480142c54d9af2ea708f60e04b0e3980eadfbd03f7cf92f11b67ec7d9aab0d15c6472eb4a9fa1b9f2f2fb65250bc4e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686757019, "uuid": "9cd5b685-0753-495b-89dd-4dbb59ceb8bd", "value": "T18E5460596955F0718033F33BDA5B9840F97B1F2B2184C967B93C54286F3D428A6B6ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686757019, "uuid": "509d771f-e8b5-42af-8b5f-82361140071b", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb7g2kT87nqIQfVX3bi8zhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686757019, "uuid": "9655ab5a-298b-4e36-a45f-dc0cbf94bbbc", "value": 297724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686757019, "uuid": "568c7468-4d4d-412b-a9f2-7d77b0fc7964", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686757019, "uuid": "95141758-ed7f-42d5-b977-97a809eeddc3", "value": "85gBuWzP3cl0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78d61bd-0a85-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728099, "uuid": "9652cc44-8ba9-42a4-97e8-79e9b2e62674", "comment": "Malware payload (Quakbot)", "value": "4abe16bb8cd01cfd141d9af59ab27eca", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728099, "uuid": "ba9b428d-8384-47cc-8778-56561c4be530", "comment": "Malware payload (Quakbot)", "value": "68dacc89f57814c2cac5cd3a53abc35e2b75bfcb7c8d84b9b33275300249ee1f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728099, "uuid": "b50f9f2c-b04c-4d51-8657-a9f73ea92231", "comment": "Malware payload (Quakbot)", "value": "7475a66a27e6be203a9d45aff1f26bf17cdb0819", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728099, "uuid": "45b93f4e-5cad-4de6-9814-32b1cc1c4f40", "comment": "Malware payload (Quakbot)", "value": "87dfca739b63c3fa78067dd666dfe423d2f59d02d4e645e7afd34dba24e1982acb6008a91a1015ae3bad3af98e6ed1a5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728099, "uuid": "d424fb83-edbb-45dc-a907-e78b400e475d", "value": "T12E644485AA51E0F09137B33BCA578010FA6B1F5B20C48972B97C505D1F3D86DBAB7E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728099, "uuid": "a1435e61-ee39-4cd9-8b3a-a6854d774708", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb2CgmE5T7IFneksmmhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728099, "uuid": "6d34c52d-863a-457f-bebf-0a3feba28153", "value": 327830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728099, "uuid": "8661d0e6-bb24-430c-aa12-4af7e74d54ba", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728099, "uuid": "5d36a5d6-8f8b-41d9-92d6-68b7cc5af5c2", "value": "eR1JzrZFCnY4V.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f39041-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728170, "uuid": "f80554ca-4daf-4165-84dd-8170656f4faa", "comment": "Malware payload (Quakbot)", "value": "2d07943ad3936ba8b759ef288aee27cf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728170, "uuid": "1f9cbe11-685a-4358-b5b0-30cc33a72de1", "comment": "Malware payload (Quakbot)", "value": "690542b74e5acf5d9e47eb3ad42afed3f2d3c1f937da9395ec6f71e3d42f9366", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728170, "uuid": "e9127f63-9d20-49d5-b8e7-42e206357d44", "comment": "Malware payload (Quakbot)", "value": "3f28e31bb1a5a6109aa68081f1d4545ecfcd620b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728170, "uuid": "6562a153-4360-422b-8417-a0288eb24ef1", "comment": "Malware payload (Quakbot)", "value": "8fba0fe4e264794683347afffae53f76e9dfe8449f66018f6644b99065b0219656256ebf842f5089d45e73f03c2615a9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728170, "uuid": "cca0d38d-0fe3-4373-a36e-202eef625764", "value": "T1C06444496A45E0F09237F337CE1B8410FA6B1E1B2184D972B97C51592F3D8296EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728170, "uuid": "38856587-be10-4bc2-a17f-920296d0c304", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbg0HkhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728170, "uuid": "a5c51508-a3e4-4fde-b5f9-3547f8222541", "value": 315428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728170, "uuid": "feb89dbd-0435-48c3-ba5d-c6cfaaee9e8f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728170, "uuid": "1e3e6bff-919d-4a82-8689-4c369e7f3592", "value": "cSnaeh4qLDCgsd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977eca39-0afd-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686779477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686779477, "uuid": "c8485a1e-31fc-4008-bacf-5d63ec2a00a3", "comment": "Malware payload", "value": "323317d95d40108aa42de6bff8ee8bbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686779477, "uuid": "04bde8ec-78d7-4789-805a-14aa2389502d", "comment": "Malware payload", "value": "695ebf4db6a46967bdecfe41ea5db0b2f96845a460f7d16eb2fcd3111f2dd36c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686779477, "uuid": "b61e8bfe-e2fa-4dc1-97a3-356f413cdb3e", "comment": "Malware payload", "value": "6e6f135129f9fa143e193970cafadf19ae4cd28d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686779477, "uuid": "58704e7b-1fb8-4a98-80b8-11fbbaf712e5", "comment": "Malware payload", "value": "992f0faed16eb4471cc4aa6bb31f339c2ff68040eb3e8f6daf5b3cb558dca99dcba68483cbc9cb06707709e159b95edf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686779477, "uuid": "ee1b8df9-d83b-411c-bc0f-1c3fa9fab452", "value": "T10294022331F0E4B1CAA653719D78C69429EFF4411B386A8F3398467F1E72390E976761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686779477, "uuid": "44e8bcfd-4075-4802-a958-e2c5f42df747", "value": "3865ca37561d2aa29b9e83d3d87488fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686779477, "uuid": "db76bde5-c152-4f95-a204-f4806e8c8e3f", "value": "6144:icdgWObGvTv2nH0r4uikBHKznOji/H08GZgtDwsnGRxTxvL:i8gWCG6nH0rxiEHKznhbFwAG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686779477, "uuid": "e6c2b9ce-e8f2-466b-ae88-8f7062dfb6bd", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686779477, "uuid": "d354e4eb-ecea-47ae-a2a2-2c624e0a5a4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686779477, "uuid": "3777c96c-9a91-49b9-8f31-46444032418c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaa73f89-0af1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686774356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774356, "uuid": "f91b5916-56fe-47da-bec0-8851a9575d80", "comment": "Malware payload (Gafgyt)", "value": "04652bab6e2b0d35ace4fdaacb8e64bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774356, "uuid": "8b62f1cc-4024-4c6e-8392-ab61935852a6", "comment": "Malware payload (Gafgyt)", "value": "6a21f0dbc386c1f6300694ffdd2051e4680a52cec66e9d789445fa8a30329db1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774356, "uuid": "b21c593b-836f-4497-a708-cbdeaa957320", "comment": "Malware payload (Gafgyt)", "value": "68af3a6a4da122dadd751cce660b8e406aa3a61e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774356, "uuid": "a420cee6-7eb5-4ea0-8bf3-3f371daab776", "comment": "Malware payload (Gafgyt)", "value": "24035a5c5cee48cf0cd3390f2d23f5b333b79295b015a078e9d2bc84486a3df08ed129f713189e22912dbae475b8d55b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774356, "uuid": "0fe917af-74ea-4378-8c8b-285ed5dab364", "value": "T1DCB328436B1C0B87C49B9AB01DA737F18B69BD7112A351C9A90BFEC04733AB81527F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774356, "uuid": "6a4392c8-fa7b-4bbe-9b08-acb802482e63", "value": "3072:WD3l+XQzPeV91310pWudJKakpNDtm2pgYMidIP1W:WD3l+XQzPe713CpWCJypxtm2pgYMidIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686774356, "uuid": "86f15fad-2ec4-488a-b68c-86d82b803c9a", "value": 113194, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686774356, "uuid": "7127271d-9e6f-4035-8275-4e7e3bd2c472", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774356, "uuid": "d3cb8c51-305f-4c9a-8f3b-7b59379dde88", "value": "04652bab6e2b0d35ace4fdaacb8e64bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81f50c6d-0aa0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686739498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686739498, "uuid": "a9deabb2-2a63-4b5a-896f-bb8e86c2c218", "comment": "Malware payload (GuLoader)", "value": "6f7b1158cf352466fc3f0207b0bc2959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686739498, "uuid": "4c354127-dc60-4cb5-8754-dad64bfcc7df", "comment": "Malware payload (GuLoader)", "value": "6a3648d9ef381db17f71b6e13ed8006fd12069183e2824b455a170afc64fa0ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686739498, "uuid": "f2479e37-310e-47c6-8ac8-b20455d40470", "comment": "Malware payload (GuLoader)", "value": "ab3f0be7e371c6810b5733604e14e1975e2e3cd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686739498, "uuid": "b3b17b01-a27f-4c95-9d06-358dfb408358", "comment": "Malware payload (GuLoader)", "value": "c696f9d886fd0431a126dff3c3de1ac4dae14131b1e85aa932630f3af3bd6787c8efe7b1db99b1f3a1bd3b97a6f4fd80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686739498, "uuid": "ca98709a-6d32-4aed-9f13-c5cb4c46c182", "value": "T14A6402127B60D933D26E0170C42B6EF24EA59D50E9506B572BE07E077E7A3C18A3E35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686739498, "uuid": "7c8dc531-7a5b-4280-9d31-4e5f062c23e6", "value": "3abe302b6d9a1256e6a915429af4ffd2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686739498, "uuid": "da1a41bd-2f5f-4dd3-be5a-4355cd8f8c63", "value": "6144:2x4vyP05yb7EuugWVZ+oYZ4X8IvMTKdfdIj+rmdd6ArMYiJWPY0I/9cCe:g4dcTbsYoYZ4X8IvtdFtodrMYjf29cp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686739498, "uuid": "6403cc08-d9c4-4d2b-bddb-2f8eedc6e8f1", "value": 307176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686739498, "uuid": "33a90d9f-0c35-4b17-a1bb-ab6263518423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686739498, "uuid": "d6eec109-14bf-4667-b027-77be8e3ac29c", "value": "ANALYSE NR.jt001-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5bff50-0a8e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686731835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731835, "uuid": "e3e2bcb4-f102-4939-9105-6e66d8c6aba3", "comment": "Malware payload (Gafgyt)", "value": "ab4e9a58c6f6dfddbc65b63c629eaf90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731835, "uuid": "e05014ee-43ea-42a4-b175-de02e29e0607", "comment": "Malware payload (Gafgyt)", "value": "6a62c3cd9240d00b3230c669b685c792a4d97f00cbb1f0a0268cf12e6ae6136b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731835, "uuid": "a40bdd82-eb61-46e8-8681-fe11bc4aa62f", "comment": "Malware payload (Gafgyt)", "value": "714dc58d3b7b325082e85ea8d13a5e613fec3071", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731835, "uuid": "0a6d04e0-ea38-4d58-9a36-f8a9f3f4f96f", "comment": "Malware payload (Gafgyt)", "value": "5d69f2454d2627eb054da2e246f54c4658325a6a9b35eda73aa5a890edd7ba6d231935b0b58067af7059bb024b925268", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731835, "uuid": "52864ba0-0cdc-409f-8156-253516e97187", "value": "T10F931A41F9408B27C2D227B7E78F439D37366A54A7DB330269257EB42BC279D2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731835, "uuid": "6314c053-3792-4ecb-b6a3-1b9e3da551bd", "value": "1536:EIkg9VQPAWeMTEb82Mm3xDKMsF0rOLcvNNPzRxQMpy2SjmokCmCVrQAFW9OXkYe:dQaMTDWWFGNNPX5SmCmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686731835, "uuid": "427c7906-598d-4c04-b0f0-902ffb38a885", "value": 97538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686731835, "uuid": "537b0e25-0a94-481d-babc-b5103cb47985", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731835, "uuid": "4dff88e1-69c1-443c-8d70-ea4e224f94bd", "value": "ab4e9a58c6f6dfddbc65b63c629eaf90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aeb30bd-0a6f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Renamer)", "timestamp": 1686718360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718360, "uuid": "70286692-2a53-4e40-87e4-a75ef64597da", "comment": "Malware payload (Renamer)", "value": "e5b5e32e85c6042f806b41a76d531d31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718360, "uuid": "eb2dca9c-ba81-4063-9d82-1fbdf3b63ddf", "comment": "Malware payload (Renamer)", "value": "6a91a4a5a664c0f29503d946eac14710ea3bb1008cc6796bc42ea27bde6ed08d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718360, "uuid": "fdeaa9db-0239-43c6-ba09-bd306e6fd0fc", "comment": "Malware payload (Renamer)", "value": "28f560f9f5efbaba9646a69695a4c2092241741d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718360, "uuid": "5eba7f51-b6e8-4981-9f25-54b3daf3983f", "comment": "Malware payload (Renamer)", "value": "80d3d132413ec9867164fef4129c28997e7fda11b470e6e524f27ece415f694e33763bff272a28afd3acb08a424faafe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718360, "uuid": "471955e0-e6bb-4651-8187-5756ba520f01", "value": "T1FD75010B9EEB117BFC552B71D025587310FBF9F60E464722F6E4E60D2A30FA166384A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718360, "uuid": "c661abfa-aae8-4fd9-b5ac-4a12fe9d5f93", "value": "2f095340e94ca508e3b83fb009ebf4cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718360, "uuid": "2b5a02ce-44a7-4bd2-b9ca-5dcc89dd3da5", "value": "24576:ecCT67wHqWis4l+jIACFr5hqjiLDpSJDN93pqb6W8cU4gLQIA:3Cpn8t74iA3qb6W8cU4T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686718360, "uuid": "e7e56799-1330-45ad-b1a1-73e1e3cbe699", "value": 1576960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686718360, "uuid": "e42aff18-08f3-4538-9ed6-3670192f2157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718360, "uuid": "2c949c1e-7bd0-4f48-840c-c9b0b4189ddc", "value": "Acil Fiyat Teklifi Talebi,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bc622d-0abf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686752849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752849, "uuid": "715dcdd6-5e5b-491b-8a98-617a82f29b88", "comment": "Malware payload (AgentTesla)", "value": "a48046ae62ad46d9aa421b789f6c6c68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752849, "uuid": "cde49eb8-fd2d-4365-b1e7-4102978cb688", "comment": "Malware payload (AgentTesla)", "value": "6ad03e07e05fdb46e4979c733584caa6122cff52bca488a9f098525a4fb349e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752849, "uuid": "deef0384-dab2-4cd0-ba79-5d052aebe68f", "comment": "Malware payload (AgentTesla)", "value": "ba418de1604b1d0b2524f81409775d0462ddc994", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752849, "uuid": "94fc3ac7-e5e1-4ced-b619-156ef51ed68b", "comment": "Malware payload (AgentTesla)", "value": "01b5b339778480aa264aa802939571f392d1dc57185ab790563c32a92f96717b6867af423461fe4470b5c55c7dd40b6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752849, "uuid": "48a0ca73-7aaf-44d4-b346-86b8b103819f", "value": "T1A3850211F2966C6EEE858B38D9A3309A841D7C677D8DD8002345372E2773BE29A3774D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752849, "uuid": "9fb36f1b-fe61-4e2d-8c45-75d37a958ca3", "value": "24576:9u9VWDluSyIqEKFGpjRP/7u9VzfKIUeFGpA44E60naWsyNZs6nf55y0zI/I:9uOkwgGpxDubi9sGpAXEzs+K6hpzI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752849, "uuid": "ecf98c7b-9565-4f33-93e6-3266a02035bd", "value": 1741312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752849, "uuid": "b5605dd5-9ef9-41f5-a82f-fd14fe91fd60", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752849, "uuid": "3dda9699-856a-4fd4-8d0f-14c95b22309b", "value": "swift copy.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9808007c-0a66-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686714624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686714624, "uuid": "d95c30c0-071c-46ff-a5ec-193612edca4c", "comment": "Malware payload (Amadey)", "value": "3dc37326a9866845c43bf5314f5bddc2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686714624, "uuid": "54a2623c-fab7-4517-b5d8-a78b6d7426dc", "comment": "Malware payload (Amadey)", "value": "6b0b70b1849ca2913ca4c5cdc390691d23194123807a39e99240af81485b5bae", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686714624, "uuid": "f8369d6b-b91b-4f77-839a-20da94f58fe7", "comment": "Malware payload (Amadey)", "value": "1e2c7f445a105cdc6427f132261cee51e4062ddb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686714624, "uuid": "134d7cad-73eb-46fc-84f6-9025945b9ed8", "comment": "Malware payload (Amadey)", "value": "ce0983bc71b34a7d9f6e50a7c56387a0f63a6d2f4916ddf21c5e29fff1a08597f6a88a181e24ffcdbabbba498a81e141", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686714624, "uuid": "a5ba6d9f-1d0b-4dbb-8996-5512458db965", "value": "T1C3F41262FAE880B2DDB1177058FA138702727EA1CE74C65627825E9E1D73780B935B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686714624, "uuid": "197957d0-c84b-4a55-b38d-cb50bafed132", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686714624, "uuid": "c89b6353-3fad-4a6b-a9a5-924e7f822144", "value": "12288:AMroy90nLS+91VNFN61tWHw5iHdB0TL7oqSNsz/EJZ:4yyLSW3N6WQgEP5csLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686714624, "uuid": "e047dbee-432f-496f-b8b0-593e40b414ed", "value": 793088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686714624, "uuid": "016e0910-fd8a-4250-80e1-beb6fb5c2cbb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686714624, "uuid": "f50c05c1-c678-4529-91b4-c00a54006b86", "value": "3dc37326a9866845c43bf5314f5bddc2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508cb71a-0aca-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686757454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757454, "uuid": "0af8a905-b966-4f27-9665-e8f3e5dffaf7", "comment": "Malware payload (Mirai)", "value": "4909028c45935696fe92304477bd6dda", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757454, "uuid": "cc8690ea-35af-492f-b1ca-159ca47c7585", "comment": "Malware payload (Mirai)", "value": "6b0d30478b32878b697d45902bb3bc20097b4ed9d2dab2bf4e189b44714fdb8e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757454, "uuid": "62d53dd6-5191-43d3-b4a4-d9eb01ba7a8c", "comment": "Malware payload (Mirai)", "value": "c96585b8fbe8205fdfe1fad5e21d6cd0342eadeb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757454, "uuid": "e69cabb2-40f9-4c2a-8960-a5fe61f66606", "comment": "Malware payload (Mirai)", "value": "2c42a5903b072392c250c8c55bc76bfaa7489ec0416dca31ef26242f2c9189d5177046be53ecd57ec8533a29b2cde130", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686757454, "uuid": "aa864d89-dfb0-4a0b-b2eb-10e185f3f327", "value": "T1A8D2D15A830485F6D888D03719B50BA52E3B1F67F1569E074981DF73BD4B0B63C636D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686757454, "uuid": "6733f1b5-e503-47e1-8403-5088f880e831", "value": "768:3NuvhBsj8ScJe7OEjwhYkRkrCRgyt1u7XLFu+JgGlzDpbuR1Ju:32nSgNGkR+Mgy67ZuqVJuo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686757454, "uuid": "90316ff9-f720-4551-908d-c43098729ec0", "value": 30196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686757454, "uuid": "0975d29a-f163-4326-b081-6c665dcd7bc2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686757454, "uuid": "0197363b-d557-4be5-ba9b-00cfa1cd314d", "value": "SecuriteInfo.com.Linux.Siggen.9999.21194.29173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77fae28e-0a8e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686731750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731750, "uuid": "52666b64-4363-40ea-99fc-ab6b76dedfe4", "comment": "Malware payload (Loki)", "value": "59faca2b106ffbbf0de9f81570366c0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731750, "uuid": "1cc5826a-b008-41a0-b1ff-5abf8aeb6df8", "comment": "Malware payload (Loki)", "value": "6bca58addb046d0aa13c6ba57457f8fb50204047d642e38f6c09fa17616d5ee2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731750, "uuid": "a11a4f90-0da2-4a5e-bc71-0058e1340192", "comment": "Malware payload (Loki)", "value": "cb199b7470ef8273344746b60b0f18f45382a9a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731750, "uuid": "65d08b17-1108-4fac-9d5f-d746106e4a20", "comment": "Malware payload (Loki)", "value": "15721c3ce2ea6462987b8157aca5790ba922c32cccbcf97054afe48c2ba11925cc8a71263a4995428abaa2025333372d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731750, "uuid": "44c54f37-6bd6-4cd7-bd46-327959dfcaed", "value": "T15E34AEC4FA4085A1EC2A57712A36CD316A537C3D94B81A1C3FCE3E7B7EBB052A41A553", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731750, "uuid": "6565a613-3d20-4f60-a381-fc0d7000b0f7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731750, "uuid": "c75223d9-bab6-4532-b246-f7f89f9525dd", "value": "3072:dfY/TU9fE9PEtu8MN6bAzvRONe4HXAOad18fq/FHot2WGhkIk2aV9s:BYa6yIUIJxRZfIkdhhJaHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686731750, "uuid": "b0b35193-0ccc-4463-9d56-de8b53e0efc6", "value": 235818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686731750, "uuid": "4086ac91-8ac0-4b8a-acba-04718c5ab73a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731750, "uuid": "37477e8a-86dc-4564-9adf-ba197e1353e4", "value": "SOA for May.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fb71e6-0a72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686719914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719914, "uuid": "4a6f0a47-f50f-42f5-ad69-bbb4326e76b8", "comment": "Malware payload (GCleaner)", "value": "10f0f3045dd1ab32dffd8b39683f4bab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719914, "uuid": "e821f3ee-2db6-4fef-a06c-2947dd5ac005", "comment": "Malware payload (GCleaner)", "value": "6bd31462a62892b138909ab742444160c1c11511a2276a7a6ba53759f904b964", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719914, "uuid": "e6f35b55-9fb3-4856-9b05-cb0f88cb220e", "comment": "Malware payload (GCleaner)", "value": "1bdb4c7e85706861cedaf1c29b0d07033a88c824", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719914, "uuid": "323b8e1c-b43d-42fd-9866-1128767fd1dd", "comment": "Malware payload (GCleaner)", "value": "57ad9381a3712159ed407680d92c2350384557d3e0bc8cc05a5d9ddfc902e756633c2323740401f69f312b5143fc3f99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719914, "uuid": "4c670819-c63b-4e3e-8021-cbce68acb061", "value": "T1CB54D05139E1C832EBF765304831D6A91A3FBC336631958FB2A42B2E5E227C15D713A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719914, "uuid": "0e963539-81c3-4240-80f5-8602aba9a692", "value": "01fc29f6287a25b9bdcce5f6d1717e68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719914, "uuid": "df1c2af4-a751-403a-b04a-c10403d39787", "value": "6144:8eGHMmWyohTSwa4RK+p0gjZmqXxqqvbTT6sVD:8XTJtEjp5AqvbT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686719914, "uuid": "45af0b63-a965-4b78-96b8-8a3d95bb8109", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686719914, "uuid": "eae9d87a-a378-42c7-bdd3-aac8d72bcd5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719914, "uuid": "0b12cf83-5c03-4b88-8c9c-2f9ad6ce0462", "value": "10f0f3045dd1ab32dffd8b39683f4bab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "529fe9a8-0ae2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686767766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686767766, "uuid": "4112dd65-702d-4512-81f7-1968dc3c95e6", "comment": "Malware payload (Amadey)", "value": "4c9c85701431824cd8b5947145325855", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686767766, "uuid": "7603c70a-ac9d-450a-a333-f1ab09d1b1e1", "comment": "Malware payload (Amadey)", "value": "6c102bdf20c648408568a9d7dc2688f1d18ff5f5cfcb5945bae9132dcbc1494e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686767766, "uuid": "3edb1ae7-67ad-4b2e-87c4-3f53362fa998", "comment": "Malware payload (Amadey)", "value": "73986fb0347e2de4289a06e66c47dd6285e25d0d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686767766, "uuid": "2d264604-8c22-4ba3-b05e-f245f51b4ad2", "comment": "Malware payload (Amadey)", "value": "8952659fd7dcc1b6d331b4cda3f5fab7e6affe78ef845576cbef09de36812c11d147ec69630f13b16287632c9c08b05e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686767766, "uuid": "fdda836e-d380-408d-83be-d62a8810488e", "value": "T1C9C41222B7E89076D9B6277418F742C71B3A7CA15878839B2745AD6E0C727C0E53237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686767766, "uuid": "7a41a6bf-30af-4f0d-a500-edc013e7fc7c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686767766, "uuid": "3e2378c6-1a48-4b38-82da-2169e085c8a9", "value": "12288:8Mriy90SHDNdrUDJ+q3SGhux6SWPf+XR4ZbdMCgWqm:eyxUDJwx6e2v1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686767766, "uuid": "2d937ff4-1fa5-48b6-b101-3cf05f551b92", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686767766, "uuid": "34f22fab-b278-44ce-b040-67c19e2445a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686767766, "uuid": "40ebc942-9d71-46d3-8443-f7aeb2116e47", "value": "4c9c85701431824cd8b5947145325855.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1de3d0c4-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686728163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728163, "uuid": "c5822afb-3062-497b-844b-88d5daa3c33d", "comment": "Malware payload (AgentTesla)", "value": "afbf4e8bd40ed0c718901278efc59bd6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728163, "uuid": "2f251f1e-5371-4ec0-b004-b0618d3642d6", "comment": "Malware payload (AgentTesla)", "value": "6c1883906e4f5dc4dcd4b8ee62171ac7c708748c0718a8a3b992626a0fe9eff5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728163, "uuid": "1d007b93-38a8-478f-86a2-14066bc1fbca", "comment": "Malware payload (AgentTesla)", "value": "c2b815a35416926661aca19067f168d19a459d4f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728163, "uuid": "a9fbf817-dea7-4370-9ebc-44036b891604", "comment": "Malware payload (AgentTesla)", "value": "5c3e46721ba78d6d3cee30caa83fc59728383e95779b8ff09dd821ee4750ee31837db31c96319d0845bebb2bce93a4d1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728163, "uuid": "4bf14dd4-7f06-42ca-8d54-58980ee6abbb", "value": "T14CE42302CFB26D3415CC1217B2DB8B0ACDB55D6834766A4687EBA234025EDF22739D7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728163, "uuid": "d1c8300a-5a7c-415c-a0f5-1fc891a5f35b", "value": "12288:47qXGQo9y4i7peF59HVNgmJ+ew17sZePpYpwiu1nKT1sNwT:4Ao9Ti7paHbBJfwRXPpzib1s+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728163, "uuid": "6a8fce12-fb00-457c-9f94-706b841a67ec", "value": 721286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728163, "uuid": "6008e9ea-9dd3-4608-bb1f-9afa4e95552c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728163, "uuid": "f612d860-5f40-49bf-a321-3571cf11f6f2", "value": "bill of lading.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c2e926-0a73-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686720016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720016, "uuid": "d46fe568-6bed-4307-8080-f8978d0dc829", "comment": "Malware payload (GCleaner)", "value": "24a907b837a061bc66cb959e662bc20c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720016, "uuid": "809d38c9-4417-4492-b346-ab9e2b02babb", "comment": "Malware payload (GCleaner)", "value": "6cccba8375557524965dbaf81fbcca57272b01b8a4bf17620b3f8ed7171d2ace", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720016, "uuid": "d38d80c1-55c7-4a60-bdab-57a137757072", "comment": "Malware payload (GCleaner)", "value": "2a3f1908d2f27d91320548a55b0c0d340dc338c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720016, "uuid": "0b029d09-bca3-48f5-8de3-18a21ef085e8", "comment": "Malware payload (GCleaner)", "value": "557cf760006ffabc7c7722ea56598390802e16da9c4fa6f0163fbcfa38d31ac184e4c99206e13624f5e5615c4cd93e50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720016, "uuid": "1e83575f-b6ad-4d58-8174-f7b2f02504c0", "value": "T15744DF5139F0C832E6F3A8708972DB90AA7BB9776634C58FB664166D1E323C15E30397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720016, "uuid": "0e91f2cd-0847-4566-90fe-57a3b3668cff", "value": "293e47a0cfedd1b59c93e4a7e35003a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720016, "uuid": "2b246893-76e3-43ba-965a-fd171bbed78b", "value": "6144:PdHunagyBdlMFasz601UGraRVbRzXDXkzva647:lUaPBdy36qLMbRzXbkzva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686720016, "uuid": "9411c561-96be-41f1-88a6-156683f0eacf", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686720016, "uuid": "65015bb3-7211-413f-8968-8ffce22fe71d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720016, "uuid": "0e9945a1-55b1-4a4f-a915-21c9cab7dfd8", "value": "24a907b837a061bc66cb959e662bc20c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f6211b-0a72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686719876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719876, "uuid": "e029facc-737b-4f0c-afc9-a3eaa3c944a8", "comment": "Malware payload (GCleaner)", "value": "8cfdaf2e1624a68684bac7614df5f89a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719876, "uuid": "ea6af10b-dc55-4afb-9b2e-33307e38198c", "comment": "Malware payload (GCleaner)", "value": "6d2c41908f0cea05a9e5fac530eb9dfb103056c86ef8740859d9036ec71ac03f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719876, "uuid": "1b5df5d8-f8dd-4101-a72d-e18b5652f430", "comment": "Malware payload (GCleaner)", "value": "97a6fef6e63e775a81219c18a63411d9624b74dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719876, "uuid": "c7fb7885-dfcf-4529-9bc8-60ac5b7c00ea", "comment": "Malware payload (GCleaner)", "value": "88286186f322f7319d7c84731d6c3cc7d1bcbcfd4e8b5393aad3340a3623e6049d5d69974569039ac0a96323e4bbf455", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719876, "uuid": "dd89bf13-21e1-4313-8e15-86365fdfb63d", "value": "T15854CF5139E0C832E6F765309931E6A52B3BF8736934894BB7643B5B6D322C26E71343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719876, "uuid": "625dd384-3ab8-4d3e-8467-634174467048", "value": "13ff58a820131ae2091edac08aa4dff2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719876, "uuid": "3cb7c7ff-ae29-4687-a5cb-a0723951553c", "value": "3072:UJ/SwfmqqM29zMGRQ1s8bSqv/aztnlx6KCyoo+S0npXbGaUg/8+x+sUGw4iRMF5R:smqqM2REfyZ/6KJod9ZbeUT/K4ilZeO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686719876, "uuid": "9997eae6-3ff9-4eb0-96e9-ee3b59962909", "value": 286720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686719876, "uuid": "902d6f33-7a92-4c3e-ab72-adec916994cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719876, "uuid": "5c91d294-049e-479d-9b8c-50a1b8227e04", "value": "8cfdaf2e1624a68684bac7614df5f89a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a5867a9-0a93-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686733875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733875, "uuid": "034a7aa5-5498-4bee-ba81-540bf3008bbc", "comment": "Malware payload (AgentTesla)", "value": "55c6392ac12e6e53b5815ddfab012bce", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733875, "uuid": "4debe84c-ce08-48c0-8f60-d75bf2ac034b", "comment": "Malware payload (AgentTesla)", "value": "6d731cdb770865654178d35ddd42ed30c749311de73924037707997e363e0bb0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733875, "uuid": "6164fff9-ad7d-4986-8671-91a821b39532", "comment": "Malware payload (AgentTesla)", "value": "5d09caa39711dd5810b7f1682000362bf2cafae3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733875, "uuid": "0ee4527c-db23-49a2-a7cf-178de8eddad5", "comment": "Malware payload (AgentTesla)", "value": "33c8a9c9aadb565ec7837155940352e251e56b595e12fca19d2050d6f30e34b7a6352ac817e24f851baaf17e5b1745d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733875, "uuid": "c79cc62a-4c35-4afb-bd5f-0a0389139e58", "value": "T152541288A304E5D7E0932BB30E77496B1BFEF81154F8358B2789359EB923551441E3BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733875, "uuid": "27a1f815-1746-4177-9387-6ccd261d7681", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733875, "uuid": "1ac599d3-6d68-43ea-a103-32c9148bef8a", "value": "6144:JYa68Xqne5RVZMsTnw0/ykGimcLwW0siBxO2mwC3uMoRfjZ0VOLQzWXk00fH:JYOqOVc0nLbcVBxvrCefSOLQzW/GH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686733875, "uuid": "fb9e0587-f41f-4e40-8b5f-b35e8793fac8", "value": 296635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686733875, "uuid": "ecc07f4e-45a8-44b9-b4f5-8e423ea5be81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733875, "uuid": "dba9cc67-8921-4fa0-9db3-42de3eaa7d24", "value": "00000915862.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eacd3da0-0a93-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686734091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734091, "uuid": "d619a768-1dbe-4c7b-a6c8-cd227803a6fc", "comment": "Malware payload", "value": "1b8eaa78a77b38df3c8d520bc84b0535", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734091, "uuid": "8ce825ab-0cdb-4934-9d7c-1abaeb694879", "comment": "Malware payload", "value": "6d96e580d329fa4c44cf3044b02185e505df20ed8195864d0af55d52fba2d438", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734091, "uuid": "422e8be4-3a4f-42e2-9be4-a0f528050734", "comment": "Malware payload", "value": "7adb0bf072a34d44162aa983c27bbde3af09f377", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734091, "uuid": "53f83c71-3222-490a-a17c-0ebb5602609b", "comment": "Malware payload", "value": "f1b8b8321a535fbbbe56d22fac6a8802c9576e79e14591794a1845dbb17d4173df1b3e8fc95764fdc69f154673ecece3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734091, "uuid": "c4fa721e-cecb-4535-bd0b-890b1793bf16", "value": "T1B7646B5EF1E9B5E5CCF3E0B8C1BE8696FA75340D43A45BF723924A0429837E15238B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734091, "uuid": "629ea6e9-780e-45da-a165-bbc0afc13c31", "value": "11a1a39236b21f26901723638d814d07", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734091, "uuid": "d596cc3a-5ad3-46dd-9ba7-8929c063cf67", "value": "6144:5xb8ZqekwkREHYuRP/4Th3gpjMl6x/Vlhg2U7V50DErMEhoI1+hRRw9mX:5xb8ZqekwkJPaThgyDChXohRRw+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686734091, "uuid": "2faf739a-9450-4b80-b64c-f2bc2a8485ff", "value": 320531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686734091, "uuid": "a83a96fc-27a0-4aba-a72f-185cba50b241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734091, "uuid": "02a3da60-7cb6-4bc6-a715-bdbadb65d6c6", "value": "34324543.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3fc2fb6-0ac3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686754722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686754722, "uuid": "cc979011-f896-41e6-aca5-a9bec21538ee", "comment": "Malware payload (Amadey)", "value": "e6ab640c5271a1c4dda09a46e63aeb81", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686754722, "uuid": "68a2d4a7-82c5-469f-8359-51b99160a011", "comment": "Malware payload (Amadey)", "value": "6d9865345877c9d57b7589392d8870ab7a225287606b9e2019860737cd5da4fe", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686754722, "uuid": "65a60d46-2c7a-4157-ade4-4b264caab5f2", "comment": "Malware payload (Amadey)", "value": "aac907437f84098fec291732b5ac05c49217b0f1", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686754722, "uuid": "ef50260f-a490-4ed9-8ea7-206429df5039", "comment": "Malware payload (Amadey)", "value": "e6188fa4491386e0a299d2f28d3d7938973b1bfb038eb5c2a9f355a1dbfe5cecd72dc91e2aa8c2b692c136546800f54f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686754722, "uuid": "0693cf5c-4f24-4d34-84ba-2c192f56fac4", "value": "T131357C1BA26601BCD4BB9178CA274A46E775744603309BEB17D05AAA3F13FF16E7E310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686754722, "uuid": "bffb1395-ed94-48a9-8bb3-2a28237adaf9", "value": "7440c982ea49d693b3f3d5cb31294fdf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686754722, "uuid": "ac1848e6-2488-4e3b-a71d-40a2bdc40e00", "value": "24576:KMq/RX0hoa8wrC+azFbtZhUYFauTZyRMws:Kioa8wrCHz3ZhUYRA/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686754722, "uuid": "3b0d78ee-926c-4ac2-ae84-6f1134132051", "value": 1088512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686754722, "uuid": "c9ed0c85-ae41-4e6e-a8f1-9d18f1de113a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686754722, "uuid": "67841d02-5786-4888-8fe7-e7f04430bbd4", "value": "e6ab640c5271a1c4dda09a46e63aeb81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4195ac-0a6e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686717930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717930, "uuid": "5477260f-40d1-46dc-b366-b4f32f5a0508", "comment": "Malware payload (Amadey)", "value": "e8a748dc4258ab7ed394f3f94d4720b2", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717930, "uuid": "74ab22eb-649c-459b-b082-26a8b02377ab", "comment": "Malware payload (Amadey)", "value": "6db69d1dbd4dbe1108a05955d03052864c7acf3165d0ddbfad7e4156c37a0bd8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717930, "uuid": "752fd988-24e6-42a6-91df-02ebbcdc3f45", "comment": "Malware payload (Amadey)", "value": "40a86b5812a2b8be9c0e69cfbeb75dd22d1b657e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717930, "uuid": "bc81603c-bf0b-4f71-9ff9-9533d6b22b13", "comment": "Malware payload (Amadey)", "value": "9fd3c0d4cedeff5e55768aab237818bf3d3339adcf5743491c6d1a60d71e0bf38925362a1a9cadb6cb491f40fde54e4f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717930, "uuid": "6c2d6192-32bf-477b-a566-10060c60db10", "value": "T16F052223AAE48831C9F52BB4D9F317530A347CAB69785A2B17467C6E08F27D1E43135E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717930, "uuid": "7b294fd7-240c-41af-8727-40d4b2a378bb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717930, "uuid": "ec548e06-c70c-47b6-b503-3efd24f5dc38", "value": "24576:zyzYfeQLXESxS/vPtUs2weMHCB5yYiK+:GsTXXxSudB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717930, "uuid": "cf0fe92d-35c5-4f9a-944a-dd28b388f2b3", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717930, "uuid": "0dc75851-4f2d-4508-b2e2-afbe7b38bbc0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717930, "uuid": "9b6b7161-1e26-4bea-9590-b1358201dd16", "value": "e8a748dc4258ab7ed394f3f94d4720b2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953b77f0-0ae2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686767877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686767877, "uuid": "72d1ab14-6191-47f5-9e97-8cd6056c5e46", "comment": "Malware payload", "value": "8f3fcef426d76e2635646108b38ee839", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686767877, "uuid": "030d8501-069f-4a09-9f07-203b9e8c5d42", "comment": "Malware payload", "value": "6e1f1acde46206aeec80aff2847e28c13ba4a968cfc1f2f796039ee2abdd4427", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686767877, "uuid": "5a91e9e0-eac6-49fd-908a-5dd7f71e744c", "comment": "Malware payload", "value": "ef2527a7e4733f68bb9902d246dbb5cc23c48fb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686767877, "uuid": "77b57e98-6d70-406b-b71a-0facd6369f9d", "comment": "Malware payload", "value": "6e7dfc41b4d46d45c21c7bc5241167514c2945402264bca55e5e8943efd7675476c59e57c052778a9f0c0500d8ae0f91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686767877, "uuid": "0fdb76aa-997c-4084-9943-44f1499c8841", "value": "T13B54E1A231E0D871D5665B33C879CDD4266EB8012F746ADF33681A3F1E732E18976385", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686767877, "uuid": "02f6ed19-841e-4023-8555-a77021ab2f21", "value": "770f7b0ac2b55bd6301ae3ba09608ebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686767877, "uuid": "a7046edb-ddea-4ec0-bae5-94922369dd9f", "value": "6144:QYu7wB6+xV1UPrroh6YAKWpZOnsvmwIqO:QP7w0+hWreapZOns0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686767877, "uuid": "545c8ec8-2a83-4c2d-9973-28fb95d0184a", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686767877, "uuid": "b3186412-b64d-4845-9d33-9cd04e9203d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686767877, "uuid": "a4d2e0ff-ab87-42f0-a6a7-ad1f329aad45", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4f7d75-0a96-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686735303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735303, "uuid": "7126132a-19de-4676-9566-a18d2da6fe68", "comment": "Malware payload (Mirai)", "value": "410c4eb880b67adac6cc3d32c117100e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735303, "uuid": "242d9119-f7a4-4560-8059-25d7fb24cfe0", "comment": "Malware payload (Mirai)", "value": "6e89758529ff8eea88c019fbbb077ff40208b53073994f1c2809cc50c0b4e5d5", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735303, "uuid": "ba4b90d6-9842-44f4-97e7-0731baf4f0de", "comment": "Malware payload (Mirai)", "value": "4ee729b90a01f14e3761977baf9657fab00d4501", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735303, "uuid": "571f01be-97cb-4088-ac98-2ca20cf51044", "comment": "Malware payload (Mirai)", "value": "62102b650207f2933e0e9ecb568307d6ddd99b896809a87c33d6f3f69c13d183dfcc936b4cffcea6bb700d388320fafb", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735303, "uuid": "cd6dd9f7-55a2-40b1-9457-713ac18dcebf", "value": "T18F330903E856C0F9D45AC2729D6FD533E632B9BC5130796B0788FA722F29E31965EB40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735303, "uuid": "3601f750-3a6d-4f30-a9cc-47909e5b2bb3", "value": "768:CgplhD19+0yAuhIlCmCRP0IuYebtkaBLtR40Nj5UEr:RjxyUCmCRzL0JtZNjZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735303, "uuid": "8970ee70-fdb4-4df7-b680-d4e2b523fb1a", "value": 52368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735303, "uuid": "ae6aac76-d3d8-4d06-8d55-4d8d58fd1c9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735303, "uuid": "1a1193e0-8ff0-44c3-bbfb-0945da9daf94", "value": "410c4eb880b67adac6cc3d32c117100e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1123d0b9-0ac0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (STRRAT)", "timestamp": 1686753053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686753053, "uuid": "49fd5736-7180-419e-955b-54189eb9735b", "comment": "Malware payload (STRRAT)", "value": "36aa904fd0eea38ab2078d7531153032", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686753053, "uuid": "e9e3c50a-a6dd-464d-a0a5-c03f5532b5ba", "comment": "Malware payload (STRRAT)", "value": "6f76388b57849bcf5f7516bdfb6971414b1a0a3df11a168aefa88724cb23a5fd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686753053, "uuid": "55028b34-fe28-4d85-b725-e5a0f14e2831", "comment": "Malware payload (STRRAT)", "value": "fce08032a06a9b45e500a673833783985eb48491", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686753053, "uuid": "d68c216f-2e08-4a6b-a975-344d44cfb13f", "comment": "Malware payload (STRRAT)", "value": "54d8d2636edb3761f5b25d33343d92fbe68697ee265ba48b314dc3dcaafc2c98642e3491e79d92e29f9c4745cbea13a6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686753053, "uuid": "9de09da0-8965-4d2a-8a2c-fd7152c6b69d", "value": "T123746D09DED80656DEAE900408BD93F2C27D4544B0F4A4CEBF71EBDEEB52688181DBD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686753053, "uuid": "94d1e1c6-3017-470b-b24d-8fb231bd5bd9", "value": "6144:2DdWAQ4TilUN5qExZVcETsyIxHSal0fSv4bVijcWAcvGt4pWU2pNa:2DdWAQ4wiXxZVcYPI9F0fS1cWAg92pQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686753053, "uuid": "fc2c7a85-c824-44a7-a2ea-6176c50b0cd2", "value": 357409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686753053, "uuid": "a1fecc99-e9cc-4d3c-ba13-9ea9abaaf1ed", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686753053, "uuid": "6d673342-cb54-41b1-9bff-8ff37bd8bdb7", "value": "wiusyhdgfg.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f79ace4-0af8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686777236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777236, "uuid": "6273725a-172b-4636-a949-89b9ddb2d0df", "comment": "Malware payload (Mirai)", "value": "eea4b15fff5e97fd2a93da98c37cb3af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777236, "uuid": "c4f55675-9b2a-430f-af1d-8b9ad43b8017", "comment": "Malware payload (Mirai)", "value": "6f7b64372a4ba2f724bbcf9073ffb6c8ceb35fd5a00b8886e37e65519b631131", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777236, "uuid": "56faa04c-f1b0-4880-bcfd-cc87669996d6", "comment": "Malware payload (Mirai)", "value": "1a700ed661f6b5e41b22105220e43f3ff86cf38e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777236, "uuid": "bc574460-5af8-461e-8482-833366a840b2", "comment": "Malware payload (Mirai)", "value": "3f44a73c6a6dd2962fb2a9bd45e346d890e6e23aaa75ea414c06e56b4dac26afa0548cae7b052514e31e3b0996a35985", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777236, "uuid": "4c34cc73-bac7-45e3-9eec-dcd31a08743f", "value": "T12FC34B256D772D2BC2D664BB02B30321F5F7138934A8CA1D7DB00E5EFF686A0315766A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777236, "uuid": "5d57dbaa-7b25-44fa-9f9f-6ac31e6acca8", "value": "1536:xmxOmBLUiVPK+Y/1GZyqERKzWFKoIlbRyG3ON//XfAlk5cZlthsLYhD1l5:Qx5BYJM1zWFKC1fAlUgrJH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686777236, "uuid": "aea8fd0a-8ac7-43a9-90b0-6847f9f65977", "value": 128616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686777236, "uuid": "ff226110-5f65-487e-8462-c056f3c474e6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777236, "uuid": "4d3d9699-2980-4110-a5c8-fb93b97e6a6e", "value": "eea4b15fff5e97fd2a93da98c37cb3af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c59fb58-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686728671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728671, "uuid": "0a2f6cdf-2997-4e75-9089-ade4f309e7de", "comment": "Malware payload (AgentTesla)", "value": "ab218ebf03edac59cf6136124a2f5089", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728671, "uuid": "61fedc1d-5c72-46fe-9ece-95bef30b3914", "comment": "Malware payload (AgentTesla)", "value": "6fa4a794d4d0968b2aa5aa59739952e3d45f44d8a9cc73c75c138fcb789914fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728671, "uuid": "c5e8db30-087b-4630-8796-1edb1f2761b3", "comment": "Malware payload (AgentTesla)", "value": "1991313b797dd5ad80a5cb60efdc9e97677aa773", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728671, "uuid": "1a27b245-c952-456c-b8bf-0575124dbb64", "comment": "Malware payload (AgentTesla)", "value": "e225d1de06cb31fa37e161532d05ae82c9d7d4a443da7fb677379e1c352b7192e1a7f74c841aeb6bd4f632587266c72d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728671, "uuid": "1be5a8e5-e55d-4ad5-91ef-cb87aa703e0c", "value": "T1B00512406CA95B57D2BAB3F90F1032B037FE5BDA3856F39A0D87F0D69964F490A01A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728671, "uuid": "be6ede36-a063-4011-aa26-9bfc4075fce6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728671, "uuid": "f9f5b548-e405-4056-89bb-9bbe9562d96f", "value": "24576:QgG1tCueiaA7mBhcngsVXLasOBgDPBeMd:QgqtCDiJKBhkgspOBgle", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728671, "uuid": "0e5ede37-d407-4608-9921-00a07473f4fb", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728671, "uuid": "79866aac-1b94-4c37-8b5b-267d285b53a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728671, "uuid": "5467ab41-1281-431b-84ed-76e9ea1c9a61", "value": "HBL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b676f9-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725787, "uuid": "7dd68bc0-07d7-4b3f-8e5f-f91d1b6bd631", "comment": "Malware payload (Quakbot)", "value": "3a1236266016d41c361ce87b6d2bc41c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725787, "uuid": "a5f723ae-7333-411a-b615-3bfd956852ea", "comment": "Malware payload (Quakbot)", "value": "6fedab3c3da352624bf356b85f926a215d3b9aa2dde39781c4d9ad8c76a168f7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725787, "uuid": "430bdcd3-9f3a-4c68-84f4-a16bf963566e", "comment": "Malware payload (Quakbot)", "value": "bfdb8288f972f8160e17a53154bc32446d559366", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725787, "uuid": "387335f8-a75c-4cb1-b99a-8aafd6b2bbb6", "comment": "Malware payload (Quakbot)", "value": "51e191a95f5ddfd04ae74f50cbb78db974b85f1a656ff194fe9a046a0486c175617420f35f60028ccf12ea1bbd435095", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725787, "uuid": "b3cf4501-1fb4-45bd-bbd4-13753de7b5ba", "value": "T141645449A654E0F09237B33BDA578410FAAB0F5B20848972B97C505D1F3D8697EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725787, "uuid": "15bcf8cc-2823-498d-8bbb-4f26f580f1bd", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb/gndPSPPXRCSctUtKxMhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725787, "uuid": "1d7b133c-ad3d-4326-aed3-fbe53942e249", "value": 336726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725787, "uuid": "a04459dc-3e6b-4b8c-8f4d-bdd098cb1700", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725787, "uuid": "4a090951-4c43-44d6-ada7-854d04980bcd", "value": "kYQAgfHXopVK6.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d973eed6-0abf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686752959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752959, "uuid": "ed3442c8-cc29-48de-b53a-999872fd358a", "comment": "Malware payload (AgentTesla)", "value": "cf03789345652206a0aa5b54e562377d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752959, "uuid": "9fcd2d37-6b13-4343-9a58-3bf8cd99c0b7", "comment": "Malware payload (AgentTesla)", "value": "70031e801f8681204d7a6f63c226277b10a6bcacec7b39203aeaa6f3d8b3bdc6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752959, "uuid": "a258a402-6e10-4b35-b837-78741967713b", "comment": "Malware payload (AgentTesla)", "value": "549e069d049889b5f4dfa06296760159a6293fef", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752959, "uuid": "74f328af-e6c1-44a1-be0c-217f9fb20a48", "comment": "Malware payload (AgentTesla)", "value": "41c5d4be73494d124e683df1f307a2540a2cb3d41f2eeed7af83042e5e794a5c8112264c2f01e6c83657d395c9d3797e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752959, "uuid": "0707849f-3688-47d7-9691-8bf591630e04", "value": "T12371E8745D8E2AB3C1835ABBDE573E7253D9F21B87CEEDC05189F9110C2F2318922985", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752959, "uuid": "fdf87cba-de72-4f94-92ce-3f2f559a0603", "value": "96:M8+D1oDWtcgVa/MMzXPFYydHMUWl9ClE7KirahhKma:9+D1Xct/MMbiKHElMl1iraPKma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752959, "uuid": "d1307581-e4f7-4936-b6d9-88a9cd171e86", "value": 3578, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752959, "uuid": "ea247c34-93a3-447d-8764-84b6f502a834", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752959, "uuid": "2d356ad7-2a75-49e7-8cbf-4322520ba08f", "value": "Purchase Order_PO1140810.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e3e34c7-0ad4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Stealc)", "timestamp": 1686761799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686761799, "uuid": "d4538173-1b41-4410-80c2-0ab961fa9c88", "comment": "Malware payload (Stealc)", "value": "11c62b8004d4b334202c7e5546ca3b88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686761799, "uuid": "9edbe6cb-1383-4d44-8938-81e934c093b9", "comment": "Malware payload (Stealc)", "value": "7056b770005321314ab761af6dcaa312762d1f0b88cbd5d812697a02f612380d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686761799, "uuid": "24be07ef-6169-4e7d-95e6-80827c2d154a", "comment": "Malware payload (Stealc)", "value": "60ad5cbe9104fb5c14d171d24c3e1e9269bdbae5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686761799, "uuid": "d1aa47f0-0093-41fb-90d3-7c8df71265c4", "comment": "Malware payload (Stealc)", "value": "4eadada9bd283db873f42b2dfd9d8649feb2aa4ee4233cd0aaefb10ddba955c7c05179622e4b469a1c3c3e72c8b61c98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686761799, "uuid": "76717fe0-e63d-4923-b438-eee729e98522", "value": "T1C5F623C62CCB80F9D9C11570C61B27DB23B3E9AA8D894D247AC57489E5B1F72707AC93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686761799, "uuid": "c6172511-7478-4699-8faf-aa9a53a7c274", "value": "d02a2f25794b88116dec9ed5298f35b0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686761799, "uuid": "68e288c8-cd73-4a6a-b947-c465d5e93556", "value": "196608:8JOrT46jzjPgWaTS6UicEScCSBhsqmY4uz14QVfoE5FmPlLaCCgeQyv4BgZSE0:8krHjPPg1IYHCSBhGY4uOwmPwMjr1z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686761799, "uuid": "6d9c750c-ebbf-42d6-9730-ff09b69f72fb", "value": 15584768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686761799, "uuid": "2146f7db-cfa0-47b9-869a-72addca574ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686761799, "uuid": "8d501933-5335-440c-b541-434b20ce1562", "value": "11c62b8004d4b334202c7e5546ca3b88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5d0c938-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728418, "uuid": "8d0a4a58-0565-4458-b9d6-cc6b15522d79", "comment": "Malware payload (Quakbot)", "value": "45ec8483399dee747ea6f16960ddd04f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728418, "uuid": "e043d765-bd54-4822-9c21-ca015fe9ad60", "comment": "Malware payload (Quakbot)", "value": "7074ff624519388df3fce38a20a1ce34aad2d8b620c5e61c13b7443ebd572b7e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728418, "uuid": "6adf2cd9-7ca9-4db1-a741-3dc64f425dc0", "comment": "Malware payload (Quakbot)", "value": "45095cb293f480de6fe174e8cb8f7aeeeebe1e6c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728418, "uuid": "6c3c9ad7-b35a-4464-a795-3b487067d254", "comment": "Malware payload (Quakbot)", "value": "15eaa6c7beef9038ed5904448556d99358651b9c4bb36a0f60f51f8c2ceb5570cc778901db60119e6f1bef7ecf94d1b3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728418, "uuid": "5ef53582-c6aa-4954-a962-019cad66aa7c", "value": "T1B47445895A51E0F15237B33BCA178420FAAB0F5B1084C972B97C50596F7D8297EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728418, "uuid": "d461ecee-9802-4caf-ba21-30e05792a96a", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbnXpvLyJ4tgSEiefjRzhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728418, "uuid": "aafd98e5-7296-4ea9-8d51-8618aa0bdaac", "value": 352675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728418, "uuid": "7ec26ad1-79ca-46bc-bfca-48561e2ff0ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728418, "uuid": "ab360df3-47f7-4828-818d-e9c0aec36598", "value": "W8ybE7RcWZ0pBm.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ef82fe4-0a6e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686717911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717911, "uuid": "0f31764b-dada-4201-8e8a-133e41860424", "comment": "Malware payload (Mirai)", "value": "381e525353baa29d1853fa28067100fa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717911, "uuid": "95160307-086c-4674-b015-b650f5461c00", "comment": "Malware payload (Mirai)", "value": "70d25058f815c55e02577e412727b3a8656ec4c4e78880b54246d26d07e5f665", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717911, "uuid": "5fd8137a-cf68-4fdb-b705-f741df5aa15f", "comment": "Malware payload (Mirai)", "value": "b6a98e22aa2a70f73bb0621026d8aa094777aab0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717911, "uuid": "12839cd8-2e9b-4870-a920-738ca0a35035", "comment": "Malware payload (Mirai)", "value": "941829289af251bdf5526634f521767887868d870c402aeb9e250e8d597fa6de527189149779e4c60e3623a0e227596b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717911, "uuid": "a9b5393d-b64b-4226-9950-87f63dd4353a", "value": "T140732996B8919A22C6D4237BFA6E41CD372163E8D2DF3207AD201F647BC681F0D67E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717911, "uuid": "aa461ba2-dd65-444e-bda7-fc4e24471db5", "value": "1536:XpXcKpBUlet3DBboJubLCNgpRTZG7kcahWMPiY4g5q9/e35roF7:XpXcKLU1cRE7kvhTkgp3WF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717911, "uuid": "c89324f3-7bcd-4de5-a1f0-b14c5a2eb055", "value": 74744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717911, "uuid": "24eab6ab-0217-45c4-b1c7-6e4f19780ef5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717911, "uuid": "a988a6d7-f9b2-4ac1-a7cb-d7ed56b1794c", "value": "381e525353baa29d1853fa28067100fa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efcc58a4-0ad9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686764164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686764164, "uuid": "85f633fb-096c-4d02-9d36-b0d72dbc4c0b", "comment": "Malware payload (RedLineStealer)", "value": "32799c39a1cfea30fcdb248d7c190911", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686764164, "uuid": "9325c95c-e9ad-40ac-9306-a47c47a4f36d", "comment": "Malware payload (RedLineStealer)", "value": "716abee0d15979a235778b18f24afde63fc3f02c4243e24ce2e07b99c3c90706", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686764164, "uuid": "32dbd191-7059-45b9-887f-16570eed25fa", "comment": "Malware payload (RedLineStealer)", "value": "8fa756c0cd1b1a549fa1c99d4e444c38a18fc78c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686764164, "uuid": "98006db3-8f7e-4fc6-bafa-e44fef15d320", "comment": "Malware payload (RedLineStealer)", "value": "b135fc8f6016d78f4d81888ae708777dca920c127dc664f6ac1dabf92e7c32548846a87c104b0d29d786f64059248611", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686764164, "uuid": "ac75017e-c1c7-4d22-af5d-cd5e9476da30", "value": "T142543AB77792DB77E5D1D0BB9B2352A9C420A8F4B2DC18CED2806B1E56201E68FF0517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686764164, "uuid": "3ce5f81b-a795-4836-977e-cbd26f187a27", "value": "bb6d69b7632b1e5c0fdd9e8372c6b738", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686764164, "uuid": "820a80ce-cd2b-4a90-9b41-bc2fd5390957", "value": "3072:1TfxygE69Y0zngZkMyPE5PQcZ6qGtKY1r63fx8h0A2aH/lFBx:1b79Y0z4QOPQVqGr1Qf6GQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686764164, "uuid": "894bb1c6-96c1-4f71-98d1-f56c5bb06947", "value": 292988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686764164, "uuid": "84e1e108-d9b3-44a9-ae23-51b197de66ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686764164, "uuid": "8df8d0b2-41dd-4b76-ae35-6a03af01c2fe", "value": "32799c39a1cfea30fcdb248d7c190911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac209b3-0a9a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686736936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686736936, "uuid": "09662972-b4b8-45fb-8af3-c076e3347f6a", "comment": "Malware payload", "value": "d9ed461cb5c2031a07d0e2e84010454e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686736936, "uuid": "04804441-38e1-4d03-bf2d-bd9fdf41199c", "comment": "Malware payload", "value": "721a57dc3b83ac60ccec8dc6a99f73117387cb8d23d62ed6a7a21ffcf0d4cfee", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686736936, "uuid": "e5af2c8d-6aa9-4f77-b6de-124881fe5649", "comment": "Malware payload", "value": "270090533eb2789631c7503d5a33aa935f23fed4", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686736936, "uuid": "cdd3b05f-f1c9-4b44-9b35-193216db0678", "comment": "Malware payload", "value": "051f21429d86a233693312e870559cb8922aa5a99af5b3890daf23e436345eba6300c66523c3144e032a062ff6cf73e8", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FakeApp", "colour": "#D5FE4F", "exportable": true, "hide_tag": false }, { "name": "metamask", "colour": "#88032B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686736936, "uuid": "3bdb0652-319b-4221-81ac-18c0501158f7", "value": "T158672343EA44CBA7C4BA83F16A230E951A174F19C783AADF1518376F2E735D50EC998C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686736936, "uuid": "2ab0e1e6-ad8f-49e3-9f1f-5fe85f544be4", "value": "786432:e/3ZU2DzmVE4+BrJFj/ntKous2UwmLqpC+ayi5FsjxxM:YhfmSnj/ntKous2ULq8/yAwxxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686736936, "uuid": "0014da9e-f739-480e-ba03-3ea3b5a60321", "value": 32231800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686736936, "uuid": "afc46a4c-c2b8-4684-a781-abffe38adb44", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686736936, "uuid": "cfd76723-ded9-421f-9f23-579aede88fc7", "value": "MetaMask.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45dc73fc-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728230, "uuid": "32796447-ae6d-4bee-b4f4-c249a7fe62d9", "comment": "Malware payload", "value": "d8b6636598ae93e660486051bc9003ed", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728230, "uuid": "f3a8d13f-d338-4060-b72e-2b627d789ae5", "comment": "Malware payload", "value": "726a7ea1923ffa5c7fc0dca35ad4a8149150adbb1632148d0a8811147967fa66", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728230, "uuid": "aa76242b-4192-4713-b053-23bd97710c7b", "comment": "Malware payload", "value": "44786774280d1326861ba735b29c65c4b8480d38", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728230, "uuid": "fbd9a815-486a-4cbb-a08b-1f275ab181e5", "comment": "Malware payload", "value": "9c54f98ae5bc6b2b63cf4964fbf4365a660582bd1c9f40796a0456df799e618af2c8a55db53642e1377189763d6f6f23", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728230, "uuid": "b9ef2e5a-214f-4278-9162-9a2bc2532842", "value": "T102644485AA45F0F18133F37BCA574410FAAB1F5B20848972B97C505C6F7D8297AB7E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728230, "uuid": "c29e2d32-b970-405b-9688-a8d975538dc4", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbjynVp7kup2yaBhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728230, "uuid": "86682c72-8a91-4437-805b-5453108c9d7d", "value": 326038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728230, "uuid": "6eb8fc52-8ff9-4691-a9e8-a9e38506742f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728230, "uuid": "72b8f516-fcbe-4ac5-a9b3-2f2dbcc4573d", "value": "aoPXgpWCNysB3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7deb323f-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728754, "uuid": "589b9a37-b40a-45b1-b3ed-d8aa6be0ae3e", "comment": "Malware payload (Quakbot)", "value": "2130c54b54046fa5bbfbc16c9b573e64", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728754, "uuid": "b98bb6a2-26e2-4e6e-ae48-f2a16f4c2a93", "comment": "Malware payload (Quakbot)", "value": "7273b75e139f3dd30809a4e9c1abeec754ee24b0a7f1ccc2333727449802fb81", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728754, "uuid": "3e4fbacf-841c-4ee8-869e-d21d3caa74e3", "comment": "Malware payload (Quakbot)", "value": "b2687b0ca75bda395148ab60154337fad930ce5f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728754, "uuid": "c3d0e792-10e4-4819-9659-d58abb8e0ec6", "comment": "Malware payload (Quakbot)", "value": "d66d236fff5dbc70133835beb1d3c8515ada055335f8ecb568176a8ce97e3a088dca2b3c556832e8e000e1ce2ddea212", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728754, "uuid": "73d54558-8d18-48f1-88e0-a88e90f18cae", "value": "T1967442496A55E0F18237F37BCA168410FAAB1E5B2084C972B97C515C2F3D8297EB7EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728754, "uuid": "53a5d89b-8373-4df5-95e3-d2b94ab484a7", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbw9wjOTMahS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728754, "uuid": "5ed75d7f-657c-4e69-aaf9-b623531993a0", "value": 342658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728754, "uuid": "2ba143f0-666b-4e42-a84b-9a957e8ae960", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728754, "uuid": "f2045b6e-b9a8-41f4-ab74-8528a24c119f", "value": "QgESjgbpGKkhH.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d876b88-0ac7-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686756214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686756214, "uuid": "ed3645a5-88d1-489a-935c-9f78635d1251", "comment": "Malware payload (Quakbot)", "value": "a474980446d2d2563e5f5735f5eaff24", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686756214, "uuid": "797536e1-fa90-4337-b65e-3e932b6104b8", "comment": "Malware payload (Quakbot)", "value": "7285f4d674b8d5a25487def62f4f0f62097d97e3317c2a6e1cdcd9ec10143f28", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686756214, "uuid": "69fc5bd2-c3f3-4500-b0b8-dd604c5f199e", "comment": "Malware payload (Quakbot)", "value": "e3973d5908fe378bd3e20583036fb9a0ef2d000f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686756214, "uuid": "c1431d92-9b58-48f5-966f-a89dd0e1dc00", "comment": "Malware payload (Quakbot)", "value": "657aa43252d2623129adb912b23171ddd179337f9cbbe57503a19866cc615b8216ebcbf05613d93c2ec52d8dde59168d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686756214, "uuid": "4015e173-ddae-42a4-8d29-5ce0caacf915", "value": "T137055B44DEC318F7DC76013191D7E77BA632A601BB15CFA7E288B578BA527A1240B0ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686756214, "uuid": "cd272ea8-ccb5-4ce2-bc65-c0aa6ab3087d", "value": "fe1bad1210fb9866013ea023b05102bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686756214, "uuid": "f386de30-ad60-4f0b-addf-4bd5a374e376", "value": "24576:3C4lIeA97+mgxDkID8c4aykLy6GNZDjf:37iovQatLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686756214, "uuid": "d4bd642e-dde8-4014-b562-99e39dd05dd0", "value": 845284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686756214, "uuid": "86cbe1f1-12ad-40f3-9e8f-aaac798c79da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686756214, "uuid": "590eddd3-5c73-47cb-94b6-888b535e0526", "value": "quickdraw.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a1555c0-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686750491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750491, "uuid": "aaead9b5-3d5b-4dad-911d-4090a7b97d3d", "comment": "Malware payload (Mirai)", "value": "0701730947609cabee4e27976eb07f95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750491, "uuid": "43a16535-5f6a-4f58-b32a-e96fff98f14d", "comment": "Malware payload (Mirai)", "value": "72a2ce9316004dc565a78bcdde137f86e02da8647c3307e7038dbc6d13236e2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750491, "uuid": "b82ff7e1-e54a-4a77-b6ab-6140754062b6", "comment": "Malware payload (Mirai)", "value": "29415ebedab4204009dba07d4cca3749d3845be4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750491, "uuid": "aff521a0-f1a8-4e1e-93aa-796d6470c41d", "comment": "Malware payload (Mirai)", "value": "97e7cf7003c7496a1d8b21617afbb4a5b00398cf8d1347b0f0f9fb71d60a478dadf0e943908c4d3f585a14d502ed0c60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750491, "uuid": "7bfb84bb-d970-4237-87e4-b50793501eef", "value": "T1F0B2E15465CE64F3C7627C3EA84AC58434C95778A8AF70BA2668019E35E244B37ECBD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750491, "uuid": "d3245d02-c2c0-490e-ac4c-2e4a4945af9b", "value": "384:eQ4IxgvjE345GviEHZSnwPVtXODMHHeCFWNZT065N542vWF8Y4bv3Zlh7qmdGUEd:pZ34REHZSoVt+DazylN53WFngfZl9q33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750491, "uuid": "213a542a-dd52-4870-b980-735c82ea1a8c", "value": 23624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750491, "uuid": "50c7e4c8-6d63-44a3-92b3-4df3b013e157", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750491, "uuid": "ab16a821-bc34-49a0-b1a5-b998b441ffee", "value": "0701730947609cabee4e27976eb07f95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19f4df59-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728586, "uuid": "e989094e-f10b-4611-9004-6f6ac897f3a7", "comment": "Malware payload (Quakbot)", "value": "6778c3c404573d5088b18d8e2918de2d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728586, "uuid": "4542fa8d-abeb-4061-972b-e3a02b6fb4e6", "comment": "Malware payload (Quakbot)", "value": "73255d0f55d8114a9ad63fe3bd964b66a5495b57364dbe586eb88191d8b96d6b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728586, "uuid": "9602b9ba-4839-4166-b8f0-1fce664d35a4", "comment": "Malware payload (Quakbot)", "value": "9546ef22912d86e31267f2a5d8400a0ebc531901", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728586, "uuid": "c4914072-6693-4d91-8120-0350e4cbb794", "comment": "Malware payload (Quakbot)", "value": "3aa2ba1136c9e01720c739be8dcc56b6fc6d25ac82c715e8fcb73e70bcccd8d30d424bb84b4202d5b29d4068f4f74314", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728586, "uuid": "090116fd-2bd6-4656-bc74-4ebe705b9e34", "value": "T1C5743145AA55E4F08337B33BDA178010FAAB4E5B1084D962B93C50586F3D86D7EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728586, "uuid": "de8b66ec-a52f-45ef-971e-da3dc99796af", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbVYl9Fw/QxB0hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728586, "uuid": "90623665-406e-40e4-9e58-7b28512e5034", "value": 353389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728586, "uuid": "d205ffd2-6777-4672-a2f9-1878ef308cc5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728586, "uuid": "7984a642-c4d3-4025-93c6-865b5b2dfcdc", "value": "TKsZ61VHW1Qmlk.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dffc5661-0a92-11ee-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1686733643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733643, "uuid": "aa981bdc-02bd-496f-a889-96993eec5fc1", "comment": "Malware payload (IcedID)", "value": "3f7112e51bd16ad1bea6539b55f91a72", "object_relation": "md5", "Tag": [ { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733643, "uuid": "3b6d42da-9f1b-4134-b39e-2b52389587d8", "comment": "Malware payload (IcedID)", "value": "7355656f894ae26215f979b953c8fa237dc39af857a6b27754a93adb1823f3b6", "object_relation": "sha256", "Tag": [ { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733643, "uuid": "1d7b37f0-67e8-4a4e-9ed5-62e3549f7e6d", "comment": "Malware payload (IcedID)", "value": "b09958a2da307f5655ea59663a94b7da847f89dd", "object_relation": "sha1", "Tag": [ { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733643, "uuid": "e9bcc75d-b9d4-45ba-9aea-eef35d7ee5ef", "comment": "Malware payload (IcedID)", "value": "69f7ac4d128aadd8173170ee389089f48636a91fa7eb0aa7a5c5b14dd64d78c3216e764b9ebae1b7b1c5ee885c9e6c11", "object_relation": "sha3-384", "Tag": [ { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733643, "uuid": "26755495-a6e8-4b2b-af40-5a544f5b73f7", "value": "T16205A6C223EBBD4B04275376339426F5D53ACA75D98998CCF4467C58F0ECE06BA982C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733643, "uuid": "e05d91e1-7438-4b91-9542-2dd2368765cf", "value": "24576:zGCpq2Pb7niA0lpNjCM2at3/BG0Kjh09KqEdadTsivpyDfP29c9WnZmPv+RJmE6T:Rpq2PfniA0DNjJ2at3/BG0Kjh09KqEdn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686733643, "uuid": "62ca7012-7948-46bf-b626-c3bc22ed7d58", "value": 813100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686733643, "uuid": "3fccb55c-41e2-4a00-8a1f-20e58aebc708", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733643, "uuid": "22a568bc-274c-43bf-94fb-3b47350e8def", "value": "Docs_Request_06(63).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f5412e9-0aa3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RustyStealer)", "timestamp": 1686740621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740621, "uuid": "8059550e-2cc0-40bf-8351-dd740b08f157", "comment": "Malware payload (RustyStealer)", "value": "617b78a176dea6e50d311194ab77dc66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740621, "uuid": "400a4d62-ca30-4c77-a3bc-9872461f0c74", "comment": "Malware payload (RustyStealer)", "value": "73dd6f94c406f7bb069a1a06fd9ebad40683dfc1d02c949a3504e7c6be278b57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740621, "uuid": "449a8c73-6822-4aae-9cfd-e7497f45310e", "comment": "Malware payload (RustyStealer)", "value": "e32bfb147016377c84a5a777172dad3868ea433d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740621, "uuid": "c8bbf246-5198-4eaa-94f8-2876789939ef", "comment": "Malware payload (RustyStealer)", "value": "23226bbdb1d73f31c5cbcdb232eab4353088439515c054f9a8eae3c6e660e2382d37208399e36f7392fa7865609a9b96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740621, "uuid": "d8e9a341-f110-42c2-bc0b-cea98c40601e", "value": "T14366C51AA76D60D9C07FC078D2839F22B9213499073977F7899096692F24EF8BD3D364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740621, "uuid": "c960ff61-9726-4440-9dd8-161fcaafbf4c", "value": "eb74391ccdeccd1a290ccb380e0221e2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740621, "uuid": "e9dbabf6-e3dc-44f7-ada5-da01761c3000", "value": "49152:Fv2Bnc1mhyvBvnkxjdlxJxM1mxtNM3fXbq4RntOCO3E4/Y1m+c/uuE626h4BJc8O:nnBsQkxo2tFnp5iUNS74W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686740621, "uuid": "37736502-63f2-437c-96dc-dd80c78eca3f", "value": 6933272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686740621, "uuid": "e6f46fb2-3c00-46d7-8040-20b2948b176f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740621, "uuid": "4187379c-af61-4e00-a8af-aab8060002b3", "value": "73dd6f94c406f7bb069a1a06fd9ebad40683dfc1d02c949a3504e7c6be278b57.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42607eb5-0abf-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686752706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752706, "uuid": "7298fa23-77c2-4950-8903-86ee2905f176", "comment": "Malware payload", "value": "d422a1cad01215e8a30f39a5198fc99a", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752706, "uuid": "694b4777-d050-4109-9c47-aa6cf16e496f", "comment": "Malware payload", "value": "74693ef55b720c3db57a86207e9cd06aae032521283934128098541d90c63b9a", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752706, "uuid": "26a6f143-f5cf-4d00-a7cc-86193a5547c9", "comment": "Malware payload", "value": "a19fbe1754ad36f9b752b6839543a6fd41c0967d", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752706, "uuid": "a34e445c-85d0-4ab8-b0ef-00a9136d51fd", "comment": "Malware payload", "value": "4867d10b82ea1f8e1eaccabece924cd3dc3cf1c079f5ab545981a00d5b296305195d8ca5810fc7e79f4d5b3b444ec757", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752706, "uuid": "28e6510a-35e0-4581-a302-d18202ad0f8b", "value": "T1C612EC308CA335126773D2B5419BC5AAD1A049078A84A4D63FEC669CCFFD33C866EA57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752706, "uuid": "635e877f-8ea3-492c-bad6-5bb47674860e", "value": "192:5SlRl5l1yYckUaOtuwlThe5ar3c2va0i1rMiQeyoCQY:5S7l5HKDtuwlH3cRlCQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752706, "uuid": "d15042b0-275f-4eb9-b0ff-e1cc81453633", "value": 9486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752706, "uuid": "b340fe9c-6515-49f8-9099-8828290069c8", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752706, "uuid": "7138c465-3595-4b40-852d-be19e70e1a6b", "value": "blue.php", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a3d4b91-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728157, "uuid": "9c01095d-1639-4021-8fed-4d3ca9d71077", "comment": "Malware payload (Quakbot)", "value": "54c76f9e27a70412e5d08b37756e1bd5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728157, "uuid": "ee36481f-6a7e-4353-a515-8b5d91c1292e", "comment": "Malware payload (Quakbot)", "value": "75030730085c9f4d5afe5987d5a00daf2c4b04fceb95ec0f241e271ee67b3714", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728157, "uuid": "3413210e-c64a-4226-b6bd-2fc4cc97dcfc", "comment": "Malware payload (Quakbot)", "value": "5fbd62f29b7387dc6387ea6eac8266273e819396", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728157, "uuid": "c2ddfc6c-1281-47e7-84dc-3c9f4695c11c", "comment": "Malware payload (Quakbot)", "value": "709a001eb624b360e187f53798d5dbaaad8d4e993c0a65082a6568295e64794b1ef35113b96ec78ca49f6984ee86822c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728157, "uuid": "ddcfe829-8986-4d86-8531-5504f2b66f31", "value": "T1928440896651E0F18237F377DA165420FAAB1E1B2084C972B93C60586F3D86D7EB7EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728157, "uuid": "a0532b07-52fe-4306-a833-5e9822f678ba", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbg7dpvHnyUvihS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728157, "uuid": "da4b5824-c03b-45a3-9c99-e5bcad31aed2", "value": 373225, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728157, "uuid": "d5a13cb7-2c28-4e13-902b-67c0ecc91ff3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728157, "uuid": "3b9a9a46-ac7e-41f5-adbd-3241c440dead", "value": "cqAO3SAUlM2hrT.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ce4c3b-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728464, "uuid": "37c5ad82-2947-49cd-88ed-a13b1f5e5003", "comment": "Malware payload (Quakbot)", "value": "f5eab688637efa9e2daa7646fa17bd9c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728464, "uuid": "fd24b378-5cf4-4a89-8e95-a16aa1830601", "comment": "Malware payload (Quakbot)", "value": "7655dca0c6b6e1f781e4093ea11a0fcd61bded9b40d8fcfce85aa4ee3c360929", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728464, "uuid": "42966df0-dbc3-4db2-b8f7-1d9b9d29fef7", "comment": "Malware payload (Quakbot)", "value": "4cf3ed70ea4b38183efb1e6659b92d8969b6cb50", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728464, "uuid": "40513f58-592d-49dc-a6cd-c8b071d4c9f7", "comment": "Malware payload (Quakbot)", "value": "47edaaf9ba89c4fecca55d498a0d5b18b60b8820863cd4c86c8ca907444ddcfca373c2d37b1633c45230f1d117788bf0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728464, "uuid": "a08f963e-5448-4403-acfd-e23b3a17f049", "value": "T1A07432896A51E0F09237B33BDE174420FA6B0E5B10848962F93C61596F3D85D7AFBEC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728464, "uuid": "57814f3c-19e0-42c6-a879-0fab8044d203", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbVzX5YIJhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728464, "uuid": "c7c95508-85d5-4f53-90a4-ec2850f9aaed", "value": 346925, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728464, "uuid": "2163383f-b7cd-47bd-a757-f5a2b6626c7a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728464, "uuid": "4fe80ea6-4ffc-4fb3-aaa2-a23ba8c231eb", "value": "VSVpARyN3cztLX.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5933d30c-0a95-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686734705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734705, "uuid": "42e8a672-31a1-4b52-ab6e-e9bd21c48c44", "comment": "Malware payload (AgentTesla)", "value": "6fef2ab5b0cbe0b559d40bd211103d7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734705, "uuid": "1de8a626-e067-4ea1-b643-014a7415206f", "comment": "Malware payload (AgentTesla)", "value": "7680824ca2f598511250621c470586201a4129a04d32b86f8cbc4bd208de5cab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734705, "uuid": "2733050f-193d-4463-b81f-48deda0294f5", "comment": "Malware payload (AgentTesla)", "value": "1ff1276439ded5fffd2f7a5486c557825b40f9ed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734705, "uuid": "6d516cc5-f88e-430f-afd5-7b110f20b678", "comment": "Malware payload (AgentTesla)", "value": "9a4d1b1da490d246a5e444457bdccf8b59456e0605639faaca4c0cea094e6b98e964c2cd08b1894244aec1c744d7d423", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734705, "uuid": "b1dfea1b-0bc0-4309-90ad-2ab1552282e1", "value": "T1A9E433703869C908EE7474745FCEC17F56886CCF8D2AE518252913BD058AA9AE36DF32", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734705, "uuid": "ba7232c1-ea40-4755-bbe1-d4e1bb7bc205", "value": "12288:rNWIud7RJhUMbvAARbeIfLsDwEnmcgR2HulMO8ca4lJGNDeets:rNHuJtUMbvA0CvDEAKMX26Ndu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686734705, "uuid": "eb3a28ff-c028-4786-a83d-4bdcec45f2e9", "value": 712702, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686734705, "uuid": "05664e4a-001c-45d3-a0ba-b8c8819e71fd", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734705, "uuid": "97ee94ca-8c14-4308-a4c7-9125cf35412d", "value": "P.I.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2612029-0abf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686752867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752867, "uuid": "91e810b8-85f6-4a8a-a8b2-a641cfdd53a7", "comment": "Malware payload (RemcosRAT)", "value": "a4b441dc077059150c6a09a3a54ec5af", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752867, "uuid": "05fff742-8988-4ffa-9d66-a03c8db351a4", "comment": "Malware payload (RemcosRAT)", "value": "76a8a187cb83651ab2df6370985f5a63ada5db7c145c33f17da4b37dbafd9186", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752867, "uuid": "aecd6c8e-3462-47e0-a294-82a1920cbc49", "comment": "Malware payload (RemcosRAT)", "value": "58cfa02b1d9cb735b6beba781101223612ffe885", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752867, "uuid": "621ee469-3a1b-41f5-b926-0a2493281790", "comment": "Malware payload (RemcosRAT)", "value": "a941435f768e21e606db785a81937c407616ad74d5923d86ce87b2cb5b327af614648f7c3ebe6174c6f80e6e7675080c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752867, "uuid": "eaea62f9-358d-479c-af72-551659a0ee9e", "value": "T1A5039F5AE79F02A48F510277131B1E89AABDB63DB35154B1786C833433EDC3E42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752867, "uuid": "940c6545-dc38-4cd8-aa51-e4e839309cbf", "value": "768:2Fx0XaIsnPRIa4fwJME+WsVLtdHit7UXmPLw4:2f0Xvx3EME+DLt1i+Uw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752867, "uuid": "a38f3776-c8ba-4dbf-b567-ab44211aa661", "value": 41375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752867, "uuid": "7f521ded-ca2b-4815-8b04-42d0d7949c5e", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752867, "uuid": "1dd19d7b-46f5-48b8-ac79-95db9fbb6b05", "value": "30% advance payment.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e143023e-0afc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686779172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686779172, "uuid": "4d4dcc74-0ebd-4ba2-b1d4-7da1fef71549", "comment": "Malware payload", "value": "0d728ca438e6de9c8310f493afdda28e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686779172, "uuid": "673c4b0a-4d0a-4db1-af0d-fa3ea46d25b7", "comment": "Malware payload", "value": "76d2fbe4b75497a63ba51bb5ec56d4ee73e03dc9b66320737cff435f117bc53c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686779172, "uuid": "842ebc10-da2c-4b74-988f-9a69d5dc0807", "comment": "Malware payload", "value": "c0fdd7c8817baea0e69980df77b542d321b92910", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686779172, "uuid": "706268b7-3c6f-48b9-ad40-527fd216da07", "comment": "Malware payload", "value": "eb706ffadf684294261b4516642322368d4d77f98a115f2caecc4d9051b576d04a47a26888e5b7961b7d2ec990641d58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686779172, "uuid": "465d6d89-29e8-4e62-a9fc-62391bd352bc", "value": "T12804BE2275E0E472D5664B314C78C7E42E6EF8121F74A6DB236C173F1EB21E29A72316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686779172, "uuid": "c289602c-316d-4799-b859-1bdd087951b9", "value": "3865ca37561d2aa29b9e83d3d87488fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686779172, "uuid": "78ab0e62-3f23-4d6f-8f86-c637c6e623e2", "value": "3072:hB38RCbcwvd0dAKKstem7nS08ag73go2NKS34YLm:D3e65vdJbmrbp5gDgz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686779172, "uuid": "8aa862ef-8680-4421-9cc8-68dde5045930", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686779172, "uuid": "508da0e1-c50d-4b2b-8f89-7439e9fb3a15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686779172, "uuid": "4e4b98e5-411a-4089-800f-b6a4f0680585", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4715ec28-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686728662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728662, "uuid": "674b8340-094b-4956-b5cd-c386f611483d", "comment": "Malware payload (AgentTesla)", "value": "162184a5589d50e13013d233c4e0f07f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728662, "uuid": "026cf3c3-7cad-4e18-9339-1a2018334cab", "comment": "Malware payload (AgentTesla)", "value": "77fa6b59ac59d5cecadce11e16a7a309acc1d7ad87caf74dd4ff99da3c7eda84", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728662, "uuid": "99223c45-a78a-4754-86a9-1a5dd1d27ad9", "comment": "Malware payload (AgentTesla)", "value": "4cd6c137160c3ae0fd02079494d35acf2a5f5d58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728662, "uuid": "b8927785-d56d-45dd-8296-b35885f0d7df", "comment": "Malware payload (AgentTesla)", "value": "fff10aa49f0672ac69d4f0ae8fddf262889ba6e4444cbdc8004c35a8f6c8013cd97cb272c5d9e1b9c1ed97cfd065221c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728662, "uuid": "5288dbca-47b0-4c01-a8f5-1feb61060c89", "value": "T188F433D461F4AFB58DDF7E53E10787A30CFEF248F39B8974647D866B58A2209D0186A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728662, "uuid": "c847c0e8-1711-48a0-af85-93b6ce5ea13b", "value": "12288:fKwtOS/CFCP4JpGmjyfRdmZmHl/m8qrB2JjkTHjQW697mIR739w6CF:fIcCI4bGCSpm1B26THjZ697D+tF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728662, "uuid": "8ff46e04-bf0e-4637-9607-6c92457e2871", "value": 723852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728662, "uuid": "815c2cbd-e827-4087-b153-87a907d00992", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728662, "uuid": "83d8dcd5-25c7-436a-b6ad-2f472643e393", "value": "HBL.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ff6e7d-0a81-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686726001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726001, "uuid": "99a88653-26c4-43c9-90b8-9a73acb26b58", "comment": "Malware payload", "value": "7ef3dda4ec91f3790d7fc16b79545467", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726001, "uuid": "6712a866-6554-41c0-b68d-b4f59ed535ab", "comment": "Malware payload", "value": "788dc5ef6fd243db4826675d050804659404543efdde2ab0f07d74c7d2c3148e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726001, "uuid": "4170788c-9681-496b-98a8-3fc7fc37c8d6", "comment": "Malware payload", "value": "124627404469cbe6569cfb804ef8659bdddde13a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726001, "uuid": "f02d84d8-110d-448f-bf41-bbfbb4fa7bd2", "comment": "Malware payload", "value": "c09551111f8c4984f26a62640530982391e4908cc1cf203bfa45afe8363a18435561528d92c9f796f23eb44823f01199", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726001, "uuid": "574dd6f6-ca5f-4707-a620-6e044e328aa8", "value": "T120644549AA41E0F19237F33BCA174450FAAB0F5B1084D972B97C51592F3D8297AB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726001, "uuid": "6a7335d5-ec50-4630-a542-a00708817a5d", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRby0vmICbhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686726001, "uuid": "a8d1b732-330d-4cf2-bfea-e6849ed9d5bc", "value": 328341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686726001, "uuid": "b212bb72-8e54-46ae-b6d1-3eba3b6c4eab", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726001, "uuid": "8d9c26a5-1c31-47da-9335-529aa425aca4", "value": "foQbgV8KxCFJ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04872081-0a6f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686718242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718242, "uuid": "be2db106-3397-4bbb-ba9b-da81f359d535", "comment": "Malware payload (Mirai)", "value": "7ce92e74d12d7674027469e5266a704f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718242, "uuid": "0eea87c2-2d2d-4357-bc5d-310c6c315726", "comment": "Malware payload (Mirai)", "value": "78dab3875bd36540bc004ad346789429d37d49c358e929fd2c0c2b259fd20970", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718242, "uuid": "49495e7d-9043-45f0-905a-b349a7a81c49", "comment": "Malware payload (Mirai)", "value": "64a6e2d9c7acede8fd95efe136e04eaeec751e77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718242, "uuid": "dcf42d43-b3f3-4063-9bbb-5ffa6d0ef58c", "comment": "Malware payload (Mirai)", "value": "1a0898dd2977c9a22dfdcceb86567fa5d873158bac1a3f76cc37bc7382ce351d81ae481a49528979850def7c61eebd21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718242, "uuid": "9e8fb784-c116-4a75-bfea-25202e39140c", "value": "T171735B35B9762A27C1D1A43A11F74B11B6E117CE3AE8C61E7E720E5EFF216506013EB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718242, "uuid": "e60365ce-6a4e-45c3-8871-ef776d2cb692", "value": "768:EYao5wB7N3voa5q9/R3jzg9LgAfWyznJwglJLRmkRGVZSGibO+z8sL42:narB7N3voa5S/R3jzg1gRyznOkESW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686718242, "uuid": "d6ff6a21-67b2-46ce-b261-08d19dee73ca", "value": 76184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686718242, "uuid": "787b8713-3ab3-41d6-a516-144d89bdac33", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718242, "uuid": "0241f589-7ac7-449c-ad9e-3665097f9ff8", "value": "7ce92e74d12d7674027469e5266a704f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baed03ad-0aa9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686743459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743459, "uuid": "41d81bfa-fda3-4bc3-bf06-ff02027f6e67", "comment": "Malware payload (AgentTesla)", "value": "ee2f65a5b6e02536b0970ae6c809ff97", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743459, "uuid": "b69a7a9f-44aa-4269-b62c-c28fd8a790ea", "comment": "Malware payload (AgentTesla)", "value": "7993122c1f0f168df60c23425ce74d6410d0960d1020f724dd92802b019a7ab2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743459, "uuid": "2cbe7181-d091-4fe1-ae56-5f7b0d417d59", "comment": "Malware payload (AgentTesla)", "value": "5c1cfdad004028a715342106243dd76ae93cabdf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743459, "uuid": "a30f6db2-222e-42e5-bc55-48642aed2b93", "comment": "Malware payload (AgentTesla)", "value": "ecae3f880cadfedf892ba5bf6d25e4928bc334e5f88d6e3cc81573f9649c5b594d3bb45b53f5f4614b9ee8f5e10931c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743459, "uuid": "88c61bfb-baf8-4e96-845c-795864b19732", "value": "T16215224AB7C40702E5496634C0E7153003F7AA87B674E39E3D8D40DE5F67FE5A886BA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743459, "uuid": "8e956d14-57f5-4a2f-8e28-469c4217256d", "value": "12288:hJBEpQJeWGoHNGd8mN+P4jRRcrfA6KF8Qj2cCJaZBzGKBAHModUk5PNSpdw:hPEpQJbGCod8mNfjbcrY6EucYKpoSkO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686743459, "uuid": "348d4d63-418c-4a35-9071-9630a12f61e6", "value": 907264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686743459, "uuid": "484b4624-df84-4cfc-b13d-374a56f85782", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743459, "uuid": "cc74ce6b-5ee5-4344-912c-d0653a3c16d7", "value": "nOrder Metak_WJO-001,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aba5fcb-0a97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686735486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735486, "uuid": "56b03379-1958-466b-8063-062a7b54d933", "comment": "Malware payload (Formbook)", "value": "7c7d839e0b2b705d1efe4d28d5886e34", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735486, "uuid": "da9162e7-8c8c-45d3-8b24-371425856f31", "comment": "Malware payload (Formbook)", "value": "79af5ae5775017d8ceca0d821e099268b028abda80a97fd73653aece7fe23583", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735486, "uuid": "145ab0dc-c15e-43e8-a251-809d87ccda6b", "comment": "Malware payload (Formbook)", "value": "7cd5b6469fca41531b4e8545fa3129e70600706b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735486, "uuid": "6371c9ba-d293-4eb9-8027-72a1c2a135c5", "comment": "Malware payload (Formbook)", "value": "0322e4e4ac25bb447b3f11a985c891f1c6053bef9252e301b15371350391b43e579915e5f4344a50054ad8a731997d65", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735486, "uuid": "bdf63e59-1cad-4942-96f9-21bbf5e5f093", "value": "T1DDB417F871E1E279C80482312A617C7057F14EA0DCB2A955FDECF9E4D631EF62B2164A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735486, "uuid": "1b0762f9-d731-449e-bebc-bffc2627a45b", "value": "6144:F9jyWesJ7Qt85IbM832oAcKtZeRCJPOpOMWnuCxFwKxFf+3WPYMogLXax1vj:jjwsSa5IfpK7xOpOMWnDxXW3WPYMTX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735486, "uuid": "0df54a8e-aff3-401b-9591-9c8b4e871836", "value": 542720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735486, "uuid": "9f7d99e0-493b-44c4-9e06-0180503b5064", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735486, "uuid": "84e5f5a6-85af-431e-9da6-af2950bc02cd", "value": "Sat\u0131nalma Sipari\u015f No.129099,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8e5d3f-0abd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Cerberus)", "timestamp": 1686752000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752000, "uuid": "c8c2eaa4-3647-4fbb-810e-c71f24f714dd", "comment": "Malware payload (Cerberus)", "value": "dea6771be19c050e11694df90336d400", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan.hqwar", "colour": "#EAC03F", "exportable": true, "hide_tag": false }, { "name": "Trojen", "colour": "#2193A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752000, "uuid": "6d8054e3-f7ca-4fca-b079-84c87d2529c3", "comment": "Malware payload (Cerberus)", "value": "7a65b831c9f781e49c47393345bbe2ffff6859a608b9a5413d7f3b76683ff178", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan.hqwar", "colour": "#EAC03F", "exportable": true, "hide_tag": false }, { "name": "Trojen", "colour": "#2193A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752000, "uuid": "e3dbe384-2f61-4d3d-a3ed-6bf56f5ba93a", "comment": "Malware payload (Cerberus)", "value": "89ee06f706c25921dc4025078f08bf1f8b270343", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan.hqwar", "colour": "#EAC03F", "exportable": true, "hide_tag": false }, { "name": "Trojen", "colour": "#2193A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752000, "uuid": "e5c8e65c-03a2-494d-94c9-a7daaf89e800", "comment": "Malware payload (Cerberus)", "value": "1d1832a4ece0de463246da2c206a18497a0800d44877a04e0c49e0388c7cb4e66c0eea2ab08726442573db9f33c65865", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "Cerberus", "colour": "#B9AF01", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan.hqwar", "colour": "#EAC03F", "exportable": true, "hide_tag": false }, { "name": "Trojen", "colour": "#2193A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752000, "uuid": "1174941e-bbc4-42bf-9776-3703c14c6e24", "value": "T1C8B523D3458CE17BC935563E70EBE091F99200A39DB2912BAFC1CD55E8E7DD32272889", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752000, "uuid": "bc09881b-cb37-45bd-8269-829de5f92cf1", "value": "49152:GsUhzGTzpUllkhrr+0lDbk2Ta+RJA0dzGUDUOcCB310TwcxfWZehr6cBSoLFVMtx:1pXCloH+0BbE+RJjzGUDhIwqfbrxLQtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752000, "uuid": "b480eed6-fc7d-43a0-aa06-b50418980ec5", "value": 2402916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752000, "uuid": "29f38877-afc9-45fa-9e9e-ebe4638782d9", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752000, "uuid": "4dfded98-0231-43ac-bf44-4d2bb7afa830", "value": "EBA (1).apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a156dffa-0ad1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1686760596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760596, "uuid": "1e3f56cb-868d-4216-8fa7-be182f7f3397", "comment": "Malware payload (NanoCore)", "value": "031eac3d1f21f4aaa03315c6237cfbb0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760596, "uuid": "6f3403f6-6209-4684-a2f3-dea16bdc18ec", "comment": "Malware payload (NanoCore)", "value": "7ac86b5adb380a31243a480d2665b4b7b78ea177a824bbcfbf785fc7b34acb71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760596, "uuid": "3778d6df-7e93-4060-b6eb-d23c2733470e", "comment": "Malware payload (NanoCore)", "value": "4a1452f730eebcebd0e8bb6aff5a8c86a21a87cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760596, "uuid": "bc4919e4-50cd-4d5e-92ef-54e0f340881d", "comment": "Malware payload (NanoCore)", "value": "fc4a8c0c115b0351b7230d118fbe512970cf54092a9cd671067ab2139c914fac18984abb8ae29963a990aa006d39b966", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686760596, "uuid": "35113c15-2037-407a-8bbf-64613c744908", "value": "T1C264122D6BBA5320D49F4F3BB027A1224F6126E66D176E177845B02C74C739BE852CF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686760596, "uuid": "c90cc64e-0c41-435e-80c0-89af635c11e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686760596, "uuid": "649a74c1-8513-4bd8-8050-202fc11ec04a", "value": "6144:tKhiy7kfS4J8TexrhbbkKD7CpjRPbapgIN5Xli3T1Fuk96nWK7F:WD7kfS4J8TSrhPrWBRPepgI5X0D1Fuki", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686760596, "uuid": "0a417da5-a5fe-4d0b-aaf0-cf5e2e61dd90", "value": 319488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686760596, "uuid": "627d720d-283e-4b02-ad13-03b617fc2946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686760596, "uuid": "0eb5e559-55b4-4772-8366-05bc88088c3d", "value": "031eac3d1f21f4aaa03315c6237cfbb0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27dbd078-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686750514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750514, "uuid": "27d8515c-0689-4702-917e-29ee2e1ce7a0", "comment": "Malware payload (Mirai)", "value": "a118dd4f0b1888a7166e12650d72f79c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750514, "uuid": "a04b423a-1bde-4444-a62a-cbcb0bcd2a50", "comment": "Malware payload (Mirai)", "value": "7ae2756c71ca12113f54711b05d86b0a93b3c8c7b0bc88043f6a1012628311af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750514, "uuid": "ec92277b-9294-4f49-b4dc-2810688770a9", "comment": "Malware payload (Mirai)", "value": "0db174f37f33c4c0cd105df89caf931b797fcd65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750514, "uuid": "36c0721a-6a18-45e2-bd0a-0cc16737e20f", "comment": "Malware payload (Mirai)", "value": "add27b7f03935a3886e7d71bcdfb28e3539b20b77022f102931ea2689ee0768c88727bf38358d8e9258ce87da42a778f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750514, "uuid": "0e3ac97d-740b-462e-ab53-23df22b9b3ed", "value": "T1D692C090FBC79613C9709D31EE648903B3A31B3DC6E67533711065A9AEC110BA27D1BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750514, "uuid": "6d85f294-a42c-446b-a6f3-040493f16297", "value": "384:PjZsVZWpY+oCxtXp0YCKPCfLW3dp+kXNFR7623873551lchymdGUop5h8UB:CGm+T/ZvCKPCfMX7/3iJ/lcs3Uoz+UB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750514, "uuid": "f6998490-822f-47ba-8862-370f16d92716", "value": 20504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750514, "uuid": "934dfa3f-31e9-48fa-9c5a-b6b18edae76b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750514, "uuid": "8d720e75-eee2-46ec-ba7d-c92395724cbc", "value": "a118dd4f0b1888a7166e12650d72f79c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cee1fab-0a95-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686734712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734712, "uuid": "d7ca84e4-8857-46bd-87a2-74464e1e1583", "comment": "Malware payload (AgentTesla)", "value": "cdf8661bfba3b34c9c876c216db9bac1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734712, "uuid": "97cee4b8-28b7-48f3-a3fe-f93484ef19d4", "comment": "Malware payload (AgentTesla)", "value": "7bb1a4ceb5f46fa0a8313404d39bfe9838bd8ec84ee1d2f8ab9ddb41de92e8c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734712, "uuid": "e92bc639-5fd5-4397-90a0-deacaa972cba", "comment": "Malware payload (AgentTesla)", "value": "30dc311efcb113155f32b818b171e7e3ffa03b88", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734712, "uuid": "0e8acc96-1a0b-4fb7-b149-a56296709978", "comment": "Malware payload (AgentTesla)", "value": "45df9a9c3190d1f2523eb0fc7c8501bde7f0a2fe78c030e9b29f9907c8dff78d8435ada3b44aed3b96bf801cd04edeea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734712, "uuid": "950ea585-7de2-4a52-a47f-9def0a1aaa2f", "value": "T16FF4021CB1A5F7B3C6BB07F8E48250B293F990551135E3C42C49B4EB91F2B9D6B62683", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734712, "uuid": "6e0b0fef-d232-4e55-98e4-9ee06621e496", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734712, "uuid": "ac6aec6c-261e-498c-a448-d164bf275d88", "value": "12288:WYIZYFeueRy5KPtlaA3OK4nwFpJaKdpkyoQGqUerMvcL7eiKEXqXdVFSZ2:BIZYFjkyYPtsAN4nwjJ/kvQRbK4qXdVF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686734712, "uuid": "fc330821-b6ad-4c80-bacb-62d1a789d573", "value": 785408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686734712, "uuid": "49406ec5-b33b-4bfd-91c7-2dc859d4b8a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734712, "uuid": "6d4fc068-0377-446b-bfe4-5d1a4cee0549", "value": "P.I.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e66a617-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728245, "uuid": "14ba2370-006f-43bb-a308-c75f726d2a45", "comment": "Malware payload (Quakbot)", "value": "c13691a9c5c89213749c8df69d0f2f96", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728245, "uuid": "e9959817-6362-4c60-b47e-39174821c995", "comment": "Malware payload (Quakbot)", "value": "7bd9049004b444a6eb99d81744b86642ac85e4fcdd542341aa2fea3f7b0bee1e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728245, "uuid": "8afbb878-7090-4edf-a14a-a7b604ed2f1c", "comment": "Malware payload (Quakbot)", "value": "aa3b37bfc230252956a3c59c9fb8a7cc53faab62", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728245, "uuid": "bdecdb9b-d7b5-4ff7-b905-719e09ef97d0", "comment": "Malware payload (Quakbot)", "value": "ffc82231ea189d3051c793f923221ee7eb7352a159f88261b6dfe3e9d691991b22ce4fe5eac239f3d8f34c466f3a8151", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728245, "uuid": "2bb6c8bf-9a45-4ef2-9d78-cebd1497c81e", "value": "T1036432896A41E4F48233B33BCA568450FAA71E5B2084C972B97C515C1F3D86D7AB7FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728245, "uuid": "ccae3eff-7f52-4d3e-aad3-235504ed0476", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbRFxOYT1hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728245, "uuid": "f3f7ce8f-c305-4b59-844e-2c849a3683b7", "value": 336024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728245, "uuid": "7e7fa14c-c95b-4aac-8d73-ab34cf468adc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728245, "uuid": "4a9b1025-f9ef-47f2-ba5a-cb7bed6192c7", "value": "anHqRHOrsmeEsx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f648db25-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686725949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725949, "uuid": "e40cdc58-d895-4a0b-b956-f0c7d750bb2d", "comment": "Malware payload", "value": "dc197e1ae0d82da21c8a64815d8dc710", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725949, "uuid": "a79508de-3f50-44a9-876f-837a027afa16", "comment": "Malware payload", "value": "7c13a8cf1a7209c1092a471f4726ee62e6e2feaece247e1427da5cafe804d8cf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725949, "uuid": "fdff04b4-3d85-4479-b478-d3277f9d8a06", "comment": "Malware payload", "value": "afdf3aca8b72e74046625d7ad0332cde7fad893f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725949, "uuid": "5852abe8-3783-48fa-ad14-42be950726d6", "comment": "Malware payload", "value": "8463f9335b22661e4cf2317b55ff6700d505219abbf65230bf6d80446c52f453cbd6fde1f90e98525c508ff7541bcba3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725949, "uuid": "8e0a8566-0bc8-43b3-9b31-7171052d62c5", "value": "T148745445AA45E0F18237B37BDA178420FAAB0F5B10849972B97C50582F3D8697EB7FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725949, "uuid": "bc60fca3-6907-4d5e-9f8f-71344351f931", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb0EdmVZHhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725949, "uuid": "32288118-606e-47fc-ac98-172dc5a89c37", "value": 370881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725949, "uuid": "4d60cf98-3f63-43b3-b59f-7932216cd9e7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725949, "uuid": "00a73836-627a-4200-bed7-52db15e7f15d", "value": "h5HC9PIQrblKE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ca2a3c-0a51-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686705766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705766, "uuid": "7f4e880f-60cd-41bb-ae5d-c07bd96063ed", "comment": "Malware payload (RedLineStealer)", "value": "147feabf23d44e433406d76ef4f88aff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705766, "uuid": "21c49ca9-c40f-4242-a963-8a073f74d24c", "comment": "Malware payload (RedLineStealer)", "value": "7cbf1500a90a12f2af851d50fc1ef6de2a45c6b6cdd2331f73aa8689cdfa7b79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705766, "uuid": "04032348-50ea-4b84-af3e-85c5ea75e5d4", "comment": "Malware payload (RedLineStealer)", "value": "2b40da0a81c4b3cd11f4823fce56958aa0940dfe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705766, "uuid": "09b95be9-79a1-47c5-b870-819bbbfb5df3", "comment": "Malware payload (RedLineStealer)", "value": "fe248dbd91cd7b17b84d3e6e13dbf5eaa38f4dd1c3c178f1fc11a83c2a3df58be2d5de145381574800da9b3ecbc63faa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705766, "uuid": "bcabac04-5394-4203-b01a-16e6c96acd77", "value": "T124941BD01D879323E93B4FF2D6B14AE39598EE73071282AE1E829F777514869CDB8D01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705766, "uuid": "333f0da8-9dea-4176-8d8a-9fa3ca269f2e", "value": "5b43169544844188711b217df61eb2d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705766, "uuid": "caf712cd-710b-4160-a0ae-30664eb130bd", "value": "6144:y5+7qXVcJkBiy+/atAGjbSECZdNbt/mdaT:6+mcJO5+/jGjbSrHka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686705766, "uuid": "6d9dadb5-09b3-43db-abb3-7d85303dacb1", "value": 408736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686705766, "uuid": "64683e1e-c3e3-43cd-876f-4ac5fb236a37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705766, "uuid": "c9477c57-8bbb-4f55-affa-3139fe13e33a", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f07a13f-0a52-11ee-b3cf-42010a9c0076", "comment": "Malware payload (OrcusRAT)", "timestamp": 1686705858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705858, "uuid": "67a8b2f5-c722-46d2-b3fc-60463c96fc21", "comment": "Malware payload (OrcusRAT)", "value": "d0d5380f649e52bafc30aa4376ff2b3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705858, "uuid": "7e74a323-dca5-4f4c-8e82-65c94f3791ca", "comment": "Malware payload (OrcusRAT)", "value": "7cc49809dc4bb7e531f1f5c489f8f8c3ac7d79ce9621aa8fcf09d319e16a71ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705858, "uuid": "ffd305e9-b1fc-421e-9565-760afa96c07e", "comment": "Malware payload (OrcusRAT)", "value": "0cf478b8df2dc6eebf28a2518d77e1bf0993c11e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705858, "uuid": "722278d9-dc66-4a09-b90a-8141d0112855", "comment": "Malware payload (OrcusRAT)", "value": "0c153c8c7980e4082debd5d6bf6a861de1028031aa2625930583907c49a362c2733c782e8cadcdbda5daec804dcb6f49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705858, "uuid": "b9c12d34-e12e-4c5d-b939-95614c031ed8", "value": "T1FD36BE013BECBD07C1BE2778B6731AC90BB8E8066052FB5E195861AD1D9FB01BD15367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705858, "uuid": "c1b5b44f-1fc3-4b1a-82f0-5e35fa4353a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705858, "uuid": "8ba71859-c300-4d55-8d07-99f3538e968f", "value": "12288:DoHWszy2LkjKgEX0pq5g7dG1lFlWcYT70pxnnaaoawBm7cfpCt6IV64erZNrI0AM:3eu4MROxnFYZrZlI0AilFEvxHinj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686705858, "uuid": "c01eed67-c9eb-4b97-bf88-1c20c8bb6c88", "value": 5242879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686705858, "uuid": "b3af4ed7-f472-483a-979a-47dc2a4c085d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705858, "uuid": "c78ba8d4-4588-4890-897f-af2d66e49b0b", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d262455-0a81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686725988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725988, "uuid": "3885e965-9f65-41c2-8b1c-812adef1723f", "comment": "Malware payload (AgentTesla)", "value": "01ff513f788e2f8964c2db9d58a2e3c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725988, "uuid": "a39c1089-9449-4f08-84a9-9c663d975c29", "comment": "Malware payload (AgentTesla)", "value": "7cdadb18edcd84c6223b48a00dc074dfec26f8416b754acc87f1231ede8bc42c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725988, "uuid": "e633d0e5-0726-478f-aa37-057a4458ad70", "comment": "Malware payload (AgentTesla)", "value": "419e056727da73f3eb164d1787ef1caa9ef5a54d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725988, "uuid": "04a47c6c-8ca1-4c17-b33e-5ae189575338", "comment": "Malware payload (AgentTesla)", "value": "2c18ece957388022bfffb3e1c9cd6c2b3b9f066a947d15ec3cdc245f8fb505d287a3acf2d4f4fa31bf6c0c6645eb8be8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725988, "uuid": "98ec5367-3e53-40cd-8006-7ac22124dee6", "value": "T17A05D0417A3A291BEEB98BF54120727083F62E5E621DF7D84CC270DB53F2F894651A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725988, "uuid": "7a9e85c1-cf8f-4e5c-855d-bd13d5239843", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725988, "uuid": "47b4e4e1-f1c9-473b-8a5e-1aa50c56762f", "value": "12288:9lKnunEXqXdVyCKVsuEbDbiu++jvVX8/vtMuixPSCtf:aa4qXdVrHy9+jaNMuixPLtf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725988, "uuid": "1b1ac0bd-e9d4-4b70-9e82-98cabc971f03", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725988, "uuid": "dd873a95-ef5d-46b3-a196-faa14fc5f810", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725988, "uuid": "b0a5ea49-75d1-47f4-9aa3-bbe075aa6f43", "value": "41570002689_20220814_05352297_HesapOzeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "382147e3-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728207, "uuid": "1e03cb1d-7b71-43af-870d-77314ea6a04f", "comment": "Malware payload", "value": "2d36ee898c4f991cf39ccf91f9367bdb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728207, "uuid": "b93cef9d-5492-41e5-92ea-f1befa0c3e78", "comment": "Malware payload", "value": "7d62555b7556b1b9005b72497f471b0f4519e9d459cc69a9f3eea3ccb3df175c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728207, "uuid": "06c75834-5d26-4986-a3f2-0cdc690d3f62", "comment": "Malware payload", "value": "de4e12b3df2725fd7f5f021febd142f23dbb2d46", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728207, "uuid": "9f81edc3-740f-4f80-9612-e6c96e85d058", "comment": "Malware payload", "value": "70dc2417e86bd8771cf168e2d3bc00f6a63193f9e11550bd0770b771654428c91e1bc9de32d911c062097720639df6e1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728207, "uuid": "4d1f248c-568f-430d-a22a-f4f0c00afc3a", "value": "T1E36422896A55F0F08237F37BCA578410FA6B1F5B1084C976B93C90592F3D8196AB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728207, "uuid": "329ba6ab-35c9-44e8-b354-c57fb76dba3b", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbhRoAxhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728207, "uuid": "c7a6f9f8-08e2-4e82-a7c9-1298fbad4c9c", "value": 320325, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728207, "uuid": "1c09d59b-5ff4-497a-b394-30be5e48a368", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728207, "uuid": "a57b4e96-4389-4d50-bdf2-bd7e4e875940", "value": "bheaZ8wIFSjXgZ.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e52ced3-0a97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686735466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735466, "uuid": "dbec4b61-3321-4ef7-ad4c-8450056b8658", "comment": "Malware payload (AgentTesla)", "value": "437e9a9b1fadeaf96020a2bc02b0f501", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735466, "uuid": "8be85988-71d0-4540-b900-c1f221e25ddf", "comment": "Malware payload (AgentTesla)", "value": "7e1aa5a27b397de94ebb0593c2a4aa59d90c0179539ec982c93848ff6470b9c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735466, "uuid": "8c72c0ed-e64a-4265-b006-84321ef95f16", "comment": "Malware payload (AgentTesla)", "value": "d5f8948f1d3d23414675f8050d730ba525078c8c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735466, "uuid": "8c298c2f-6a3d-468f-90ac-9c1dde6105bb", "comment": "Malware payload (AgentTesla)", "value": "7dbf3d51e3c76bae22e4ed517b813d948708ca9bcff32c0723c49eb284eb4e996ba61a6accfa9990314fea9bfcbe390e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735466, "uuid": "805ba598-1ec3-4a48-adf3-4c74282b3f9d", "value": "T1CA05028497FE8707D9BB67F4A47051344BB2F96EA136E35E0E41B0DAA923F014E12B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735466, "uuid": "d6f54b5e-dd13-4538-ac0b-15125d20f6d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735466, "uuid": "3e0b8f78-e7bb-4c24-99e9-5c2ff28632c3", "value": "24576:qvgaWA7GkPzx4wZlgw9h5KuvxDyHM4qXdV:qvTWAKkZlj5Kuss4qX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735466, "uuid": "ef6161fd-b695-422f-bba5-bfd43f94e156", "value": 795648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735466, "uuid": "99f97a81-2e73-4611-9d45-b88c52b95bdf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735466, "uuid": "230445c5-02ac-4879-8410-07f55cb6a838", "value": "sS87CGnbDWZ72N6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3fd7750-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725892, "uuid": "54fd5584-ec7d-4979-bba9-97a02ea5a887", "comment": "Malware payload (Quakbot)", "value": "4752d7c33ef96db9dbb1569f9a9b870d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725892, "uuid": "8cd552b3-065f-454c-b01f-365eb32e5639", "comment": "Malware payload (Quakbot)", "value": "7e1cab198ebdfb8e9928b8108e9c8018d1c7dcbb4d9097f49a04c3187da3c7cb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725892, "uuid": "19161b49-ef00-4eb6-aa0c-6ca3c6f34b04", "comment": "Malware payload (Quakbot)", "value": "e39eeaa2afa7ba7ddb236ad35096e85c036b0eff", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725892, "uuid": "e681d15f-acbf-47dd-b39c-86dd19971825", "comment": "Malware payload (Quakbot)", "value": "5b66a07ad16238d68a3ec26fbefc912f0bbff82a88293a2551b121727539ab8a9d8e7398be5b6702219ad59668cddc4b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725892, "uuid": "47efb0de-f131-49a1-ae02-e54764d13c86", "value": "T1D67411495A45E0F14237B37BDA168010FBA75E5B10848932BA3C61582F3D86D7EFBED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725892, "uuid": "0046114b-3227-4a4f-96d1-e305be403070", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbGSBrj0hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725892, "uuid": "33c0a2fd-c855-42fa-97f2-0aa03ded05d5", "value": 356995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725892, "uuid": "c63f19ba-4681-4542-b5d0-0804eac342be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725892, "uuid": "fbfc86f1-339d-4b0b-a9e8-064d401426cb", "value": "iCjXl17olDWOPw.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83f96aa5-0a7a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686723181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723181, "uuid": "9e20577e-7138-4106-89cb-0364073c0ee9", "comment": "Malware payload (Amadey)", "value": "c07d7f76a4e87d5f6570ad144d5e042c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723181, "uuid": "f89a3931-b1c3-40e7-9fcf-d3cc968702af", "comment": "Malware payload (Amadey)", "value": "7e377f9e9a8c3ef5745ac7a94dd0cefef7bbe6339441b80b141746fc332c691e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723181, "uuid": "a1be225d-d948-47a4-8d77-f632c14e09f6", "comment": "Malware payload (Amadey)", "value": "ed674ca493e7f718dcb4eb2d7a0ecf73c1158f15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723181, "uuid": "b5950067-8fa8-4af6-a58a-9cf961edd59e", "comment": "Malware payload (Amadey)", "value": "53ec325b2e924ab1c14c04b52f3375a44773d90682952155130d9ac5047c14ed7b99b5efb0d3f339ff06e52b8ba725c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723181, "uuid": "d1500b55-85cc-4040-9d9a-a99a3239bc7c", "value": "T11B0522277AE68532C8F157B049FA0A831A3DBC916E39C2AF5383584D1CB3698747177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723181, "uuid": "1c9aef0b-0488-4bf7-a8d1-efc01b7c18be", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723181, "uuid": "b80c7234-0411-46e2-b96b-33de24b2cf37", "value": "12288:kMrky908d/UxzHA7cDb6lqCmU2f5VmwzwpUf/pDXmgqJOy87QxQjX/PFcwLSe82D:Qyvgs8tewza4bqJOnQInFtHk78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686723181, "uuid": "dae4a020-ccd2-4b45-b6c4-9055e232d490", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686723181, "uuid": "8aaafd0b-ca92-402f-bbb5-55d0e507e0e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723181, "uuid": "884ca9e4-1551-4051-ab2a-f39f7787cf75", "value": "c07d7f76a4e87d5f6570ad144d5e042c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0f01027-0adf-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686766608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686766608, "uuid": "4066d2d6-60aa-43a2-91a3-1ccc38c5c6bd", "comment": "Malware payload", "value": "1579be3d2f681ffd63a7b64af2ef22ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686766608, "uuid": "100e9d43-f232-4aba-9105-491a51d9aed2", "comment": "Malware payload", "value": "7e5f90a23f501b938d12c14ccfb747fc8832ba25da231bb3608bcff7b0e29a2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686766608, "uuid": "5e614669-418b-4525-8396-40123a778cb0", "comment": "Malware payload", "value": "e63578ef7a0d64fe4fe57a8cf970fd0ea9914713", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686766608, "uuid": "57d6aed6-5866-4b9f-aa57-4447c0adf397", "comment": "Malware payload", "value": "8101478944444df928d52e8d91309fa07d40162c8d851987f023013eca5b7c304e0f16552995b0243ae64d4f22b962dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686766608, "uuid": "3ccc5249-189f-4f62-b29e-431dc2c5d304", "value": "T1C454E02371E0E831D5A35A314E3DC6D8B66FB8521F746E9F13681A2F0E722E08977356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686766608, "uuid": "1e8270f9-8e9f-4b2a-b3dd-a33770faa296", "value": "770f7b0ac2b55bd6301ae3ba09608ebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686766608, "uuid": "61f658bd-a3f3-4340-94aa-d5fe2394cae5", "value": "6144:tw5EId5eORzpuBacaeJ9penzU9RUKTaom:tgEIDewuDPgn1KDm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686766608, "uuid": "8595558c-8d17-44f0-994b-758b7f58f808", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686766608, "uuid": "c4114626-93b0-46e0-8eee-b1c654cf9520", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686766608, "uuid": "5b59f764-6481-47c2-965c-d5664c211591", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43b4208f-0a8a-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686729945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686729945, "uuid": "da6aee33-4417-419c-917d-e963ba5d10a9", "comment": "Malware payload", "value": "166bd54a086bb68ffdf0d74e484a0edb", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686729945, "uuid": "269f44e1-6fdf-4e07-adb6-6cffb85a3c50", "comment": "Malware payload", "value": "7e9362b520bf227bfa1c152710b76b7ff83f41f4a7cae42bbb3cfa1473bb0edc", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686729945, "uuid": "4b78e7fc-cb2f-4309-8f5e-ec3265cf94bb", "comment": "Malware payload", "value": "0e62681c403c4523e137f73cf4912fb9fb878b8f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686729945, "uuid": "520db519-407d-4a1e-933d-0e5362d366a6", "comment": "Malware payload", "value": "a7ab24261b1a125e1a7b5d11a8e3354e5231ff85fc3ebf7fb65cc93c3c7ede7cb6501e81b0169f4d8dcd757f576fe10d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686729945, "uuid": "17693d71-a1dd-4f30-93cd-df5601ff9844", "value": "T149D41E6013E99A0CF2FB3F556DB952846F62BDE6BD7AC15C132024AE0D74E94C9B0732", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686729945, "uuid": "39a74a6e-38b2-44f2-8916-e85ed6192774", "value": "3072:/4K9fy3oNVGejWMSL9qi4FvXyOdPt70E/Q/D/hdDN/SnkNpXNb5tn/3hk+nMsEcr:PGRoW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686729945, "uuid": "48628a99-edfe-4ca8-82e9-6d99f0a3beb7", "value": 636930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686729945, "uuid": "35211305-8a81-46c6-9867-91c5a9f34911", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686729945, "uuid": "d0eaf924-b1da-45be-8272-7a2e39a09f7d", "value": "Notice_13_jun_2108986.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da7ee6b-0b0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686786252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786252, "uuid": "c7be19d2-8908-418f-b0b2-8da284191e9d", "comment": "Malware payload", "value": "07475790c917cac4814a886c90ccf7aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786252, "uuid": "2b7b8da2-9950-45eb-8c54-4068fa15c9c9", "comment": "Malware payload", "value": "7eec0cecf20acc0ae5c19f0a4f26599f30a930f57ec684499070f76fe9d8a151", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786252, "uuid": "8a9a5a1c-49c1-4e23-941b-90542df0bd41", "comment": "Malware payload", "value": "7777b3806ad4464e86b9e35fb44f13658f8940eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786252, "uuid": "29c1457c-571e-4673-9ec5-60be1ed87f76", "comment": "Malware payload", "value": "1255a1983989aa0be445188f30ea42c34bd603b11cfbdb7b4c0de3810bcebb73c90f4a89cb7dbc19fb2412d81ef757e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786252, "uuid": "ca939645-2ad4-4579-8c11-c9f76e38b2c3", "value": "T17A051246BBE85573E8B427708CF613870B36BDA14638D3576784B89E0CB22D59632B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786252, "uuid": "6a992ee7-f419-4c1f-88f9-e5d0b7ff5a9b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786252, "uuid": "e9ade8d1-3072-4f94-9999-45c99449bd56", "value": "12288:XMrSy90RuFRltG68tcnPWDFQOIxcrYnYoiUIRpCBXB3Cl1hTKiaVhhxL2:VytFv8thFQJxcriiN2xkvTo3S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686786252, "uuid": "32a95338-6e21-4f2b-b075-8b86bf06aa4d", "value": 804864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686786252, "uuid": "1237d077-3068-4c7f-907d-f82a673cf25a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786252, "uuid": "1a126dd4-99a5-4c52-8f27-22ba94b483dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "545e1e73-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728684, "uuid": "66954f38-855d-40e8-a1b9-bdaca1e67de0", "comment": "Malware payload (Quakbot)", "value": "f3a1903b397696ce6c2cb40db32f7e29", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728684, "uuid": "7fcffbd1-235f-492f-a88b-c1a63e4f24ee", "comment": "Malware payload (Quakbot)", "value": "7f141a6ead781ea3893bbccd921bc9e80c75dd8a7edd2fa5b662b590c029d301", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728684, "uuid": "e79713ee-3e58-4322-a3ce-31402c0d2e11", "comment": "Malware payload (Quakbot)", "value": "76f7ae09b9f7e07f5eaf1376bc1b0996a7185046", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728684, "uuid": "c00421f9-2d78-4179-9bb7-b086ac5dce2d", "comment": "Malware payload (Quakbot)", "value": "0bc2c6bf37ca994e720bf1aeb1ccd1bae75374ec68435788fafda7722cbd65f11af637efe5325e2d27b3a1e036eb6069", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728684, "uuid": "d4e9a58a-0f84-427b-9bcb-ef5fc8742cfd", "value": "T1DD6433856A45E0F08237B33BCA5B8410FA671E5B21848962B57C505C6F3D86D7EFBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728684, "uuid": "ca315ff8-0554-4b06-980a-8de8008bf5be", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbjUfCnbqrShS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728684, "uuid": "d3985eb6-e844-4e26-9635-e5ea841db27c", "value": 324142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728684, "uuid": "027b919b-5ad5-4b55-aba2-a59a8a313d0e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728684, "uuid": "924ceea3-890d-4a75-9492-596fcbbe2b80", "value": "S7ZC0B4rK1iA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c46d6d-0a95-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686734611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734611, "uuid": "ae441e5c-33ba-4a2b-9fc0-17791689fc53", "comment": "Malware payload (AgentTesla)", "value": "7c34e879f19cda6ddce16d1468298e4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734611, "uuid": "97309b61-87c5-488a-b43c-e0c965dd06e0", "comment": "Malware payload (AgentTesla)", "value": "7f4eaccd05489039f57a3d4258721fd636ce8ec8104c2184d366af9a75498e8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734611, "uuid": "51430a1c-542b-4348-bcc6-09e973d1a229", "comment": "Malware payload (AgentTesla)", "value": "4d2793ce804d1b0784d607f46890425cc54688fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734611, "uuid": "d1ab0232-a35f-4a01-8c44-b3f4247ef6ec", "comment": "Malware payload (AgentTesla)", "value": "686e5f5fc6acb39d5387112eba5b778620213355c6d03f4e8b0d3b2c5ca92ed9f93f623de46d0ba0f426df8ce667186c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734611, "uuid": "c46b174d-ca58-471d-9ca0-1a4a7546d21f", "value": "T1110550BD2A8036AB97B5DE7241D2084BF23F632772535DA821D213C6872251F37ED94E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734611, "uuid": "36ef685e-4030-4f74-9b6a-e5402b28f94c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734611, "uuid": "a3618983-10b7-4aff-9008-1e4058937dcb", "value": "12288:xQwTr3+sMJBGRKe7q6gHtSBV0+LygkDAAdfY:9mfGRfq7YBVByg5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686734611, "uuid": "d48a5dd7-57b1-4891-9470-3b86f3e12db4", "value": 805888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686734611, "uuid": "09253354-b43a-4471-80bd-a5c645bc47cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734611, "uuid": "834d7d76-b39f-464a-8f6c-992697d68eb1", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1211f21-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725941, "uuid": "2acfbe3f-648d-481f-9569-b87c3d1ce053", "comment": "Malware payload (Quakbot)", "value": "4b1ebb74ffa64ac4011d7d4371a49774", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725941, "uuid": "a70022fa-4c44-476a-91d4-12cfdea5af62", "comment": "Malware payload (Quakbot)", "value": "7f5b5bbc58fc4948ac565fd4a85019534f827304fb5b7498dcf25b7c8a5420e6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725941, "uuid": "02249a8c-7883-458d-b8c2-66e026f41668", "comment": "Malware payload (Quakbot)", "value": "889cd0dab3c272282b8e9a8af6250a108a917afc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725941, "uuid": "323e9e2c-44e6-4012-ac2d-9ecef473a683", "comment": "Malware payload (Quakbot)", "value": "26ab1c8fe45449dbe879d3ae86fbd2c49e5b476952e2c50ed216cda6d9383d92ffb32a3a8ee2d894dea0285a04434a09", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725941, "uuid": "7b2f8a14-3621-4898-969b-6267ccea016a", "value": "T1427441896A55E0F18237F337DA178010FA6B1F1B11848972BA7C51592F3D8297EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725941, "uuid": "1a252036-a519-4ac6-aa57-c810f3c724e3", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbyw1yRviK4hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725941, "uuid": "380c0f40-c802-4b8b-b2a9-e58afb73bc5f", "value": 340872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725941, "uuid": "ffc62e65-2d6a-41c9-86a2-b67550593067", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725941, "uuid": "61eb4b53-c108-4b52-8ed9-9eddda0ac2e6", "value": "gryGnFmGMNa9Eh.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d865fde7-0a96-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686735348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735348, "uuid": "f94d24ef-5972-4983-a484-f738acc28a0c", "comment": "Malware payload (Amadey)", "value": "b4dfa1573daf2b94ce47106ffc248b5a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735348, "uuid": "101eb836-019d-4489-9dd3-8d4f33cc6181", "comment": "Malware payload (Amadey)", "value": "80a5552633e679459396c1c07bfe3841fb17c55cbfd1fb836da974977d38beb9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735348, "uuid": "1ca394e5-05f8-4f60-8b13-db3588c372cb", "comment": "Malware payload (Amadey)", "value": "521ac99ab28693b6b2d3023ad47739d8daaa2982", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735348, "uuid": "bdff690e-d413-4e46-9e2a-919f1e072457", "comment": "Malware payload (Amadey)", "value": "9754773b1aa4d98d3237b949cc379ff8b0eb273cf5dd5ea655780fe84fa7f01cfde044636fc2f877dbec8be392127f6a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735348, "uuid": "8e2e9cc6-2e47-4271-afdf-cf4be7460de9", "value": "T1E9051285A7D8D1B6E9F51BB02CF66BC31E3ABCB11A3D817B2701644A0C73781697136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735348, "uuid": "73827b31-fdfe-4607-ab44-7878ee4114fc", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735348, "uuid": "dfe3143e-16f0-467e-b817-f4ea6d2aa30e", "value": "24576:oyf2SY0sXe8xvhGm4fdp/D6JQCJfC7F5+GOQS:vJMX1GldZ6CCJq7OL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735348, "uuid": "e2d4e521-f7d3-424b-9c92-761325a97680", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735348, "uuid": "d8534a21-90c1-496a-91c7-b9a628f59789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735348, "uuid": "d86b251a-e8a8-4b0f-8e35-61c663972cbd", "value": "b4dfa1573daf2b94ce47106ffc248b5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1529e2d-0a74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686720680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720680, "uuid": "f94982e4-10bb-447f-9159-344bbbd65d76", "comment": "Malware payload (Gafgyt)", "value": "86e4955e3f8abea0f31ac57d35f5234d", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720680, "uuid": "502c1865-3844-432d-b3b6-945f6de84ebc", "comment": "Malware payload (Gafgyt)", "value": "81fe27c667b45e07653d6c9d98ec43651f60308da6c3e5fecc101dcf88eb6a4f", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720680, "uuid": "51624e09-59c3-4f45-8af8-941b952d377f", "comment": "Malware payload (Gafgyt)", "value": "bbc5af25b7885eafbc6ad1c93383c22e9484f3c3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720680, "uuid": "c6b22dd6-95b5-43ec-812a-ab4c79649072", "comment": "Malware payload (Gafgyt)", "value": "48ae8afe6888ae86d30f313521da5029633e4abe7a21eaa30b1cea747e5c263143b92660c843a0a5b82fcb921d8cdc9c", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720680, "uuid": "3696c5b5-bbcc-415f-80b0-d9fe48b92721", "value": "T1C943F1535383EE60D8A3F431B1ED19A5B3B520B14E220EE666457ABBB857260CCF4FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720680, "uuid": "f55e6d8f-8852-4ef6-a330-13122badb9c6", "value": "1536:mPAnZPfFj/yDG+v8/DwvQLDeJp4egtFuJ4HSRItSd:9ZPfF8Vvis4LSp4P3uJ4HSRoC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686720680, "uuid": "202e1b1b-56a9-4bc8-86e7-95843b29c505", "value": 56260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686720680, "uuid": "0e3f2570-a4d7-46fd-b00e-fbff7dcf7454", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720680, "uuid": "90db9b26-32b1-4178-8aad-243865793203", "value": "86e4955e3f8abea0f31ac57d35f5234d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a75196-0a96-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686735350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735350, "uuid": "48901de2-a0c5-4782-8f8f-db3c538d8d32", "comment": "Malware payload (RedLineStealer)", "value": "4edcd2308ff797a7e0d5e9f43ffa1a38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735350, "uuid": "eb812f61-b6b1-4d6f-89f6-28c363acaeac", "comment": "Malware payload (RedLineStealer)", "value": "82625f73c025ec0aab39d6ee7b95dcdb978fdf9c9bcc08b3bd6997c8948c56ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735350, "uuid": "804b556f-ee5a-4dfb-880c-a4bf404760fb", "comment": "Malware payload (RedLineStealer)", "value": "b530f78465d590bbdb5edc29d8e798080eceab6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735350, "uuid": "9fae1483-6bbf-47a0-b3e3-abd8f28253b9", "comment": "Malware payload (RedLineStealer)", "value": "04d577badb7f945f94dacc77de1a02a0f7380d6b3eede31b16b2ab9486873d50a6cd8cc28523f574d04a3c311fdb9557", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735350, "uuid": "6bc8a68b-c182-46b6-beba-875fdd893e25", "value": "T12DF41356A7D94026D8B16BB08CF712C30F3ABC625935861F634EAC1E1DB36C4993177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735350, "uuid": "7bd4908a-bbea-42bb-8a0c-325ca34b3d00", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735350, "uuid": "b211fb7d-859c-4251-9a36-9fcbb0581732", "value": "12288:cMr/y90mA+Wljafdkf64oH8y9X800j4TS1746sxpJFs5NQGxJ53tAolwQitO2E2n:DylgafdkPocP4/xpJF7atAq3itNE2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735350, "uuid": "883f3a7c-3042-4f3b-ac5a-fd5b13af8b43", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735350, "uuid": "5d773279-affe-4b4c-a544-ba0f8df89c12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735350, "uuid": "2e71056d-7c44-41fe-a20c-f856a5e5b52f", "value": "4edcd2308ff797a7e0d5e9f43ffa1a38.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62762d2c-0af8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686777241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777241, "uuid": "cfc060ce-cb4f-46f3-a775-fee49c28790f", "comment": "Malware payload (Mirai)", "value": "f73e0bb259abb28251642a4ef826d925", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777241, "uuid": "826d61cd-b2a8-4c69-9f51-961145b45856", "comment": "Malware payload (Mirai)", "value": "827105be799f1e894722b05df51d583e7a1230bcfc1baafed7be3a8c705256f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777241, "uuid": "edff34d4-1945-4f75-8d0d-08ce4fe1f1b2", "comment": "Malware payload (Mirai)", "value": "cbb3083d2195d31d9dd286a0b7a198ede641a217", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777241, "uuid": "67c1294d-ab07-4a4b-800e-32070053993e", "comment": "Malware payload (Mirai)", "value": "46a066a6707b552d5259a133637b67f4cf37ccda708c6c2d59280544138ba9ae401b48b1bbd0288ebc93eaed9094f405", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777241, "uuid": "7b92449b-32c5-4c54-9575-c8eab5972d51", "value": "T1D58329796541B7FCE9F79034F80314E2289207583BACE1D3B493417BFEB5348A525E56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777241, "uuid": "30f95cf0-fe9f-46ea-9d51-a91f1d2f40e9", "value": "768:UwQtpV/8urSxD/zd1+xSzlqjXTSqv4kuSJyAGqol/XodL5wX2ZvB:FES5nFwTSqv4kiqol/odL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686777241, "uuid": "5760dc9c-7d61-4457-bda2-cba6ab5b4b19", "value": 83616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686777241, "uuid": "fd4613df-d28b-499c-ab6e-4f096d81c3b9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777241, "uuid": "2952eaca-3997-4172-9606-00b84f8a32b2", "value": "f73e0bb259abb28251642a4ef826d925", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab31a8f-0a5f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686711622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686711622, "uuid": "8eedc5e8-24b5-4c5a-b010-be8e908fb15e", "comment": "Malware payload (Amadey)", "value": "8b8840c4db1c24db5253d9b82aa13ead", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686711622, "uuid": "a86554ce-c4fd-48be-8c65-083fddbfd677", "comment": "Malware payload (Amadey)", "value": "8271105109e78e0fcf19fada4140231e93f6290efe7654d1c0fe92acb91a11ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686711622, "uuid": "ff1e5fa2-7d46-44e4-b84d-ed860240cb72", "comment": "Malware payload (Amadey)", "value": "08e870f5291c55daa66f466be5718566aa2f79d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686711622, "uuid": "f1ce3ed6-e62a-406f-945c-06879ea8e521", "comment": "Malware payload (Amadey)", "value": "c28ecef122cafc5abbdd0702dcdb5e2b4cd531e1107cb8459420fd40373400dad5ac0754b09ba24601b3db98a74c6a23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686711622, "uuid": "bf6d8cc9-450f-46f8-866f-61eb283f160a", "value": "T1F9051253B7FC0032C9A537B098FA47C3073ABDA0197857A717CA9D5A18B2684ED7271B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686711622, "uuid": "4477398c-9a14-4306-93e0-18ffe6cb5720", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686711622, "uuid": "e45ce6be-3771-4bc2-9d75-cbf171d1c861", "value": "12288:GMrwy903N6J9kVsYcxqspBP8ePy+fpfVA7ucwwpD6GEjNKgGMAeP:KyqIJ2Nc5bxXBNcwwpPEwHMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686711622, "uuid": "7363cd46-2440-4af1-b706-1f8a7447cd4d", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686711622, "uuid": "c471fd0c-fb51-41dd-b6ef-88ef3648df38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686711622, "uuid": "d925e414-94aa-491e-82c1-0306277746b6", "value": "8b8840c4db1c24db5253d9b82aa13ead", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b0ccb9-0a73-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686720331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720331, "uuid": "1c864a26-0a0c-47c6-a616-abc8394639bb", "comment": "Malware payload (Amadey)", "value": "ccc5370cdd32335a717ecc1dee861b33", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720331, "uuid": "478ffad8-728e-4d90-81e0-9eda2b525dfd", "comment": "Malware payload (Amadey)", "value": "82c9edf409936323db8973643e26818f71f9fc62e995f613be86a4b9c41cbd02", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720331, "uuid": "c07934a0-ad94-439b-9804-76cd1efbd029", "comment": "Malware payload (Amadey)", "value": "ee2e96feb69b70a11bac478f2ef4b7d8f0aa8891", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720331, "uuid": "dd38e1f1-6991-4b61-8505-2f2389f77087", "comment": "Malware payload (Amadey)", "value": "d98791681d776d1a6fac7a4db950b2a4e32231e330c9e470b31eec1bcff54697663d6c16e5460e84b75e3426bdba63ae", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720331, "uuid": "ffbad65e-1575-4fb2-9281-263d7c0c8fe4", "value": "T12DF41206A7D98523E86523B418F903870F30FD915E70568B3B85A96F2D73AC1E87637B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720331, "uuid": "59c5336c-d10c-4d69-8b99-58b69f2f1eb7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720331, "uuid": "ac3cf142-11af-40e7-aeb9-755b05ae088c", "value": "24576:hysyuO+bIlCoGYCpmzHLnLhA/tOKg+Uzd:UsyuOplGnp0JEET", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686720331, "uuid": "832144b7-1246-4526-bfdf-ed8ad780600e", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686720331, "uuid": "c4826223-f9d4-44e8-9ce3-29e2023d7c60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720331, "uuid": "9c48a09f-ae08-426d-804a-55e68add1edf", "value": "ccc5370cdd32335a717ecc1dee861b33.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbcdd81b-0a72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686719838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719838, "uuid": "a1e038a9-a6de-4152-b0ff-1736ebd6d17e", "comment": "Malware payload (Loki)", "value": "c3b11f1a57341b001b34cda101602fb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719838, "uuid": "c317ded3-a6c4-4be7-922d-96978d3978f7", "comment": "Malware payload (Loki)", "value": "82f14f2328af922009bb022e324ef028b09b2570981c3d98b2a29957829a0b0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719838, "uuid": "f2266e97-1b1c-4817-8be9-531eb848acc1", "comment": "Malware payload (Loki)", "value": "603d231989e3e835837275dd3f51006d5db1438f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719838, "uuid": "ed0b893f-9345-4c31-9585-06355a458ccb", "comment": "Malware payload (Loki)", "value": "d81a7228bf19687f3543c74c9f9322ce306281163f2cd64ad14c60e5109c6327b80c2221a4181b419d4535375dac68fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719838, "uuid": "c058863e-6da1-4a2c-a452-623940e475f3", "value": "T1FAF4DF41723A2A27EABDCBF50251627097F52F5FA15DE6E84CC2B0EB52F0F804651E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719838, "uuid": "b97af730-3bcb-477f-bf22-9fc57947c15d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719838, "uuid": "2871dc2f-85b0-47e8-bf15-03c165f71f1f", "value": "12288:XrlKnu6EXqXdV9YGk8Clu0ow3CGDjvpEYneF2KHoJoL8IULd:XAH4qXdV9TrEBowSGXyyXJoL8I4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686719838, "uuid": "2c12d7a7-9c6b-43a5-8bd4-ef3b7b568651", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686719838, "uuid": "a82eed9e-7afb-4110-90b6-00813df06e56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719838, "uuid": "da6f69b7-9cda-4023-b5ea-d1e2e604156d", "value": "c3b11f1a57341b001b34cda101602fb4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a38b17c-0a6d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686717447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717447, "uuid": "3935d505-0483-4818-b2fe-49d319003ee1", "comment": "Malware payload (SnakeKeylogger)", "value": "e92997a9c79499a5c22dac469f236a71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717447, "uuid": "3cc3aa07-02a6-45a7-be3f-d60bf6130dfe", "comment": "Malware payload (SnakeKeylogger)", "value": "837657c72effe9da508cb38d2110e6f664f239f88558948f10d265d9ff3a3f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717447, "uuid": "0e316ab5-fa30-4493-8ac1-aec5dca4b356", "comment": "Malware payload (SnakeKeylogger)", "value": "e2cf3d844cd984ab4dd6ef74f38920b85b1082e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717447, "uuid": "b2306922-2a03-4249-9bfb-5a16edc4945f", "comment": "Malware payload (SnakeKeylogger)", "value": "42fd0c42b52fcfa27465f98a152ebbeef09cd4bd59c8fd90faa7faa21e9dad0cfdbf10b2e8af942b069b1e0edce27a24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717447, "uuid": "117b22c6-a919-4538-966c-6e0aa5ed95a2", "value": "T1B2F4CF81713E2A23EAB9CBF50250627087F62F1FA65EE6E40CC6B0DB56F0F414651E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717447, "uuid": "103eed10-e2ac-4c5d-9c4a-c32471055313", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717447, "uuid": "d9d16cfc-9d56-4e07-976a-98466259f07f", "value": "12288:llKnu9EXqXdV3TcOrvpTM427w+rTIZ6882693e/PViOI2X39U3pn:SQ4qXdV3TcOhMzvIZl8H93e/NiY9U39", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717447, "uuid": "2e1ebcb2-e814-48ce-9388-d12457df4aef", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717447, "uuid": "2d428dca-1699-4943-a987-00bc2dbff4a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717447, "uuid": "7413ca37-b59b-4b31-9031-352ebb036673", "value": "PO-0001050.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90fabb1-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725927, "uuid": "0797ec3f-1ba2-4796-b2a5-de97670a61d4", "comment": "Malware payload (Quakbot)", "value": "4559c72c77d2d2c6f4a1f26f72c67966", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725927, "uuid": "d1c7ae89-59be-468c-b6a8-c1d675b28201", "comment": "Malware payload (Quakbot)", "value": "83ab13a53b95f51b806b1848e60bfb6058920817d8dd5603f6408435dc3b849d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725927, "uuid": "e1687b4f-51d8-4713-b932-6eaa8f748bc7", "comment": "Malware payload (Quakbot)", "value": "c6ff6c24af7be924943e6cd0807c9f6098e83e1a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725927, "uuid": "fb43c2f8-272f-4453-9ecc-b2013f00a541", "comment": "Malware payload (Quakbot)", "value": "25b9c5b94af623dc17f926f61c927ae1697f8e633607648f8f83d47ba27cc50690f02ecc0944c113d3a718316d06c8d0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725927, "uuid": "f46fef98-6f90-4996-9141-21c015fea63e", "value": "T1327461486646F4F19237B33BDA174060F9AB4E5B20848972B97C505D2F3D8297EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725927, "uuid": "4fe89374-be83-431b-b45f-245ec1d01e3e", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb976hki9cyw58WmanhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725927, "uuid": "16780a11-5128-470b-ad2e-5beb6dff6617", "value": 345425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725927, "uuid": "50824f05-77d5-4312-b63d-22c439e47967", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725927, "uuid": "2644ccce-43c7-4ab8-9d80-90c43c421802", "value": "hXG8u0BHqA3mj1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b83d15f9-0a5a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686709524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709524, "uuid": "53a04e89-b201-41d3-8c2c-fe5aa6cd1847", "comment": "Malware payload (Amadey)", "value": "548650124db67b74bd5f7932c12056dd", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709524, "uuid": "3e9427a7-6786-4e40-9a6a-a317de210cda", "comment": "Malware payload (Amadey)", "value": "83fe0a833e1523ae6c199671959c1e42cf923f22d0c23803d3062b8bebe0603a", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709524, "uuid": "a8e815f0-9e61-477a-9559-94ccb14c1be7", "comment": "Malware payload (Amadey)", "value": "b759d46fd891d6fbf2eabc611e5ec196e22d181b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709524, "uuid": "02c0f4c9-1745-4733-9928-4e668662696b", "comment": "Malware payload (Amadey)", "value": "6e82d044d00ddd9d4f5c43beac52a2527fc4ca0c5c99cb65f7431df5a3bcff9eb9838f1c91382eeca15e85a2cd51e30b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709524, "uuid": "7c5994db-2402-4f76-837c-08f81f6773b8", "value": "T1C0D41253A6D98473D8F16BB019F603D30F7ABCA15DB8925F17959C5E08726C0AA3233B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709524, "uuid": "62caa48c-3a3a-4d86-a775-61194e0d04f1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709524, "uuid": "8996a966-bce2-4fcb-b4fa-bf8a395e4344", "value": "12288:eMrPy90LgEgbPfRvy910T0pX4+pvKyut+Klv:ZymKRvwm0ptvKX+0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686709524, "uuid": "7b049c95-8115-4b46-a141-3952b9670617", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686709524, "uuid": "9fdc3f50-4c84-4d47-a4d3-c938c6c2ed2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709524, "uuid": "fa913bd4-5034-41a5-a5be-137c0fbc2247", "value": "548650124db67b74bd5f7932c12056dd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a5f69fa-0af9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686777550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777550, "uuid": "c617ca4f-6f2f-4e21-9142-0f3ced14fbfc", "comment": "Malware payload (Mirai)", "value": "402239dbc2cd0cba74c67f87addc355d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777550, "uuid": "e7ec8431-31e6-4236-8a8b-2dc452640904", "comment": "Malware payload (Mirai)", "value": "8449671b328637527d1050b1485b5c66ef12f1e5193840de322ba3be7c576516", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777550, "uuid": "eece0538-e173-4594-a034-0d991dbad467", "comment": "Malware payload (Mirai)", "value": "a8464fa8662233aeca35ff3a46b16a80682bebfb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777550, "uuid": "e4005193-9f45-4923-9b75-cd9e40e44564", "comment": "Malware payload (Mirai)", "value": "cab4f736444d77972c99110825445ea4857529b1712bb0f9a09eea4c03e20d808c5b76274ee35a70033472ff5a0e53da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777550, "uuid": "f2d80fce-1f56-4cf0-8a57-2b8ea3b6e086", "value": "T1ED130218F2A8F6D9F91F0E35498147F12F94A2D06F17C94211CB1702B231A966BE6BC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777550, "uuid": "48669d90-a860-419e-8192-f97245cd1a8f", "value": "768:1W+JZmtT7xuSzPG4Kdcm/6vyfI+hHZ7wsKk9nw2gC+IuqHfj4Ce84uVcqgw0RTWR:1W+J8T7xuuRyhhHOs5PR+04Cn4u+qgwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686777550, "uuid": "95cbf947-e2ca-4379-b80c-a93b247f55f4", "value": 43436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686777550, "uuid": "ce3b9ef0-4a46-41fc-9e46-6483f9c9825a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777550, "uuid": "9d4fed61-5d27-4200-ba80-979f13118e6e", "value": "402239dbc2cd0cba74c67f87addc355d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab31eb5b-0a7a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686723246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723246, "uuid": "42e02368-cd97-43a4-bea2-929ef34b7945", "comment": "Malware payload (AveMariaRAT)", "value": "116e42afc80aa29b77e37955a1434bb8", "object_relation": "md5", "Tag": [ { "name": "aufierionformaticascom", "colour": "#F12079", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723246, "uuid": "8c936680-f791-4c58-a7fa-2f541733ac76", "comment": "Malware payload (AveMariaRAT)", "value": "845aea480b4e69994eec7fc5b5db0b1377746ac925bd093d327325c8d84bb576", "object_relation": "sha256", "Tag": [ { "name": "aufierionformaticascom", "colour": "#F12079", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723246, "uuid": "2e988d0c-a55a-40aa-9499-0ac010115bf1", "comment": "Malware payload (AveMariaRAT)", "value": "3fddb6606e7956510b1b3e03894db2219a6f924e", "object_relation": "sha1", "Tag": [ { "name": "aufierionformaticascom", "colour": "#F12079", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723246, "uuid": "54c5b942-c435-4432-85b6-f2c8fd567dcb", "comment": "Malware payload (AveMariaRAT)", "value": "24e642a61fcd4b50396b6c4c07b7407739cf879165d9edcc955099f6adb3659410c1f1a3fd414dcefdfdac4dc2a435e5", "object_relation": "sha3-384", "Tag": [ { "name": "aufierionformaticascom", "colour": "#F12079", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723246, "uuid": "78053490-3908-4414-a019-b9196d9f039f", "value": "T1B015D0730152FFD9FBAB1D68A40519806C24189BA76CD698FCC803BB92EE574EF19D70", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723246, "uuid": "1137c585-a4cb-45ff-80db-5fb86c6ec896", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723246, "uuid": "23abe193-1255-4748-9eb1-86604638440a", "value": "24576:l13H945bXSee+JjoeIZbGOJ6+Kn5ixhiie2aQw+bK:lVm5c+JfIvUn6cW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686723246, "uuid": "99ef16c3-52bc-4b3b-b059-9751ebf320a9", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686723246, "uuid": "39412a36-8e49-4f34-be04-b10fe3bc0dff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723246, "uuid": "9af8c210-e21f-46a0-8c6b-f78d7bcb8add", "value": "Quote Order_Parts & Drawings\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d33716-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725821, "uuid": "4f7c893a-920d-43f3-98a2-c150e1314b36", "comment": "Malware payload (Quakbot)", "value": "3318b6a0d3f9402962812395c61718dd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725821, "uuid": "64b344e3-f155-4b52-ab01-5c1565a80e16", "comment": "Malware payload (Quakbot)", "value": "855e2d5dede5dc3c5a9aaeab8100284c84f3ffaf41a65c7d6514434d9e8c34a1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725821, "uuid": "90550808-865f-48ab-96fd-3980af57d8dd", "comment": "Malware payload (Quakbot)", "value": "96416398df6893a50dd2eede757279c368fa4b44", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725821, "uuid": "31839df6-38df-4fb6-94aa-cfa58e194764", "comment": "Malware payload (Quakbot)", "value": "4ccd49ee5eecff3e62251c86f31b68e599a02ee9dd609c0c21cc241a0decf50c2fa3935c29fd1a4dec8ea3ded5f57206", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725821, "uuid": "aee2a040-fb4e-4d72-80f0-afa906351968", "value": "T1627444856A45E0F04237B37BDA179410FAAB1E5B11848932F97C605C2F3D8697EBBEC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725821, "uuid": "3c9ea089-b275-4564-8079-3143d15b6f6c", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbq0JrFnXxJ5OGhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725821, "uuid": "afd64496-b311-4e56-b882-6f529800ab02", "value": 350757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725821, "uuid": "bee64527-7b1d-4433-9029-82d3481c5f54", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725821, "uuid": "4e9cdacf-6f73-44eb-9bea-2a26e91b5a28", "value": "jjkER9Z7sl68j.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bb84704-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728670, "uuid": "faf185f6-6c0d-46ee-be2a-c0640143c32f", "comment": "Malware payload (Quakbot)", "value": "7c75c7a3ae114ffa9d2f74073126654b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728670, "uuid": "daaa96a5-8006-496d-b607-02e8d36a1ec1", "comment": "Malware payload (Quakbot)", "value": "85aa6a26b394da306e21260aa86bb2f36550ead1086c06ffed11cd86c214cbe2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728670, "uuid": "d666fa2c-5e19-4184-b511-5c481bc93030", "comment": "Malware payload (Quakbot)", "value": "d123cb85ca3e02bd8cb47746b2a97440b1d5c0a2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728670, "uuid": "df6c17c7-eff4-4dee-b792-5171c7586a03", "comment": "Malware payload (Quakbot)", "value": "1d52fb80d32729c205ba09c422beac70b1de512f70df3dde329c225c5e1fa4206efa40e1227c7d38fe09c8f685f9963e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728670, "uuid": "e4d8e503-180f-4a5a-a0fe-7c445ed0264f", "value": "T1247455456655E0F18237B337DE178060FAAB1F5B20848932BA3C51586F3D8697EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728670, "uuid": "3a712a02-684d-4916-b853-09c422f38da6", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbn6qcD3ddPls3ihKLT7bEZHf:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728670, "uuid": "29a0e914-6d38-43a0-b409-354b600a7551", "value": 347560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728670, "uuid": "3f83d1f2-ea1d-4274-b090-513df784d29f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728670, "uuid": "2fc325b8-084f-4015-919a-5f69f6774129", "value": "SEIaOWrhb4VqN.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8ff584-0a9c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686737749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737749, "uuid": "b3ccd0cc-745a-4efb-9700-ca7e7d991852", "comment": "Malware payload (Amadey)", "value": "6de34e42ae9641afbf729049bff32d29", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737749, "uuid": "28159e7c-9ea0-4ab6-8109-739395bb695e", "comment": "Malware payload (Amadey)", "value": "863bf11c887b34e400f509188632cf5f5c6cf53aba8481146079cfbe532640f5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737749, "uuid": "0d259f70-4f60-4887-986e-2e239e240627", "comment": "Malware payload (Amadey)", "value": "790ffb1a571d910be91b15ecc079a3d188768664", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737749, "uuid": "ed548b61-2632-42a8-86aa-5cfc88094123", "comment": "Malware payload (Amadey)", "value": "e773be21507c1dbc4825c83c62e82c526c2b9d2d39ff156ac263c9489cfe384b6c2b099facca0a452b4c3129de3d7652", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737749, "uuid": "384ee6d2-1b66-4b43-af60-0fd1f2227540", "value": "T139F41252AAEC4073DD722BB099FB1683173A7CD65934636B3B4868DE1CB2690B432357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737749, "uuid": "94bd7a98-c8d4-40bf-a4dc-d95f9ba04567", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737749, "uuid": "40317f4b-f4a4-4246-9c18-8a867a57fd34", "value": "12288:+MrGy90eYwHANsTNeNyxxkRBR4KM2W9BnMjoBXj5CsNWXWsmea3:AyuEAqJeNyXYD62W3nMcfjWmqO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686737749, "uuid": "59d398b5-0c61-414a-916a-04bd42a515c7", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686737749, "uuid": "0beb8147-2920-44d9-916d-90a8640336b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737749, "uuid": "37abde61-f4ff-43d7-b11f-7706cde02d36", "value": "6de34e42ae9641afbf729049bff32d29.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905295c5-0a82-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686726637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726637, "uuid": "80a20759-1f9e-49d6-a590-bd46ae6bd9d9", "comment": "Malware payload (Amadey)", "value": "2c7f87d8b7a4bb87a8c5a1d0a6dacccf", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726637, "uuid": "9afc9777-6bd1-4d99-9b90-0198a975b6c5", "comment": "Malware payload (Amadey)", "value": "864d66b4e83d7a86cdb77eaac5f9cf3d288f095ff9b10709322c264c83e107ab", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726637, "uuid": "a3a255d2-8d2a-49d8-8ddb-3a9d9f667e4d", "comment": "Malware payload (Amadey)", "value": "5b93ce7dfb162a0c150436d2240623e8a7cc874d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726637, "uuid": "acc333f2-71e7-4ed8-9f11-7757ea76194e", "comment": "Malware payload (Amadey)", "value": "b60daf3d727f75962fb292afe26b023d29e0c63687570820f962e67b9b31892d33c471f96f150352ed2bd6d22bc22608", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726637, "uuid": "e0a61ce6-7a5b-439b-bab8-e52c306129ce", "value": "T106051202E7E85133D8B573B11AFB03530B39BC525CA49B9B2795AC4B4C712C4A9773A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726637, "uuid": "78c0e78b-b5cb-4993-aa2c-e3b7e51e35c9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726637, "uuid": "0585c93c-bb58-47a9-9756-d9b622576754", "value": "12288:WMr0y90xv23agq8h+l2J42MQbK+0mhAvjHYwM24z1XZ/rGM0:Wy2eN+gJ4sKmhADYYy15i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686726637, "uuid": "24adc82f-3e0e-4fa9-b29d-031042ee0877", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686726637, "uuid": "73487748-7f8d-41cc-91dd-be88e2f5358a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726637, "uuid": "4ec72e57-85ad-41e1-8374-3bd1402280c5", "value": "2c7f87d8b7a4bb87a8c5a1d0a6dacccf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c874827-0a94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686734308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734308, "uuid": "fa310cc5-23de-45f4-84b3-82a9519b205a", "comment": "Malware payload (AgentTesla)", "value": "b9518acc697162f3d4fcff6ee699509a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734308, "uuid": "38addbbc-ac78-4554-9c47-d2b4f4cb2467", "comment": "Malware payload (AgentTesla)", "value": "8668cd0f536fc0fb2d750d9d4ed492ac9435a32b7ade9f3e427af470bab09bf9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734308, "uuid": "b26d05fd-c899-4aa5-a8b6-134e5726dbf3", "comment": "Malware payload (AgentTesla)", "value": "2b0a0ddf4fb9ddd357890755482123891bc723b8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734308, "uuid": "90d44b25-777d-45a2-b992-4d1d7d2ef11e", "comment": "Malware payload (AgentTesla)", "value": "ca1a35b3dc1c67fea11a6f8ac81c8c11e01d9063dcd325f05600bcc89f357acd768ebf173914dbc4cf1014c324a112d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734308, "uuid": "85609c8e-2095-4f95-8bda-76f082164d31", "value": "T1A1F40244A7FD871BDAFB27F4956485744BF2B45A693AE34E1E41B0C66A22F104F02F23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734308, "uuid": "1b2cef50-7942-4e4e-86f7-c61f8f93ff17", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734308, "uuid": "ec6124d3-99e0-4a79-b9f4-46c5ec961c7a", "value": "12288:KM4WT1Uzlbt2hKuvzmgj/v0kctP1HGDNbUL3MFy0U82EXqXdVc:KMobIK4H0+NbLyL824qXdVc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686734308, "uuid": "9c8f8711-a922-4fd3-86d8-dbccab540ebd", "value": 781312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686734308, "uuid": "205cb770-71f4-487f-b3dd-a976ccc3687b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734308, "uuid": "13106242-d97a-43b8-bba6-21ef36418fd2", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0602a8cf-0ad1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686760336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760336, "uuid": "a5e3967e-d8a0-4026-aa48-76c84967574d", "comment": "Malware payload", "value": "e445fe9aeef1d21f9e77f8241cf0da3a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760336, "uuid": "33a25df5-0c65-40dd-9666-e5b9812e29da", "comment": "Malware payload", "value": "868b638c26c1b55953be58a5d445a2a2786831645ae747693d0862212d35fdc0", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760336, "uuid": "48ec082e-b9d9-4506-b6fb-10cc9f63afd3", "comment": "Malware payload", "value": "60a076d4ba88ba7eb5e563c770092877a4f13191", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760336, "uuid": "2bdeefe4-5609-442a-b617-7b0f6286fd66", "comment": "Malware payload", "value": "0c1f4355c03749dd2b994ad661842247e38b563c95158a6a5fe789faf2247e33651086663d1cff32afc2a0072798a0f1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686760336, "uuid": "82e79458-6a57-4b46-8afb-37cd3652984f", "value": "T1C8B633FC1BA1779E49288F2B2ED39566F2D3487B20CA89075C499327EDDB86CCD65043", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686760336, "uuid": "cc185ed4-fb91-4ce0-8c46-86dc67e0c99f", "value": "196608:jckTATdbDH6lGd/E+ykGv4qETBK+57BH2bd8zhPsKJuc1KTZfoTG:dTAT5Dal/xV4qETYEPsac5yG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686760336, "uuid": "013190b3-989b-4ae4-8574-d65bbfdec540", "value": 11315344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686760336, "uuid": "97a489dd-2d62-49af-9ef7-d3b32f271ae8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686760336, "uuid": "84010962-ea70-4ab9-a509-6b2bf4c69708", "value": "e445fe9aeef1d21f9e77f8241cf0da3a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00261f16-0a6f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686718235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718235, "uuid": "0549d19a-6970-4a12-b60c-5f813ce06d22", "comment": "Malware payload (Mirai)", "value": "297d1564646f18110df22aef9194cd00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718235, "uuid": "7c20f3bf-d933-4ad7-928a-7526e5c2144b", "comment": "Malware payload (Mirai)", "value": "868c98c50b3f5cb3aa7897233fe2f443a4d9eaf0280454be2255e92f318d1129", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718235, "uuid": "733c4fce-2450-463f-ba0a-4c613e5bd09c", "comment": "Malware payload (Mirai)", "value": "d767cdda289601a7b501e7d223235551eeed2ef1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718235, "uuid": "3f2d3f32-4a5b-463e-923c-ed9ec9037d25", "comment": "Malware payload (Mirai)", "value": "6b012b518f58676c80ee65d44767f330aa795c3d69a62affa9ca00c65338bc4ab60e967803409df6956d2ae74f28ec53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718235, "uuid": "039011d2-584a-46e5-9a3a-dbdcd673ced4", "value": "T1E3639D36E41A99A4C0464634B0E5DE351FA3A9C043272DB6AFE442F61803EBCB55DFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718235, "uuid": "dfe9a5f0-fed2-467a-a6be-f09292fdd441", "value": "1536:YaGrdgbyFJxwtHYJ1rATfqoI/NL/7vCpuh9C/C:Y3ebynxoCHvguh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686718235, "uuid": "bdb5acfd-63c6-4c14-be29-bf45df48b549", "value": 66964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686718235, "uuid": "4a444408-525b-43e1-9637-f435f54fd8a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718235, "uuid": "17261b49-5b3a-4245-bf5c-e63302b9eabe", "value": "297d1564646f18110df22aef9194cd00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63cce709-0a70-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686718832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718832, "uuid": "2b017ff4-a4b6-442d-8a57-f97edb06866c", "comment": "Malware payload (Amadey)", "value": "8887d5cb2c2f788494d5de4396932732", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718832, "uuid": "c9035d4c-f0b7-41ce-b233-a5110027963b", "comment": "Malware payload (Amadey)", "value": "86e2c600b2e3e5be7af6c23365e9b44ee43cdbe2d6e2c2689f39ae752d522091", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718832, "uuid": "24397a02-a13f-4377-9fd6-79288d7b45c2", "comment": "Malware payload (Amadey)", "value": "bd172d173e1d5bf1de1fd8d73dd4fc1a484b83d5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718832, "uuid": "cad21b50-7689-467a-bb2f-7709c44d81fd", "comment": "Malware payload (Amadey)", "value": "759292b859cd86ce613b1508cdec732cc9d7f762e409724d62f7205cf701c0aa609a01fe4d87683e1e93038088e30a0f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718832, "uuid": "47e29d80-2e0a-49d9-a5b4-90c08798e2a4", "value": "T1D3F42362D6D8C472D9B117B058F907D31B3ABCF19A39126E3286994F0D73AC4993273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718832, "uuid": "98d37a76-68ba-42da-8b7b-d4f8ca986cbd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718832, "uuid": "ab395ae1-3c5a-4527-a1a4-01eea8a278a6", "value": "12288:YMrIy907YoNv4+jV2HdUjiSzQ2+KVuXWF6tOu3NAfNgkYTogDVg:QycYtuI9LDPXg6tOu9AMlDVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686718832, "uuid": "984a5e0f-3047-45f1-b300-ec88f241bfc7", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686718832, "uuid": "228a310c-962e-45a7-983b-75e0cc0de9ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718832, "uuid": "76880d90-af3d-4d02-b81a-f8d22edeef61", "value": "8887d5cb2c2f788494d5de4396932732.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6906c57e-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728719, "uuid": "49bf000d-72bd-4820-9004-964455819bc7", "comment": "Malware payload (Quakbot)", "value": "29fc7d472f309a711ebd7b4250ad5ee8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728719, "uuid": "c1aae3d7-fee0-4ace-a2d4-70e161801561", "comment": "Malware payload (Quakbot)", "value": "87c2c690b9a4ccd266848d48dcddec5f21472f30e1684066638c44e7f287e51f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728719, "uuid": "9f0cb866-245c-48f4-9ef4-9edb28040080", "comment": "Malware payload (Quakbot)", "value": "ee8d354ce82e46eabc3fcd66487d7872fc4bae43", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728719, "uuid": "b8f2bb8a-683d-4cec-87f4-5880f7686851", "comment": "Malware payload (Quakbot)", "value": "54457d9f701209ebc0689ed5e4b840a89db3eb145af2c72f2f3033d9c0e51d5117daa045bd6bfc134238646a4cfd275c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728719, "uuid": "93f34444-5188-4178-a9b7-15f3c6657b73", "value": "T1A37431486A51E0F19237B33BCA565420FA6B1F5B2084C972B97C505D2F3D8297EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728719, "uuid": "bc615ca2-8d1c-4fb6-a819-b0084dd36f15", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbwq2jwNxTlhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728719, "uuid": "952d88af-6f72-4c7d-925c-643a31ba5c02", "value": 340555, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728719, "uuid": "e4e90909-de55-4c30-ad8d-f9b9d62e10a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728719, "uuid": "4b3d5299-2b74-4105-af0f-cfcc845a6480", "value": "RfIsDFAgCoRK.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88fc907-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728825, "uuid": "38fccafd-cfc8-431d-9cff-193e0d0c0dc9", "comment": "Malware payload", "value": "c69ced43c2f71edd4cbed11bd855a5b8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728825, "uuid": "7aed6b75-663f-4352-b879-ec09a7d17c43", "comment": "Malware payload", "value": "88285aeeb72a8951140bc0236c733ebec023b3eb03c55ba49979003c46300b11", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728825, "uuid": "cac8682a-d454-4ad2-905c-e01c5950e98c", "comment": "Malware payload", "value": "be5e475605cc668f8d0ddae1033533c6ef9a2c9a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728825, "uuid": "51c0b240-a90a-4bf0-8db8-345ebdee0641", "comment": "Malware payload", "value": "5844a85c2d39cf493cc7a90b3d7546a026d338021f01eafeab0322f69205c84b9be03c80586320cc4dddb93700c4e4ee", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728825, "uuid": "2e6fd218-86c1-46f4-8c1a-9a4b400df176", "value": "T1226453896A45E0F08237F33BCE174410FAA70E5B21848972B97C51596F3D81D6AFBED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728825, "uuid": "f43f0b8e-9c08-4f3c-9369-ac8c2835944b", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbsGtRj9dIhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728825, "uuid": "4fdb31aa-c70d-440f-a0f3-444ef82eedd5", "value": 315228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728825, "uuid": "bf42b719-49c5-4912-9f5c-db7024462b57", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728825, "uuid": "1638d151-3715-44ec-8ca1-1c4c9efa21db", "value": "OJhA8e6RpvSnt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8eaa5fa-0a74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686720692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720692, "uuid": "632f5f47-a5c5-48de-9ab6-2bd7a576a5e9", "comment": "Malware payload (Gafgyt)", "value": "05424fd2f808e31d5598478e5e2d708b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720692, "uuid": "e7c13242-86d6-40a8-820b-859d6bd7cd56", "comment": "Malware payload (Gafgyt)", "value": "8869b88d8a5aef158bc478d5ec6c1b18fc39bde993a176eb5f3c73a7fd5efb76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720692, "uuid": "7f18e75a-9e77-464b-bd1a-3d529cda3ddb", "comment": "Malware payload (Gafgyt)", "value": "8a89e69f0cfd3a3a68ef485b0301fe3759a2df04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720692, "uuid": "07136c2c-ae6a-4835-bd97-fb96de3b2e51", "comment": "Malware payload (Gafgyt)", "value": "24b2972e177c88fe3463b6835bd86d302fbe60df3ac4bde5e013ca9bee8efc0076668ff50e561354c731da460a01aea2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720692, "uuid": "7fd289ed-efde-49d7-b241-fa6f8233f6bd", "value": "T104048462A84CCAD7D01663B964DE8F3BDE3EB6D22B028D027DC524755E61BDB2C0BD41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720692, "uuid": "fafb9a7f-ef59-4874-89fa-815afa62f599", "value": "3072:+w8XDRn7Mfjtmt9fDr1CBFnyyDOJ3uTZ3ADfug2DR/I299Ni:+w8VIfjtmt9uyyiJ3uTVADfug2DR/I2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686720692, "uuid": "c13c52fd-f97d-4ae7-a6e8-39a0f78b5020", "value": 183140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686720692, "uuid": "1e210289-be8c-4108-a3ac-1fa14adfcac1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720692, "uuid": "d61cee1b-fbd2-4392-9648-90cf834dd10d", "value": "05424fd2f808e31d5598478e5e2d708b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c1f783-0a6c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686717327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717327, "uuid": "95ce9819-beed-49a6-8d81-5cc98c16eb55", "comment": "Malware payload (Amadey)", "value": "ef9bd638abbba6c9c586e677dead59c9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717327, "uuid": "de0404cb-f757-4250-b3c2-d8c42d30d405", "comment": "Malware payload (Amadey)", "value": "88739c7706fab480d0a3aaa62fe1518b7d6c40df7dd24ea00bed06cf263e5bd7", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717327, "uuid": "732b79f5-7ae4-441f-b01d-0fd5c67e229d", "comment": "Malware payload (Amadey)", "value": "20c544d8072481b7129749e0170a128e3f61ec3e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717327, "uuid": "e9552206-edb4-4be7-9657-e113850f9ee5", "comment": "Malware payload (Amadey)", "value": "f2c19f08b3d68eb8b60e94b9979b425fe515c87d19e7c091e0a430ffe8c8cabe678a3b823864ecfb6f5ba2f23863dbb1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717327, "uuid": "c65b2406-ea5d-4c88-b881-c0a3048752bf", "value": "T1AAD41246EAE84073D8B8277008FA17D70E36FC925EB5832E32569E5E1CB36847935727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717327, "uuid": "9075e9e0-1ccf-4292-a068-ecd225dbe8e7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717327, "uuid": "c945d1e4-679e-4c8c-a3b6-1fc46637d4a1", "value": "12288:rMruy90Xub0KgQjyVg03KzCRVBrMKUpYoRFIbD38589xrup5I8I:hyQHf8Eg0IYRg3FIbD3c87rE7I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717327, "uuid": "eb66e602-38b9-4256-a162-e2fc3fdc3443", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717327, "uuid": "b8931588-db93-4bce-b1dd-d7c5fbe9448c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717327, "uuid": "23f228a2-03d4-427e-8a89-c243f2a9ef91", "value": "ef9bd638abbba6c9c586e677dead59c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe83016-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728220, "uuid": "0782f587-3ce9-453b-84ff-a5afbf98302c", "comment": "Malware payload (Quakbot)", "value": "ad7ab8cf4ad882da6a597f30ff11ab3e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728220, "uuid": "c3c447ba-c84f-4406-ad06-b2e757261ab8", "comment": "Malware payload (Quakbot)", "value": "8913f51f576f3301a53cba804462f22c5a965e87e1acf37b23076fe661524998", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728220, "uuid": "018d605e-4488-4f7c-bafd-48fddf78967b", "comment": "Malware payload (Quakbot)", "value": "7af106152040e257df908a66f0e7e697864e3c47", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728220, "uuid": "47128492-96f3-488b-9385-7aedbdb9b1bf", "comment": "Malware payload (Quakbot)", "value": "7895278480b2ccde2a08e27d60f945b2c42001bb8ae850a508c63985982fae0937ff7df76a09b2f8a066dbb4a0df4f02", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728220, "uuid": "708bbb7b-879d-4c63-8e39-7135bd7b1e3a", "value": "T1A86444896641E0F08237F37BCE178450FA6B1F5B21848972B93C51586F3D8697AB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728220, "uuid": "fdba9281-be5c-425e-8ff3-aa96a1e38d21", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbCZ9wxIkyWhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728220, "uuid": "c092e268-89eb-48d5-800c-1e9f0a62f3b0", "value": 337039, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728220, "uuid": "2b807937-9982-4f5e-8cfa-4a0e3648ff64", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728220, "uuid": "6474a76a-d442-48ab-93d5-2faced797c00", "value": "bZfEmjWWBWJ1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23dc8c54-0a6f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686718295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718295, "uuid": "9e2174cb-5a01-4166-801b-3caaccef7b0d", "comment": "Malware payload (AgentTesla)", "value": "bc4ab1f3c3027a3ae09c492c698d8fb9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718295, "uuid": "409ec25f-9b6a-4f3f-9a5d-15efb9c6edda", "comment": "Malware payload (AgentTesla)", "value": "8a6bb1e79db9f0a2123d338504be78857498072724a24cdd885c35ceeb226b57", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718295, "uuid": "8c28d093-927f-4f26-b974-6b21568f6c95", "comment": "Malware payload (AgentTesla)", "value": "850a729ecfc6d521616429f619520a842e6e90d4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718295, "uuid": "a2137d3e-1cf2-4857-b376-ef956305bf8a", "comment": "Malware payload (AgentTesla)", "value": "c9732242193220a9db73365c0c0cdc10ddd9c40dfe756c98624e92d3d0235058dcb77702c759d5006d1d75d091a1836c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718295, "uuid": "32619bf7-389b-4832-8bb7-a4a5bb513c32", "value": "T157151C913DEF6A24603BB68A42E674B94F2EF4994239D07D484D250A1BD3F4A1D83F37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718295, "uuid": "5ce267f3-6f30-4906-80ec-65b23cb7d91d", "value": "3072:9gYcpl+og0S7axgAuf3lzyv1R6cB0/sWQD0SrWUZqem:53iZqZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686718295, "uuid": "69782d99-9492-485a-a600-1c199fb8ea76", "value": 891714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686718295, "uuid": "7ff042a1-f3c9-4853-8ea9-255edcfefe7c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718295, "uuid": "ce55acab-4c5b-4505-afd2-894e55197ebb", "value": "COMPANY PROFILE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9131a230-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728357, "uuid": "e1928d54-b781-4362-a8f2-57a717cd2def", "comment": "Malware payload (Quakbot)", "value": "c22b44069b1b975de6a325fb0fe54cd5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728357, "uuid": "1697af79-c164-4865-958e-e543fdb9c4a6", "comment": "Malware payload (Quakbot)", "value": "8a9f624cffd86aa962676fc64c27678aeca0fad692090a9c3ff88ef85ca254b5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728357, "uuid": "1bc8e817-8826-4ce4-b931-23c962046083", "comment": "Malware payload (Quakbot)", "value": "2c0b3909eb71b60219cd45f4a7073130ae05dfdb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728357, "uuid": "06b2cc24-98d1-41d2-94e3-a95f9af91929", "comment": "Malware payload (Quakbot)", "value": "ab86fbcf1a8f3e6f07c8cb1a20c11d29874062cb5e1405dc1e99696f6bb41bd5c7e4544c8a557bd2cdade4c4a40518de", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728357, "uuid": "f12c8b8c-2da9-401d-bf65-3cab8593fbad", "value": "T14C7462896646E0F18237B37BCA174450FAAB0E5B10848972B97C515C6F3D8687EB7FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728357, "uuid": "99e45976-9989-4463-97fe-d5d0f5037b51", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbN1zhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728357, "uuid": "39add521-276f-44b5-852c-ed7340d7d9c7", "value": 339213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728357, "uuid": "ff0abc9b-974e-497f-8590-c071481c9062", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728357, "uuid": "e524c696-de52-47d5-82f1-d09e89430936", "value": "YF3gPyYh7aZYWi.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbdc3cc9-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725851, "uuid": "c3d61479-827a-43c0-bb95-8f520e6b8f0a", "comment": "Malware payload (Quakbot)", "value": "010c83d2f8c71695d70e04e7c054fabd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725851, "uuid": "fe91a617-5f74-41ce-87fd-b5d17226bf65", "comment": "Malware payload (Quakbot)", "value": "8b0945c51b038dd1ce17c6b4dee9353fc9cab765d79552c0bd30489d11f012bf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725851, "uuid": "d91b175f-21be-4bf2-a77e-ff8883c72418", "comment": "Malware payload (Quakbot)", "value": "62dd9db694916bf22fca31466e645faf81ccbd81", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725851, "uuid": "50b04537-28cd-487c-8aab-49f2caddb083", "comment": "Malware payload (Quakbot)", "value": "89d540d0160e2c4047e39f0e3e7b302d4cdaa9aac2b9c4d9e1c173874425b692257fa6b1cae129e0c78c9c36465ac313", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725851, "uuid": "c7cc5bd4-65ba-46ed-a07a-cc978acf89ba", "value": "T1E96433896A44E0F05137F33BCA578410FBA71E5B21848936B97C60582F3D85D7AFBE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725851, "uuid": "b5792f8d-76f8-4e7e-8aeb-11f1ccfeb208", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbmiMMaPX5rIkxX8/cwe7x4Q+:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725851, "uuid": "b84ad923-3d09-4253-8c4e-ae81cd852e70", "value": 331588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725851, "uuid": "250720cb-0a3d-410d-9dba-0bd3717ad4a2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725851, "uuid": "4c81e28c-3335-43be-9ff7-1ec664c05b12", "value": "iccohoWRnkeL.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a368bd3-0a6f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686718386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718386, "uuid": "a0dd1f78-7b92-4f2f-87bd-7d765e6b90d0", "comment": "Malware payload (AgentTesla)", "value": "d2ff06dd4d7382df1e4f37e588cba982", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718386, "uuid": "0da0f3ca-4c45-47df-8ba1-15c7936a56b0", "comment": "Malware payload (AgentTesla)", "value": "8b9f62091a55888570c94edca554a69a8b28909113b022021372e936e2c567d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718386, "uuid": "3996da57-c13a-4a57-9c77-6abc31e0499b", "comment": "Malware payload (AgentTesla)", "value": "56c7bbd3f6d59cc9fd09d198df62f6b02dfbd0c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718386, "uuid": "50ed6b65-3eac-458b-9bd1-c6c3604e080d", "comment": "Malware payload (AgentTesla)", "value": "71d971c861cd3443c139a09572d11afc9569e7db08d2bf2d7f9b17bde2f4a0d20d2fa70ef9bcfc41c40d27bb948a90d7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718386, "uuid": "07d88920-460c-46ca-82be-5f198c0c9791", "value": "T10425C0C055486AD6D1573BB41E26AEB016EFAFF92220D2083D0776E38973F46265BC4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718386, "uuid": "d0e388e3-6ee7-4dd0-a601-c6c74949d6eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718386, "uuid": "b9a0a9b2-b205-4b8e-bd53-1e2c2bbdef73", "value": "12288:k/cvG73htU7/2eQ1x9W8dg4i018zbGrCLBP5aup/AQf/fWT+DqiBrGa:wgG1tCueiM8Xi5z2CLBxaupTf/W+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686718386, "uuid": "fddaa1a0-4394-476c-b833-bcbd71312c13", "value": 1052672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686718386, "uuid": "15046f31-f107-406a-b916-00241248e70b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718386, "uuid": "4eebfbbf-c492-4556-91bb-38ff6772c6f1", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3112171e-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728625, "uuid": "42b25a32-6fcb-4ed1-a33a-2b037f962059", "comment": "Malware payload (Quakbot)", "value": "6836ac6c71935f3c3e42bfbdf4c66e7c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728625, "uuid": "27afa877-d0dc-4759-a942-f53fc1b02530", "comment": "Malware payload (Quakbot)", "value": "8bac1e1bc404a9d9bddd15d2807b739c8f9ba94d70dd28f92faf300a043ca784", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728625, "uuid": "6458f33e-290a-4483-9d79-6e7ec1430301", "comment": "Malware payload (Quakbot)", "value": "b7f0ac4f83dfb7c55eb1b6fff91268b384b2837f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728625, "uuid": "6cc82e37-9cd7-422c-b802-fcbf9e7af766", "comment": "Malware payload (Quakbot)", "value": "c1a3a30fb4f52332e836e277e2e3411c3f0b4aaee9eec35f5daf4e3cf8bdefb824e75c2b1afbbbcba0937f6c377ebb28", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728625, "uuid": "c45700c0-9b9c-4a01-b4d7-2f50430a9a42", "value": "T1C2744484AA45E0F09137B337CE579410FBAB1E5B10848972B93C61586F3D85D7EBBE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728625, "uuid": "cc58903c-76e9-463d-8604-00abf987e75a", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbrneSa9ekvKhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728625, "uuid": "07638066-de85-464b-9c9b-1e9094893649", "value": 354721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728625, "uuid": "b543cec2-db6e-429d-884c-c5747aa8557f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728625, "uuid": "2b899e13-5ab6-460d-adf6-a09694484052", "value": "THo49kPRJm1S.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9bbf72a-0a8f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686732344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732344, "uuid": "6df57a12-16cd-4872-a8fc-e40847c48122", "comment": "Malware payload (Amadey)", "value": "82f179bc13959d0cbc2992a2fadf9f94", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732344, "uuid": "174abf4d-e1f8-44eb-87a9-ee8792c7b7fd", "comment": "Malware payload (Amadey)", "value": "8bb3d13637fba031173da7c11aa21c8df13fa46b1f4966c7ffd9cdb8fe3021a6", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732344, "uuid": "f72a6bb6-3579-4740-bb95-b3c3610ac421", "comment": "Malware payload (Amadey)", "value": "87c19262ead09cdf623cb8f2b372726439ea3c18", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732344, "uuid": "6671255f-0482-4117-80eb-994598b9b7be", "comment": "Malware payload (Amadey)", "value": "af5ef85671f156f231c554ffc4b6832f7cc9121ed81318b1b496f5624abbb19562b1457fd26994fcce48a5134e795a3f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732344, "uuid": "52dfbc4a-24af-4f19-b0e3-186b8689eb39", "value": "T179D41202ABE85573DD72173154F703A30B36BCA24C7882676746FD6B0CB25896D363AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732344, "uuid": "eca4960b-9615-47cb-8b81-7e0931e1254e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732344, "uuid": "9f36dd56-75a0-4b5b-995c-52c91df238d6", "value": "12288:hMr3y90DGElJCftW5tvdT98OppiWmNRhjHU08PWMekkq2lBmUG5N:CyLRgBdukrmNRhjHH8Pxekkq2PmUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686732344, "uuid": "223d306b-c519-4158-a2ec-43c2b138ea25", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686732344, "uuid": "785b3b03-d185-4fae-ba30-d55cb33c1161", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732344, "uuid": "8e3ef79c-9960-4b3b-85a0-351f3494e14e", "value": "8bb3d13637fba031173da7c11aa21c8df13fa46b1f496.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52bb57a9-0a59-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686708925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708925, "uuid": "815ed7a9-ff64-4582-8513-861b59b3d727", "comment": "Malware payload (Amadey)", "value": "ae38a510af25cc43aa02373b4d64d3be", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708925, "uuid": "4e50a3d7-2004-43bb-9502-3ab17380db0a", "comment": "Malware payload (Amadey)", "value": "8bba0faf5bbacb0b74befd2a265f4672d76b44bdc4862c0bd86d14024635eeaf", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708925, "uuid": "21a6ff90-c6a4-4cb5-a7e2-ff7758cf2310", "comment": "Malware payload (Amadey)", "value": "71f413dd21daf5ecbcc53d095b3ce4ef9b429488", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708925, "uuid": "355ec9c3-1c52-4ed7-8549-a314d3c4a5bd", "comment": "Malware payload (Amadey)", "value": "1864c0827587820f13b7e8ecf340f65635a4b09b181ee78bac142081fced7294624f4d0e0686c7059f4b9888d32370c4", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708925, "uuid": "228bca9d-bd17-42b9-bf6c-fddb80ad85fc", "value": "T13CD41302B7F84072C8F11BB018F713830B367DA1997893AB2395695E1CF29D4E5B5B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708925, "uuid": "712ddee6-db52-4e1a-873c-37407a52777e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708925, "uuid": "7a8dc118-337b-4cc3-94a2-c36e4bffed8d", "value": "12288:qMrFy90Ugt2mSO+xFZrRy2DQObpdbI1y1RyVVjff1mlr:vyKt2xFnjdiiRyL9mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686708925, "uuid": "c73dadee-d808-4154-9569-a63d90ec0e59", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686708925, "uuid": "a05cd023-4bc6-4bb7-9107-a90789fb152e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708925, "uuid": "41477ee8-04bb-490c-8f76-dd457d1354be", "value": "ae38a510af25cc43aa02373b4d64d3be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62215fb9-0af2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686774663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774663, "uuid": "b22f16a7-9249-42e1-8113-470e443b100c", "comment": "Malware payload (Gafgyt)", "value": "2b53d5c5c9cd9c0510e01582314d69da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774663, "uuid": "9e5b9e25-ace5-4f44-94cc-410e1a8d5559", "comment": "Malware payload (Gafgyt)", "value": "8be2928a6dee0d1ad8e151453fa93b7b6393a3e84441f208c676d8a3e72b3992", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774663, "uuid": "bdc85c56-dc25-446c-b68e-092aac9afbad", "comment": "Malware payload (Gafgyt)", "value": "47142b7344be1503f5a5c527092d8f63487ce102", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774663, "uuid": "451b4a1a-0b68-4882-abce-d57d19253bdf", "comment": "Malware payload (Gafgyt)", "value": "bc62c7f1d58d2f76ac1edfbccfc8dffe67a033636d0492358f384b4f6322588d21a15373a55bba0dd3249b2a68baf8d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774663, "uuid": "49f42fe9-69c9-4519-b532-533f19472d9b", "value": "T14CC30A44F901475BC3E327BAE78E038C77355E6857DB33156A38BDB42BE1B982D29260", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774663, "uuid": "6b5d1349-4fbb-473c-97b9-4b744f3c6bea", "value": "3072:H63VpNeuWDGeQf8sRCst3DxkS2YmyVUQuiXfQd6W:OSuWQEcCst3ZmyVUQuiXfQd6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686774663, "uuid": "4b094e94-4e9e-4ac7-aaa5-bbd9e82226f2", "value": 127723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686774663, "uuid": "ecbc8b09-373e-40be-9e32-abb75a049d37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774663, "uuid": "27d19b3d-b140-4170-960e-3ed5cbf0592e", "value": "2b53d5c5c9cd9c0510e01582314d69da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8f518fe-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725954, "uuid": "11a50d84-10d9-42a4-93f6-36a81b933392", "comment": "Malware payload (Quakbot)", "value": "6f7c6f8890489d47b47a92352852d72c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725954, "uuid": "293c602a-b98c-4288-81cb-8f0db3589d73", "comment": "Malware payload (Quakbot)", "value": "8bfac6537f5178000f74bf5e48da07372a43e4eee1f4664a4d7e4a426be3e924", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725954, "uuid": "5996bc8b-2a3f-450c-ab3b-112f6ffddc94", "comment": "Malware payload (Quakbot)", "value": "2856c99caa3e67fd8515147b126f2ae7a55365f9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725954, "uuid": "23bf2e9e-5379-4976-a1b6-be8f466fbcd5", "comment": "Malware payload (Quakbot)", "value": "6fcdf286ef1de078e39ecd0f440e5d64f31512c68ff2cf9fa3a700129c348c5cf6834e7523fe81ebf0d82952c7c519d7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725954, "uuid": "a32fbdcd-d9b6-470e-8331-913c8bd01f5a", "value": "T1EA6443886955E0F09137F33BCA574414FAAB1F1B20848932B97C515D2F3D859BABBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725954, "uuid": "a3341e57-f817-46b0-96af-5711a7c4ce91", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbkD8Rfu4hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725954, "uuid": "ea196bce-3bbd-4f43-a626-c8284ce99773", "value": 316014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725954, "uuid": "4db50922-9f23-463f-a695-76b5428c70a1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725954, "uuid": "fe8f1c8a-7611-46f1-bf0f-2e194a69b72e", "value": "gItvLziJwf75.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e25f2670-0a6d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686717756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717756, "uuid": "d489e5ef-60e6-45fa-8b8a-b6bfd280ea5e", "comment": "Malware payload (AgentTesla)", "value": "4d4c0b605b7dd4c2851a97d8b317ceea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717756, "uuid": "7e0b98fd-c148-4d11-8c37-41a1e18882db", "comment": "Malware payload (AgentTesla)", "value": "8c037a4c8c6f94acaa718cf22e89d843d2cf146ada46df61b5f11a6eee8705c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717756, "uuid": "5276e2e9-24e0-43ea-a1da-8542ed9210df", "comment": "Malware payload (AgentTesla)", "value": "8deca815873ade42712d70d4c07e28c02087953a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717756, "uuid": "49345aeb-458b-43e7-b232-e3802dad63f8", "comment": "Malware payload (AgentTesla)", "value": "51b8334e50759ac2160ed991bae5e69e8a2ee34920dc70cf47a4447e3d3ef9756a613a710dae16cd04af337d7abecbfc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717756, "uuid": "42e0d563-8376-4d2d-80ee-80e9f3f464db", "value": "T1C1A51232F150A87EE95607386DD36592410F7C653E298810334B773BB633BAAA573B4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717756, "uuid": "47fac509-b717-41ee-97f0-f4e49097351f", "value": "49152:l+GKG0+uBd/QC8mQ/6/u228BH6QTYHwh1VfLvshB4:Y5Q2qi/lHP3VfLvsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717756, "uuid": "cc0c68fb-1c59-4219-97ea-3e565670af00", "value": 2237440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717756, "uuid": "5c2409bb-b89e-4009-b733-e2239475fd14", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717756, "uuid": "74ecadce-2bf9-44ea-ba50-4f248a4c7da2", "value": "order.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d72d3d1-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686750496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750496, "uuid": "cf786b1a-6fa5-462c-a460-289a472c5e26", "comment": "Malware payload (Mirai)", "value": "18ed8120b5af32f61aba0f304cceac35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750496, "uuid": "8e65db43-7c81-4f0c-8898-6f66fbb528ee", "comment": "Malware payload (Mirai)", "value": "8c07e58f61149ceef28ab5dba5c1f0cfe342417def758c483a6662c57916a4ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750496, "uuid": "38aa9814-a989-45e1-a731-667cb4896fa8", "comment": "Malware payload (Mirai)", "value": "ce3fe58a0726d65322cc0e2159f533db38cb942b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750496, "uuid": "73050e37-fd9c-4a1f-9933-e59916a405ea", "comment": "Malware payload (Mirai)", "value": "fe4170ac5f98c8d87d833b044232724394d53001c698839698acf4798194b18afa2f5a13292800eafd1a55c51e55ff07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750496, "uuid": "2c3a21c1-cd0b-437b-b50a-ccf3a66ae529", "value": "T150736B31B9792A27C1D1A47A11F74B10B6E117CE3AE8C61E7E720E5EFF216506103EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750496, "uuid": "9537b655-0b31-404c-aead-9866ef01f975", "value": "768:Uoao+BTVXvoaRq9/ZPjrglLgABJ7SZo4lJLRmMLGBZSGizO+DksDQpK:3arBTVXvoaRS/ZPjrgtgg7SOMauupK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750496, "uuid": "fc4fd00a-f986-4873-b432-7188e4cba3bf", "value": 76192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750496, "uuid": "baa24f31-3c48-45cb-adde-c7729bc52ddf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750496, "uuid": "c4713179-3bb2-43d0-a653-276e91f0de32", "value": "18ed8120b5af32f61aba0f304cceac35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d845f76a-0a96-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686735348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735348, "uuid": "f04b302c-fb8d-465d-979e-82e889620246", "comment": "Malware payload (Mirai)", "value": "8722ce5a99d3e9b5cd0bdd2b4db06786", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735348, "uuid": "30c26fd5-827c-4658-a0d1-ae2fb8a6eeb3", "comment": "Malware payload (Mirai)", "value": "8c1a059459b9aa753c61a605c29f05efed3d9b32cbed56ad1a7f3c845188ba49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735348, "uuid": "4e188625-83f5-4382-af2c-e6f85920a051", "comment": "Malware payload (Mirai)", "value": "52f6b0559271581a7d39e9a75f346e41648a7776", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735348, "uuid": "06eab6d3-325d-4bb3-ac1a-877ea93a5a76", "comment": "Malware payload (Mirai)", "value": "3ea546c8c1cb775be499957123ae81961cbe846f71c9fd2f17e1f3740a77cc9cfc2279799a70aab25b6aa16f7ec85ca5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735348, "uuid": "4e8583ee-d1a6-412c-b49d-82c3b8fa1b26", "value": "T178C3405B6E609F19F658573009FBBC29835A13AB36E5EA4AD18FC2006E7131D5C0FAF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735348, "uuid": "8d057f36-9f45-48ae-bcf7-26ba36c406d1", "value": "3072:wISPhPh28cVCSkdCve0uPgrUiyeVKfj/GPIBWhFb1lqQG:wIyhPh28cVlEPgrUnas/GPIBWhFb1ltG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735348, "uuid": "344c4cb1-9e11-4ec8-b3f6-ad82abb2e2a9", "value": 127684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735348, "uuid": "e1fcacf8-955b-4514-aecb-baaeb6fbf1db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735348, "uuid": "3e45876e-3c40-4fe0-baaa-7fb289a97e56", "value": "8722ce5a99d3e9b5cd0bdd2b4db06786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4d59d5-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725907, "uuid": "0867539e-07b7-48bf-8738-0b043b5eafef", "comment": "Malware payload (Quakbot)", "value": "ce319187f52477d7383b17e23ab2b631", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725907, "uuid": "3fe6495e-3e5f-4cc5-82ab-458bf40458d6", "comment": "Malware payload (Quakbot)", "value": "8c32e97f9925a82a29aae9c31e5a8a9ce2f5076bb91e8a438743fcf1930c47b2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725907, "uuid": "019e600a-258a-45b7-964b-8ad3035ca85b", "comment": "Malware payload (Quakbot)", "value": "23312a04f5a46376a75c67b890feb9078d33cd44", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725907, "uuid": "e9ffedd7-08ad-4fde-8326-f0e6c7b36c9f", "comment": "Malware payload (Quakbot)", "value": "0cd2215ea778807bfd413d8a663776b823e6ec5fb7ff86f95c280aa8bf6d9b06968295d8623052dc9167e8dc3e106536", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725907, "uuid": "d4075e21-88bf-446b-bf0d-deaa3b7baad5", "value": "T18A6443896A41E0F08237F33BCE578450F96B1E5B11849972FA3C50596F3D8297AB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725907, "uuid": "8a595a0a-c53f-42e7-93b2-d97c3ebe27b3", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbnKN5+LnhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725907, "uuid": "d490e75b-0c2d-438f-8fc7-d03ac46cb0a5", "value": 323942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725907, "uuid": "c9110d56-2fe3-4f59-bab6-1e0d2cb730be", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725907, "uuid": "97ee2c92-ceba-4628-bf5c-d99057c36316", "value": "hfYg1aqmbZcnx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fa368d5-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728569, "uuid": "2f65c5bf-fb7e-4993-9cd6-a06789c1a192", "comment": "Malware payload", "value": "26b188359d951244f5824bae06e5514b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728569, "uuid": "71b37f66-1a09-4f12-b749-d890060cb826", "comment": "Malware payload", "value": "8c603ba6bc04adaba6517858382a405e10b5b0ac2c0457c12b265f38d1a7ab3d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728569, "uuid": "6dc739b6-15dc-4ed0-8a2b-69269cc5bdd9", "comment": "Malware payload", "value": "1693a3f4ab04dc3b924a1086e302a9c62cd558ea", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728569, "uuid": "a2d965ea-940e-4c0f-bc4d-73bde6fc06ca", "comment": "Malware payload", "value": "0db62c838ce0cbd60f9893de063b0605946fb952e17bc4104accb4bba6403b63e367388459bdf34f3d774e47fb79c911", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728569, "uuid": "ea050513-217f-41aa-95ea-7fc1989bdd9e", "value": "T1797455896A41E0F18237B33BCE174454FAAB0E5B1084D972B97C60591F3D8597EBBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728569, "uuid": "bbb488d9-6083-430e-978e-5159f8f881f2", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb6pO4Je7oQg72hAV+0zipTfW:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728569, "uuid": "89fed0a2-ac8c-4cdf-ac9d-769fed82f129", "value": 358669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728569, "uuid": "513b7c79-9226-49b5-a44e-e156f2ff3541", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728569, "uuid": "febe6f66-bc25-447d-8b91-1088750a03d5", "value": "U0LpsMzh3qD0y.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57da3a82-0a94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686734274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734274, "uuid": "959e11c4-1bd8-4be4-923a-bb5733e58b6c", "comment": "Malware payload (Formbook)", "value": "94d1f5c20eb622479424d9b19a80d798", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734274, "uuid": "27b71431-8fda-44c3-a7c9-2a45897db2d4", "comment": "Malware payload (Formbook)", "value": "8d62ae4f4816a151da707fb01995ad07ff3cc85f7807f7b9ffa844131aaa449b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734274, "uuid": "e86e44ea-857a-40f9-b90a-75e31a1b9aaf", "comment": "Malware payload (Formbook)", "value": "b8893f478da25db0fde9cf01cd2269ccf66e7bf7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734274, "uuid": "278ea9d2-5c0d-4eda-81ac-96c82164c661", "comment": "Malware payload (Formbook)", "value": "925831227fa5bccc27cc0a2748e578b5bdc04ce3f42409b2cb092bb2252f4b28da3a7303c8ad5dbcc960350bc52d447c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734274, "uuid": "48724597-825a-4868-8c13-835a3e25e316", "value": "T172E423F6B73CA00E142DA45DFD4B3A4119F28EB53159B50A0BDB68FAC69F87B70111CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734274, "uuid": "33ec66b4-826a-4152-99b5-8a232498515b", "value": "12288:cC4hYjkdpSRwGCJOxmzrd6Et6UNz8YHhYwtYpIP9zrm55fJsiFxtw+5jo6zJ:j4hYALSRQumPsEt62YY1+ps9zrAfJ1xB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686734274, "uuid": "b207bad5-2f09-405f-b594-69589f3e45a0", "value": 711741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686734274, "uuid": "2401b2dc-fab1-4b9b-b480-a95787531b62", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734274, "uuid": "7bf1df6b-cdbe-4cec-a099-cb964e48d22f", "value": "RFQ # 1045981 - MAA_D Plant Project r01.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39c61913-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728640, "uuid": "020a23cc-847d-458f-be0e-5a6db3885e9c", "comment": "Malware payload", "value": "3f1ba3896438a555ac485b9144cdd79d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728640, "uuid": "adbbf3bb-c026-45e5-97b7-2914e0cb88fb", "comment": "Malware payload", "value": "8d8105af044073ca1364b0b173e3e855dbc79bd9f24f9d78ffbb17cf2a49e479", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728640, "uuid": "611779be-0e22-49a3-8666-f1c102c6127f", "comment": "Malware payload", "value": "4ea35a394d09cbc16e27e6ec6570efe426eea78f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728640, "uuid": "ed3d59fb-d969-45b5-a116-a40f1221b112", "comment": "Malware payload", "value": "1d39d283c18a7e995ecb073d142cc87ac0d9c4c5f0bf5e807923b56a88ca0ebeeb15050a2c90508c40dd48cafcb2d9f3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728640, "uuid": "db3ecee6-fb38-48e2-9d50-09382acb4317", "value": "T1236444886A55E0F08137F337CA574450FA6B1E1B21849972BD3C505D6F3E829BAB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728640, "uuid": "2bd1dd5d-f781-4ee9-b098-d6780b375e77", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb9tNSPGcxZkqoDJrhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728640, "uuid": "7a21dc3e-9145-4e3a-a215-14f7891167bd", "value": 319399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728640, "uuid": "d14543ec-90b6-4f6e-873a-b18567800075", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728640, "uuid": "ca7fdc82-aa93-48ce-a7e4-02e673c14ff1", "value": "SpPlHsZSO7GIeM.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac901794-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725826, "uuid": "ff7e82eb-e873-4abc-8a38-9296268e444f", "comment": "Malware payload (Quakbot)", "value": "d0bcc81b0ece3fb4b0d58591480e4ab7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725826, "uuid": "9e5f57ae-2229-4b4e-91b8-519c4d3f839d", "comment": "Malware payload (Quakbot)", "value": "8e4598055189595b7b04c58a778f02457973e353989ab022f6029ad27c0b2f7f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725826, "uuid": "b982e535-a80e-42e8-a6ab-1adceef0b707", "comment": "Malware payload (Quakbot)", "value": "88b3c1463bb7ba8f4c86e81b7409686fe1d61dc8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725826, "uuid": "0393cfd4-1e44-43ba-918d-8b5355c25717", "comment": "Malware payload (Quakbot)", "value": "f63b148b726c07da7a622231e3ae2619c3b2c004f084f79087ca53e8ea0bb7af3a9f72339b6f8ac6e8a414a2a612e191", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725826, "uuid": "9c7c94cd-c6b9-46e1-8ecd-9ed122e4209b", "value": "T1F06453496645E4F18237F33BCA578410F96B1F5B21889932BA7C505C2F3D8297AB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725826, "uuid": "3a5c364a-34a1-4a8e-9234-bb397577a822", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbX1f8s/WmwhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725826, "uuid": "6051cf9a-289c-4835-8a46-5a3db31db911", "value": 333620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725826, "uuid": "60ae4e7f-a2ff-4e36-9361-1edc266d2872", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725826, "uuid": "3afb98d3-4d9a-46b4-aa66-bb23a1475655", "value": "ja91Jyk1AdtMKs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c771bda5-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728448, "uuid": "1006859a-acaf-4522-a525-ccbf7d3dc981", "comment": "Malware payload (Quakbot)", "value": "18f5d0297caf48a8223f60f57e0fd365", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728448, "uuid": "7dfb9d56-f583-4abf-a16d-5214442ca37b", "comment": "Malware payload (Quakbot)", "value": "8ebeb73bb9599456b7df74f59012d9ec39925eef9252a12d59906a95e747b9d2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728448, "uuid": "4f40d3bc-d454-4209-917c-d90c0d3dff68", "comment": "Malware payload (Quakbot)", "value": "c484052f97e5711f141db1ae64515b8f4d09281b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728448, "uuid": "f730be1e-b9ce-4db6-8a04-89b8a3151632", "comment": "Malware payload (Quakbot)", "value": "83a51216a7d7f7d4f0d8afb2499c2065b5a3a6095bc0fcd6254c55d0a278931b3fa6e705be4e60afb44c9a9cffb9a5a7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728448, "uuid": "f2177af6-dcfc-4dd6-b6da-54370b9ae585", "value": "T16C6464896A41E0F08133F37BCA578410FA6B0E5B10C4C972B97C515D6F3D869AAB7ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728448, "uuid": "4d1d2171-00c6-46ac-9c31-d670cb65a61a", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbZKaiT3UXkBhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728448, "uuid": "fbe9d11c-efa8-484d-9258-4cebc3e486fc", "value": 310568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728448, "uuid": "919467b9-581c-428a-a061-2f126f08480b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728448, "uuid": "8cf7c02b-07b6-4e7c-b9a6-bbf7b5f84083", "value": "V5el71V1T5vhIW.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148c6a47-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686750482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750482, "uuid": "15bae606-41e6-465d-9be3-87e47cfe622e", "comment": "Malware payload (Mirai)", "value": "3340e86abae54d2a22774f285c325cb9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750482, "uuid": "346251b3-1134-4760-a3dd-ae2147c9ec52", "comment": "Malware payload (Mirai)", "value": "8ed1fb0d372b0215ab40ad410a1ddccf266ec08471f862b4d22a7c1f867ebe87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750482, "uuid": "c91ed024-a968-40f3-aeac-0f02f647c2f2", "comment": "Malware payload (Mirai)", "value": "c9ce98899d8920731c5e21d148749dfca9938b39", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750482, "uuid": "3c296340-76e5-4242-bd3a-b1f5a02111bf", "comment": "Malware payload (Mirai)", "value": "79baf35101a1348c2f5c5b3bd59f30161f0098f768e7244c01690bd90a1aad245ea37e7196b7cda5248290a419f0becf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750482, "uuid": "1f763d3f-9630-46f0-957e-fbad36d876ca", "value": "T1E4B2D023FA5F78B6C1B42C769AB4838317577BBDE072B023814843463C95596BFB9447", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750482, "uuid": "c868a943-acf9-4b8f-bd6e-9d23cd7c59a8", "value": "384:Y+vI4rYZFit9x7QOUvym6eT3iBdffhfeQEVXs0lf+QcIh7qmdGUEpia28:LdMG9x7Qgm6vES0lfkI9q3UEL9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750482, "uuid": "60d3dbd1-bab5-4438-9d6f-1e6b0732649a", "value": 23624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750482, "uuid": "d78e7778-36be-4e64-ba12-767f191a611a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750482, "uuid": "be351c12-07a5-429c-8261-0a56e4d6e520", "value": "3340e86abae54d2a22774f285c325cb9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4efdf2ff-0ad1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686760458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760458, "uuid": "577a9129-4b22-4c4d-a799-7efbaa9cb7b8", "comment": "Malware payload (Quakbot)", "value": "4b773a0dcdedffe32ed1ce4ca68c9092", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama268", "colour": "#C8D754", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760458, "uuid": "23dcca53-52dd-4d7e-bfcb-701d4b243e29", "comment": "Malware payload (Quakbot)", "value": "8edcea2ccadc4cc3ab40d1e7c650e8b1a13d892ee598582b1503be2e86c77090", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama268", "colour": "#C8D754", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760458, "uuid": "d80b67ef-8ea2-4f4a-a38d-00384326bc54", "comment": "Malware payload (Quakbot)", "value": "962aa218bd23b2b86635a309df09c0168d14c14c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama268", "colour": "#C8D754", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760458, "uuid": "c79c865d-8f08-41ae-bda5-c79e361f944d", "comment": "Malware payload (Quakbot)", "value": "a24566c0add2e7c5d9114c97f541c3fd64650b83ea3941c6efd068355df2211c88dae661e544643ec473601e229b89cc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "obama268", "colour": "#C8D754", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686760458, "uuid": "3bb59794-49e6-4bef-ae59-e76351a7bc72", "value": "T17CA4680872A19C9B330B1ABB3606FCD4F1BE09F4B246059BA5145D92EBB9F73E4E0574", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686760458, "uuid": "8b8549a4-7082-4640-aea3-a1568c5233c4", "value": "6144:LmFamddP19SiU+g9ITla9MGNs9yec26VZU6BboaI7CRY7kkhl:oLU3+gPZUW0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686760458, "uuid": "aaa9050f-c3c0-4738-b6c9-fd89949ff13b", "value": 475378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686760458, "uuid": "d0d92607-72c8-448e-ad26-a7f7aea115f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686760458, "uuid": "a6ab837b-056b-4116-bd2e-e0d5584c71b9", "value": "CalculationOfCosts-141075452.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8566157d-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728337, "uuid": "091a0f76-f1fd-4559-b209-df6d6fd7dfa8", "comment": "Malware payload", "value": "58719a01c67dbabac11938c194e20293", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728337, "uuid": "bc1748f8-775b-4e00-bba3-e8fdf84dcc9c", "comment": "Malware payload", "value": "8ee6d32025b0548e4ed6e55479f139e1fc07b9934ca1f80c870d8f714c7883a8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728337, "uuid": "7037b1bf-442d-4988-b351-b6d811c29ba4", "comment": "Malware payload", "value": "a64a46d6850a1ffd47041f26f9c5ab5719753642", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728337, "uuid": "207dd00c-ba9f-41f2-a85d-aae2853c7035", "comment": "Malware payload", "value": "e6b411598a30bf6c4d5e4de692e69cf8cbcb6bda1173dbdd5f88b9f17a2f5a1950f2a82334fecc598507a147a30217d9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728337, "uuid": "936e7eb8-722d-4ec3-9a9c-44af506f1df1", "value": "T1B77431896645E0F09237F33BDA574410FAAB5E5B20849932B97C505C2F3D8297EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728337, "uuid": "5d5f85c1-d2d6-4751-aa51-60f3d8320bb3", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbMVFj2j1DRBI6J8hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728337, "uuid": "ea772fe9-e093-46db-89dd-033f7b25894d", "value": 350667, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728337, "uuid": "196f4891-bb37-4f42-ac4f-7be324242410", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728337, "uuid": "b74f098e-5ae9-4edf-86a1-eab82c421ac8", "value": "Ykx2d2RHL3Ckeb.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73c7d0a5-0a93-11ee-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1686733891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733891, "uuid": "af4fb2c4-f7b1-4d44-a9cf-80d7b4660322", "comment": "Malware payload (IcedID)", "value": "6e5b0b116a73bf52c550453d9b436369", "object_relation": "md5", "Tag": [ { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733891, "uuid": "916cc910-fdf7-436b-b7da-8b73785523b9", "comment": "Malware payload (IcedID)", "value": "8f40ff286419eb4b0c4d15710dc552afb2c2a227a180f4b4f520d09b05724151", "object_relation": "sha256", "Tag": [ { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733891, "uuid": "534df497-e388-4a71-80f9-5975b8f45bca", "comment": "Malware payload (IcedID)", "value": "ec68fa05e59c9921786be7b49b9cd6d4f0d00867", "object_relation": "sha1", "Tag": [ { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733891, "uuid": "510111d3-70ee-4956-ad67-9e2e89287f14", "comment": "Malware payload (IcedID)", "value": "28d02c0b3eeed8475efd546a225f62e9aab38ef66bb12c3cf1a7f9359cb87bf0d720eba11d2c161c247a50f360f853d1", "object_relation": "sha3-384", "Tag": [ { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733891, "uuid": "5c7824de-d404-4491-b7ea-ebda839af4eb", "value": "T1DA0597C223EBBD4B04271372335426F5D939DA65D9C998DCF4457C68F0EDE02BAA82C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733891, "uuid": "5b9318cb-d983-47e0-9324-4c96a214f3a9", "value": "24576:eRGB5tqZdTMktZenB0KOzACpPbR9X6LoZsc/8o+m6/esOKFBjY6EjYbgBw+y7KRB:R5tqZdTMktZenB0hzACpPbRdAoZsc/8y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686733891, "uuid": "96ba856d-76fd-4c81-81ef-e20b650f2f0b", "value": 819916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686733891, "uuid": "fa57f078-90cf-422f-bb97-5c0ba01b88bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733891, "uuid": "95e50776-291a-4460-bb77-c848698a240d", "value": "Docs_Request_06(127).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "885d065a-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728342, "uuid": "e1df0378-1c21-49a0-b88d-0908bca3c975", "comment": "Malware payload", "value": "22eee5284f2009bf4e42338f3de7fde3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728342, "uuid": "845b7660-78e1-43c0-9d6a-b4ba36aee8c7", "comment": "Malware payload", "value": "8f929428a217ff296d65c32306eda42ed9b315bdbcb403bfcdfa02f897dbf926", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728342, "uuid": "18e9e62d-55b7-4073-8224-b3ef347379ec", "comment": "Malware payload", "value": "778a5678cec8d79e61019a9cc7f68a72ea49103e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728342, "uuid": "b44ee950-cf2e-45eb-af32-1e19958a0a78", "comment": "Malware payload", "value": "207ea3c12fefcc9940a8149a7fb1e50106192a929cf353f9fd42429a225c52bb5e6a4cf9b2f4de6db494ec144dd5cf1a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728342, "uuid": "a7a901cd-b566-4277-bfd4-b4025098fc69", "value": "T1277441886655E0F19137B33BCA068420FA6B1E5B2084C972B97C515D2F3D85D7EFBE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728342, "uuid": "e404bec0-0fe0-4070-8992-271ffb975d66", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb0U4+N61AilghS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728342, "uuid": "f8fb9827-e723-4e59-bf2e-ca81d873d46d", "value": 356318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728342, "uuid": "add8327f-803a-4b63-a8b4-b33a2ce359dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728342, "uuid": "187b3a16-b499-4c5b-b96e-807fbdf443ae", "value": "YtLn6Ctai99v.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e75442-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728318, "uuid": "130aef35-2f85-4392-9703-fc1cbba635fe", "comment": "Malware payload (Quakbot)", "value": "b2e30c147381cfed1ec0452056d23c50", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728318, "uuid": "6d979e2a-4638-4d2a-893b-acf5e8ee77f4", "comment": "Malware payload (Quakbot)", "value": "905af047345addcf40ced0d92bc5164fad2cc99dead0c067e5b5f091d2e9c24d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728318, "uuid": "1d9ba503-8775-41f6-a5e0-04ac041d2ebe", "comment": "Malware payload (Quakbot)", "value": "357e4644a917879c84b5ab2ff8ba5b96b9c723ce", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728318, "uuid": "877d7e75-5ee1-4f2f-8a45-7db5d2f4bc79", "comment": "Malware payload (Quakbot)", "value": "4b3114bac0ea833399bfff763db07c82383c6b21f6d2e91ef175ca6c9768bae0ab6e93e3a6c3799a8565e6965ad709e3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728318, "uuid": "9e759402-927d-4744-a6c8-ebfb5328f08d", "value": "T1727443456A45E0F09237B33BCE178010FA6B1E5B21848972F97C515D6F3D8296EBBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728318, "uuid": "ceaec480-8fd4-461f-8212-bae3cece401c", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbWsMOWtF3jehS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728318, "uuid": "2d94be71-bffd-49ec-8fb9-c83e52123c23", "value": 348128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728318, "uuid": "d68d76bf-7e8d-4c2c-b0a1-eace26fc63a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728318, "uuid": "8f2e443c-1cd3-412c-b858-801315e67809", "value": "ZBnCgr0TgNBx9Z.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ce15fd-0ace-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686759173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686759173, "uuid": "b9065368-62b9-47a7-a3da-62d91b3574d7", "comment": "Malware payload", "value": "15ed589908a80c2e8db14f6ad850e881", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686759173, "uuid": "661a0520-4d36-4133-99ab-ca0b11b02d80", "comment": "Malware payload", "value": "90ba164a4329285555718582428b2e225fadbf3cedcde35b61764a94a7660933", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686759173, "uuid": "d540bd8e-67c8-472c-914f-a1bd8013f158", "comment": "Malware payload", "value": "7861197b3a759f5354f209e934ed468e60df1940", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686759173, "uuid": "d6e194b0-09fb-4731-b79b-b6308c869d02", "comment": "Malware payload", "value": "e99311eb7868a0d44a20d49cd326c4d93c40627035d3c4335691b890aabed44a51b2efbcf4f12961ec7769834673eba6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686759173, "uuid": "5682c887-59ee-419f-bcd9-31163960939f", "value": "T1B9C5280AEDD5BF1BC851A47F994B9136A48BCD0A3741CB539308E6B330257781BDBBA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686759173, "uuid": "f37ae1fe-31f5-462c-a879-903b3110d8b3", "value": "c389d5e64bcd131854ca9a65d47d92eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686759173, "uuid": "2dc25f5c-20cb-4d11-88cd-726e5e65c93b", "value": "24576:h2fJSwRBmRwKLt+ujYczdsXBOKrnkvrKmO8ZSFBg0HQ4I2YvhBr7KW:Ym9M2aXAe5gOQvF7KW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686759173, "uuid": "ceb63527-be40-46d0-bf3f-0664bf5dc740", "value": 2612736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686759173, "uuid": "99516a3f-bfdf-4bf3-9601-e146f2ed8abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686759173, "uuid": "20ed6734-70d8-4924-b200-a853a963e4a9", "value": "snow09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "479677e7-0a7c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686723938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723938, "uuid": "77a60018-f6ba-45b5-b5a6-9a541de28b5d", "comment": "Malware payload (RedLineStealer)", "value": "aee763d2c5e29bbaeb19046e5ccd6d4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723938, "uuid": "c9be9084-cba8-48d2-b7d5-ca78813e82fc", "comment": "Malware payload (RedLineStealer)", "value": "90c0d92b87b1c826256e581b53e55a370af4ce5fbf4533162303cfad5f4c8d37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723938, "uuid": "16557edf-d658-4315-8a80-e345f30793b8", "comment": "Malware payload (RedLineStealer)", "value": "ffaad9b9445a356b6f1f2143829b6636313c7760", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723938, "uuid": "db1386e1-6f82-4bf4-a716-b441e8ce99f9", "comment": "Malware payload (RedLineStealer)", "value": "b8b1ba2c2c2da75cc915789264d8869aa9af00f22be86eccaf49f284f6dc85e03247ac262dd88975099cb3a634910193", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723938, "uuid": "50a49be6-9618-4ee5-95ec-c00db8fcffe9", "value": "T12F05235696EC80B2D8B117702DBB03C31F317DA09C7897A737565A9F4C726D4C632B2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723938, "uuid": "32457dbd-ecbd-4608-835a-b92deafc1425", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723938, "uuid": "e6462378-9547-4e3f-b7a9-85c5b5ff79d0", "value": "12288:UMrcy90SsxuP+RfDZMM86S++rcmMuZnzvWYgi8TVWTX/OmtbB8LuapSGcaBYPY8Q:4yZCfa++QMJgi8TVWTvbtbSLFSPYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686723938, "uuid": "cfaee56d-0a19-453a-b14f-ebd431c600c3", "value": 869376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686723938, "uuid": "d4ed9e2f-c373-473a-acc1-dd7a22ca8891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723938, "uuid": "09813c44-0e92-4023-9781-8dc5ced0bd35", "value": "aee763d2c5e29bbaeb19046e5ccd6d4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5773b0b4-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728689, "uuid": "80e9bde3-32df-4816-91cf-ff0880f3cf4b", "comment": "Malware payload (Quakbot)", "value": "5c69c714fd8677a8fc5165a2cf73df73", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728689, "uuid": "1ab4a552-a164-418c-8aaa-f8fe517d6f16", "comment": "Malware payload (Quakbot)", "value": "90fb5559322b1ff47e350bb5f35a3a9f8d003160c47c9d4a86a121d8c2f708e4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728689, "uuid": "c90f6f3f-e631-4a5f-95a2-f8de8da854f3", "comment": "Malware payload (Quakbot)", "value": "cf8613a6ef01e992ed1e27d1089a8e46c7916460", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728689, "uuid": "e860253f-25a4-4c55-8f21-0277f9e1b760", "comment": "Malware payload (Quakbot)", "value": "0be452f8b1a9f6e6a438737288b79f14a71f42fb8bf5f3de6ae4c41ca3abb187cd664298d3da7055303959ea254bcf51", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728689, "uuid": "06b24ae1-cbf5-4d38-8243-27fb96a99e3e", "value": "T1B06442496A86E0F18237F37BCA178414F96B1F5B10848932B97C55582F3D8297EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728689, "uuid": "6e36c6d2-7514-4deb-bfef-fb277a98035f", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbAEv/UrI2bxpUEKSxAIEwcQP:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728689, "uuid": "e9b36778-3119-4aff-92df-c5d35af6c78c", "value": 333972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728689, "uuid": "d4eaa510-7196-4de9-9a40-9b674de03f74", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728689, "uuid": "d533c0e5-b94c-4017-9fad-8cc0c5eeb8a7", "value": "SCotO65yEowD1s.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7723ca-0a93-11ee-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1686733880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733880, "uuid": "4e27712b-9941-4581-b31d-4be997bdf6f7", "comment": "Malware payload (IcedID)", "value": "4ac92c6513d6d762fb99ad1e2a2073d3", "object_relation": "md5", "Tag": [ { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733880, "uuid": "cdd549d5-98a7-4498-a7e1-b94b4d691782", "comment": "Malware payload (IcedID)", "value": "91336a4a35933090d2c305386140b6215f82def3c6ceefe34e8a02de0379ba30", "object_relation": "sha256", "Tag": [ { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733880, "uuid": "f8695693-e85f-4dca-b875-f6cc4a7cae7b", "comment": "Malware payload (IcedID)", "value": "c0ae9b0d328157580b27f7f0a42808871ff62891", "object_relation": "sha1", "Tag": [ { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733880, "uuid": "d35b21f1-9644-4f26-aa74-2f0569dc53fd", "comment": "Malware payload (IcedID)", "value": "2f3c8764e6e265af7797f867de64097d0fd531a13760f8ff8bcc1651c5d76c69a717648386d04823a1eac87fbce4d676", "object_relation": "sha3-384", "Tag": [ { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733880, "uuid": "370ab7e0-9f0a-4317-9448-eb5c4af8be73", "value": "T186F497C227EBFE4204275372336426F9D93ACA65C9C998DCF4457D58F0EDD02BA982C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733880, "uuid": "bc30343a-6846-4c69-8063-ec962ab6a5e6", "value": "24576:Y+3hLdlfJiSONgmvXfBpVSzrtU2yvtXgMLuXj6p8pESlKf7T16f0z6SKPL2FzTx9:Y+3hLrfJiSONgmvXfBpVSzrtUlFXgMLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686733880, "uuid": "9c377f5e-7da6-4905-9671-fddfff3844c5", "value": 793694, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686733880, "uuid": "bb531e6c-6264-4e47-8f88-d6fe259b290f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733880, "uuid": "b0c38d11-5ef5-46d0-91e7-b3dab8908542", "value": "Docs_Request_06(115).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8641570-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728503, "uuid": "9f6d0dde-795f-44dc-b615-bc54d50ed64e", "comment": "Malware payload (Quakbot)", "value": "8c255bee31340078ab963dedf1fd11c5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728503, "uuid": "a9ee1827-365a-4484-aaeb-e6a3fc4c31f0", "comment": "Malware payload (Quakbot)", "value": "9188f52e0786097d39407a4a95da624c737a2482bf2c891f9082d21e61f2e5ea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728503, "uuid": "bce07f6d-e800-4013-94a9-da9ccda9e820", "comment": "Malware payload (Quakbot)", "value": "64729d8603928a32b366c1df7f9adda46b1170a8", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728503, "uuid": "56dd7ff4-5d1e-491d-9fdf-0574b0f64b4d", "comment": "Malware payload (Quakbot)", "value": "e9208e11bd4ace13764cb4698a02c39a7518ad3c62472005536802416c5006757f1c7fabe43150a4537d1c2d9c901d80", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728503, "uuid": "f8a029e7-0556-4172-b1d3-bca431e7fd98", "value": "T1DA6443896A41E0F08237F37BDA579410F9AB1F1B2088CD72B97C51592F3D4296A77EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728503, "uuid": "87267ec0-b933-4a06-90bd-7cabb74bc9e8", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbhKtqq/5uYtmBq/W1hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728503, "uuid": "c2ba3efa-bbfc-4a3d-b008-eff95f3fe75f", "value": 324580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728503, "uuid": "343ff8cf-98a2-4d8a-a8e9-88f420b39b2b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728503, "uuid": "cedcb648-5eb7-4540-8c11-c02d76de8f50", "value": "UBcxJSgiGYslii.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9199ed3-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725847, "uuid": "d62af18e-fdb4-42cd-bdc5-e9b2a6d9147d", "comment": "Malware payload (Quakbot)", "value": "31670af3e9853263ad628754db2c77f4", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725847, "uuid": "975f7f56-6733-4438-9ca6-3f6da2f70ff4", "comment": "Malware payload (Quakbot)", "value": "91ca0dd484a61948629b7b73ec89c55dd0431ee6bece9ee4d56d54b33dae0a5c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725847, "uuid": "fa38462a-e4d5-41f6-9fbe-bd179d56b558", "comment": "Malware payload (Quakbot)", "value": "69be374815494b07ed750f427d2c1b64f881a585", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725847, "uuid": "f087414e-aaa6-4c60-a58e-ca1f81b5557d", "comment": "Malware payload (Quakbot)", "value": "0834ea22f4ad65575f3ccdba10d4a39f575d6e8a25223194e9a0823cdf3e4142f9874dc075e193931635a7dfd56e2443", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725847, "uuid": "10f17567-4055-4926-9e8f-80972fa64262", "value": "T13A6420896A55E0F08137B33BCA179410F96B1F5F2184C972B93C516D2F3D8296AB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725847, "uuid": "b362bc79-d137-455e-8af2-245cddf7d2c6", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbDVqNfIldlymhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725847, "uuid": "82ddea6e-d068-46f0-bb83-3ba4e61fcf44", "value": 310324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725847, "uuid": "6b42c647-fb6d-4fa3-815f-d1c2b307d4a4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725847, "uuid": "30eb2751-ba71-4bd3-9c91-8a7b3ed3f392", "value": "j0W7ynerdcjxy8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9803093f-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728798, "uuid": "5f85c6dd-9f08-4274-b981-18028ceeadce", "comment": "Malware payload (Quakbot)", "value": "ec6e9d298473a2ddef22af9cfdfa6f50", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728798, "uuid": "de644159-9be6-4def-875c-a0dcb1097382", "comment": "Malware payload (Quakbot)", "value": "927e7e809a5fb07c15e72b7f831550d5e4af6be4bbe85f2832b46619798178e9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728798, "uuid": "d1c74faa-e708-4e2f-823e-8ea5f9398797", "comment": "Malware payload (Quakbot)", "value": "d6f7d1199a8a8ce78b673bb918e224c70e65ec19", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728798, "uuid": "eab14521-e486-4be7-be9e-dff1f5d8b450", "comment": "Malware payload (Quakbot)", "value": "da45406600457c056e307d8a04cb6152f64f2620ad7b3bb1671728cc9a85bae4cef71208edefacb3adfe36eedc34dce9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728798, "uuid": "74270c4b-bf17-4f17-b2d3-87f6fc658486", "value": "T1477411896A41E0F09137B377CA168410FB671E1B11848932F97C61586F3DC6DBEBBE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728798, "uuid": "3bd6464f-4621-4e0d-8901-dae9a3967bea", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb16BZIlpO4Hkfg8w6x4XeHTM:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728798, "uuid": "1da314fa-17e5-4112-a4e7-338c3c663147", "value": 348700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728798, "uuid": "6707a0b3-b12b-4350-8124-cd4d7f86fc73", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728798, "uuid": "d096538a-c85b-452e-b80c-3b3a7624a794", "value": "PiYthxRecu4egq.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11bc57af-0aaa-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686743605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743605, "uuid": "98292db4-dbb8-45af-9b33-7ff017bf9171", "comment": "Malware payload", "value": "19396b24379e112c1f2f5744bff71a86", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743605, "uuid": "36676be5-ab16-4789-bb4d-e60ae144a83b", "comment": "Malware payload", "value": "92d42b1b4d584381c47f143e0de595c516999adb2850aa7c00d67df7b4a8fda6", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743605, "uuid": "bf686bef-8ec3-4dde-b78a-de61c44a431f", "comment": "Malware payload", "value": "1467c59d3ce94e08d5a6d932f5a8fd4c4e34c115", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743605, "uuid": "9d4b73d9-71e9-4d36-951e-5b993c9d1b85", "comment": "Malware payload", "value": "4a514f4a431dc5b8dfa6635b0479485544ea226edd4d09aed351f66a914c993e679ecb8e4600514a3d2b6d34103aa398", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743605, "uuid": "86f2d206-8847-475e-bf92-8075b52506e4", "value": "T1C405D050323A2963EABD8BF50151917093F62F1FA26EE2E85CCAB0DB57F0F414651E27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743605, "uuid": "a6b4613a-10c3-44da-b1e2-b5749a3fa2c5", "value": "12288:olKnuiEXqXdVRavV5+SCjmtop9Sp3WoIdYXQHa1bsC:d34qXdVYvV5+ZmtorGmoIdYXUa1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686743605, "uuid": "b7ecb458-0972-4a36-83bb-a9e90d4fe810", "value": 868352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686743605, "uuid": "da9b77e8-109a-4290-83b7-90933d3954be", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743605, "uuid": "7f48f018-e813-428c-9b24-c39af6e67be7", "value": "nRFQ 100-519639_pdf .img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af57df59-0b0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686786389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786389, "uuid": "1a2bc838-14c8-4f7d-8142-99c77843b93a", "comment": "Malware payload", "value": "ed5bd7443ecd91ac8cd78a7eb1344fae", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786389, "uuid": "11b82ac8-3137-484d-93b3-81458b44e01d", "comment": "Malware payload", "value": "9497d4398c54ed5ed9f3b954ae86cc6b32e9370a7b11261463ffee4036b34e12", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786389, "uuid": "5c7c0b6d-5bb2-4c99-9713-1ec931fb164b", "comment": "Malware payload", "value": "8c9f71290b8fc56e31d8bce397996a5e2fc41e68", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786389, "uuid": "a01e3b51-87f7-4e18-a2bc-8558134bdffa", "comment": "Malware payload", "value": "3b5f74f136325bb2e663e7ff4f53e81484b0a413400a57c0987be2980547eed8c44290ba440fa909b141d707654e1957", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786389, "uuid": "9d1a8b8b-bf2b-41d1-97e2-e1e210aafa87", "value": "T17B15128277D50512C85841B890E3063803F3AA9BABB7D386395C96D54F87B95EACF7CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786389, "uuid": "8509d9c9-7764-4c44-ad47-0946b1dc65d3", "value": "12288:V+uEfG3nUHprmxYsWzK5yge/AXjwmp8PPwRtb0KgHh8ntZMR+Z3D:V+uEfG3UJrLvuvtXjSobK8ntKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686786389, "uuid": "27427c70-f53d-47a0-9c55-94552a216da5", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686786389, "uuid": "b1407b5d-ecbc-4469-a096-28250188cc66", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786389, "uuid": "943eaa1a-0b77-47a0-a82b-549770c43adb", "value": "nPayment_document.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82848f4-0a5b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686709981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709981, "uuid": "d8225205-0084-42d7-8923-1b313c309707", "comment": "Malware payload", "value": "d69cae7945f52fa3dd3a90e3d280858a", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709981, "uuid": "7c05cda6-7ed7-4293-93f5-4caa7c8884a4", "comment": "Malware payload", "value": "95bb490075886f0eb4ccaaeb4d1bcda48f74a3adeed83c96d578f693c93a87b8", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709981, "uuid": "da0d6d5c-ba64-4ed4-91ab-aefb34865672", "comment": "Malware payload", "value": "38b6e301e27a54074cc0b4859bcd3219aa43692b", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709981, "uuid": "2eaccf38-0b07-45f2-b3c6-bc413ba86284", "comment": "Malware payload", "value": "afe23fa76714e64d200b5505529f09132ee3eac82366374c9c6fa2ecc331cd72aac82fb0f8127ba6bb3ddd918aa5d531", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709981, "uuid": "da68cbec-dfde-4bf5-898d-ea9548964e18", "value": "T1DB44D0299B53A0D5F6A6DD34351B3A98DA02306762D0F73F36FCF56113EF48A218B249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709981, "uuid": "45f2f70b-43d8-436e-a4f1-07808127a494", "value": "3072:LK0afMUWXma4Tg92ngwZbV81DeJNvuLbRfQog7n8sQOw5JFtQG+JI0omp2lhStgm:LHaMUTntui3m1fQfj25hqjp2m9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686709981, "uuid": "17844187-088d-4c66-94e5-726619d1772e", "value": 270945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686709981, "uuid": "d80b7bcf-3fbb-48bd-a177-e13857012c81", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709981, "uuid": "8b8e444b-b1b8-40f7-bf2d-31c600bc8eda", "value": "demo01.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c57e2e4-0aff-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686780103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686780103, "uuid": "d8b73a5d-8fe7-43c3-ae65-6015c09d4163", "comment": "Malware payload (Loki)", "value": "7eb9e0caa921d34f26bec4a88aacbff2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686780103, "uuid": "3da89c96-2310-4768-a6c5-daf734596640", "comment": "Malware payload (Loki)", "value": "95d05f1cf422a2fbcf3207e4c6c047138525bcd7d30deb26060c269e88e1df39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686780103, "uuid": "4f1f57de-6044-4fe3-9d6f-3b95709233f7", "comment": "Malware payload (Loki)", "value": "33e0b6647c3c75a6d2cf5b372294d862fa369966", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686780103, "uuid": "022f6021-b578-4262-9f9c-ec06b0e1a58f", "comment": "Malware payload (Loki)", "value": "73e50045e9a5db5bb179fc52cc7966953e49a03703934495cec56e0470ace29ce0dd4b25872bfd6c64f78d2aff2c7c81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686780103, "uuid": "5bd9ed7a-8965-4aa0-a65f-6c950afc4240", "value": "T1950512423510491BD2797BF84F1562B033FF8F8A3E15E3CB2D87B4C998D6F466A21A16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686780103, "uuid": "e26ed528-d747-4594-b54c-be3aab1109e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686780103, "uuid": "7b89bc2e-e695-4984-bdb3-db51e84804c3", "value": "12288:+acvG73htU7/2eQ1x9krXLvzbS/PwyuHSi7FtZVOTJfTe9wZPI:+agG1tCueiOrXjzbS/IJyi7yThTe9wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686780103, "uuid": "cbbfd38f-cf22-426b-88fb-860f894b83fc", "value": 801280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686780103, "uuid": "f33f5534-8897-47c9-83ef-aedd9fe2804c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686780103, "uuid": "d2dd774e-ea68-4edb-8592-1fb654dfd3ed", "value": "95d05f1cf422a2fbcf3207e4c6c047138525bcd7d30de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92be8fb4-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686725782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725782, "uuid": "c67b4945-3118-44de-a611-ff7ce07a591e", "comment": "Malware payload", "value": "c09ad7f02ef2de02b9a59ebdc30c90b5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725782, "uuid": "49d7fcdb-4fa0-483a-b792-266fa8de76c3", "comment": "Malware payload", "value": "95d487e1b312dbd263a62467e955c7211aad480c4d77337a96f43ee18175c698", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725782, "uuid": "e4b8bb42-ed04-4dab-9d88-b7fea8c218fe", "comment": "Malware payload", "value": "d3802742c27adf72afedd4048d9671de652b738d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725782, "uuid": "22b578ce-3456-4825-b728-d22cba3fd290", "comment": "Malware payload", "value": "a69d8941aa09d1fdd04cdfdaba761b48490013acf441fde1ae6cb21030bee7fb5640fb8b715ad7e81dbdec546f66366b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725782, "uuid": "4d8e1117-0700-43d8-922c-9599f5db1375", "value": "T1176444856A41E0F09137B33BCE578410FA6B1E5B11C4C972B93C51596F3D829BEBBE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725782, "uuid": "7559a5f0-c1dc-40c5-8289-6fb4e98688e6", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbwKw2NjSW8HzJhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725782, "uuid": "915744e6-0576-43b6-a90d-7352de29df18", "value": 336213, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725782, "uuid": "d986a8d5-bdab-41bc-8c8f-dd18744cedd4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725782, "uuid": "b41bc228-2988-4f3e-847e-851c39f05df1", "value": "kVapaty8M1AHWi.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4e02a17-0a85-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728095, "uuid": "95a2212b-6d67-4e1f-800e-3dc9e0a0bfad", "comment": "Malware payload (Quakbot)", "value": "a2ec2281b63decae6cdb6d2c087cbf15", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728095, "uuid": "7b4c6ac1-ed7b-4c23-805d-2613cb2810a0", "comment": "Malware payload (Quakbot)", "value": "96984f4d92e891aed7f951855292c8b034afe2e6683651f85f401cbe8246d889", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728095, "uuid": "16ea36d8-0b40-47bf-83d5-39a1246836ba", "comment": "Malware payload (Quakbot)", "value": "6a79281c982e4d9b8df3581d5a97bea5536569f3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728095, "uuid": "ef73176d-a950-4b8a-a08f-3c4782e5a6b4", "comment": "Malware payload (Quakbot)", "value": "fa62fbe96ab1dc85f156965f68a4d85d8f21095ab8f5bba7c1a7cd5d893f38039978d40813422684dbe8dc4899ef0b03", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728095, "uuid": "14b202db-0fe7-415e-9580-a7bc721b3d6e", "value": "T1876445856A45E0F59137F33BCA174410FAAB1F5B10888976B97C50582F3D829BEB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728095, "uuid": "98900dd5-d3fd-4be9-9006-c95175127e6a", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbSQ9DDhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728095, "uuid": "06721ecf-fcfa-4889-a1f5-7aef1aad5c88", "value": 335816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728095, "uuid": "d2e5c904-799c-40cb-aa3d-297349bcb427", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728095, "uuid": "d7e38879-b34e-4da5-972a-3a8822e0746e", "value": "edwpQBRQvmzhLp.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41f6bdc-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728442, "uuid": "7af6be29-f3f7-48a1-a242-958b25c04475", "comment": "Malware payload", "value": "57889fff696f7d23bb40de8cdd85fbb8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728442, "uuid": "e8c7301e-7351-466c-8c66-ae943718b98e", "comment": "Malware payload", "value": "9699fb4b5a460c02d05f85377271191d39ea526f91add8dc6dc2acfb74daefbf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728442, "uuid": "50497c31-c9d4-4378-a14a-bfea7e623d3f", "comment": "Malware payload", "value": "167ae4452def78b0aeaff4dc978b78022f34879d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728442, "uuid": "d5c18cb8-d4f6-4009-abbf-02edd38fd6b9", "comment": "Malware payload", "value": "19c5edc1803da7036e727b6ec082f1ef394c606bfa918d04f374710fac5fe74d3dec6370be51a4e1713f1fb4e5a0c50b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728442, "uuid": "e6763e03-b292-46a9-8098-86d2999d5d17", "value": "T131643289AA45E0F19137F33BD6578410F9AB1E5B20848936797C506C2F3D8297EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728442, "uuid": "f8cd8296-5c77-4d4b-b31d-ae8bbd6c00f3", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbNLpuGAdUEwYmyhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728442, "uuid": "90fdc431-72cc-45a0-954e-c9c7c0bae615", "value": 333830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728442, "uuid": "6e643f93-e013-4e38-863b-e7bd712a4d5b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728442, "uuid": "cba6d599-d4db-445f-843f-589e6a5319f2", "value": "VZlOWTozFKxw.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58d611b9-0ae3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686768205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686768205, "uuid": "4f84b932-a4e6-4dd5-9704-d19082832af0", "comment": "Malware payload", "value": "bca1f5ea6b1712923c3534bd67ca2d29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686768205, "uuid": "dc8f078f-9324-4516-8011-48e25537224d", "comment": "Malware payload", "value": "97fbb8c62444ab8fef4af17c33117b43c9f926a45445ecc9fc51138089a75000", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686768205, "uuid": "da26c4c7-992b-4970-9ac8-5548c41ed999", "comment": "Malware payload", "value": "07ece5ce3c1cef86f7db7ba7333c595122919ff5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686768205, "uuid": "5cb2b517-c43a-4eda-aef0-d0273fb84c21", "comment": "Malware payload", "value": "a41390b356554631055764d28cfdbe0f384cb86237aae96da61c3fe4b3bab5f55f2a4408be86d650ccdbe16cf89f4cf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686768205, "uuid": "f9c1f878-81ad-4612-ab2e-174d530d4133", "value": "T16394F11276A1DC71F96A3A714E65C6E4272EF9215F759B8B33180A3F1E332E1CA72341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686768205, "uuid": "cae30f8b-fe0d-43d6-b0db-8eabb85fffb3", "value": "770f7b0ac2b55bd6301ae3ba09608ebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686768205, "uuid": "1105c80f-83e8-47e9-b5b6-0106f9d88372", "value": "6144:zrtjepA3joHfrbwmBjOAKiAAAtGV7kmzi5ysYzOd03Mek2r8lA:zpepeMHtOZ7AAYVkm2LASDz2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686768205, "uuid": "938cdcfe-1d37-4d15-b4ca-e5d56c555045", "value": 414720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686768205, "uuid": "9fe59817-7e39-40e0-9bc6-170abb96c40f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686768205, "uuid": "d85ff3b1-64d6-4849-9fdc-7d21884b9f46", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e6ca8f-0abf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Lu0Bot)", "timestamp": 1686752718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752718, "uuid": "19ebdded-3849-445a-b537-dc5c6642d32f", "comment": "Malware payload (Lu0Bot)", "value": "fc964391b20b12dcba52a6f5910adb8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752718, "uuid": "9a7bc392-cc20-47dd-a561-f9976ae7fae1", "comment": "Malware payload (Lu0Bot)", "value": "9837727bf67f4a49655b5f2230fa7dad235b025c9af377e559df6fab0f4ff36a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752718, "uuid": "f7bacdf4-0cf1-4573-9616-7e3354eb10ee", "comment": "Malware payload (Lu0Bot)", "value": "9ca210487d82ccd81afb5e419b219a7e724db397", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752718, "uuid": "6ffc14f4-0fb7-4d97-984c-c0adbfafb44d", "comment": "Malware payload (Lu0Bot)", "value": "1a83f310d9fa00b99d388727c756ba7443745bac6b57731b26bf52aa14cf1eb473380df9dd66318ec0ab3eed00e6bf51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752718, "uuid": "908a0815-72b2-4970-b43e-f8ae31aa7c40", "value": "T1A6C53309A1D420B3CE65177156EF079706357E51AF329A6F244384CE0DA2AD4AB38FFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752718, "uuid": "a7cf539a-1abb-45ca-ae89-20ca62b26d28", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752718, "uuid": "4c31ff25-45e2-4bfa-9583-826a4fbbbb5b", "value": "49152:3jzJVxwtN9oNSzWmDjfs4DI0gAF9xvCw/snQfbHCM1I68ZLQua0k:3JVk3DT5g2UQzHXcZX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752718, "uuid": "abbf19bc-a84b-4ecf-be7a-4f108a5a5237", "value": 2636647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752718, "uuid": "a8133a7c-ad88-4fa8-8825-64a7e6b834c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752718, "uuid": "0f7822f6-a0f9-4867-a10e-6696ad4d2697", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ed95cd-0b0d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686786260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786260, "uuid": "deac9e6a-4a19-4f4f-9d3a-ddf94e4c6186", "comment": "Malware payload (AgentTesla)", "value": "de0b643459f59b88b3ae511b986eb868", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786260, "uuid": "a418bc9c-36a0-4f3f-802e-7a700d1eb3eb", "comment": "Malware payload (AgentTesla)", "value": "999c708503ca5289854b3347f0a9115d596676ba1f41b51b0bf9ff1f12ced04f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786260, "uuid": "20c86ea8-5063-4e84-8259-9adaf2b6ade7", "comment": "Malware payload (AgentTesla)", "value": "476a1bb239548c0d1c16ba415c425cd8b56d6c45", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786260, "uuid": "8e1d51be-1984-4679-9a7a-698976f8ab95", "comment": "Malware payload (AgentTesla)", "value": "d68f663e7b6fa5eaceec2c3004d859b69fb65de838ee5b36f13d0856178de6f266fa07e3f49dc0bce6c2de65a874031e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786260, "uuid": "a34f667a-9511-4828-96c8-e8227df9bbc0", "value": "T17105238277D50912C85841F8D0E3053803F2AA9BABB7D387395896D54F86B95EACF7CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786260, "uuid": "ddce19f1-7901-42ce-b218-9f214bf92aa1", "value": "12288:f+uEfG3nUHprmxYsWzK5yge/AXjwmp8PPwRtb0KgHh8ntZMR+Z3DP:f+uEfG3UJrLvuvtXjSobK8ntKAL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686786260, "uuid": "21ef0320-1f06-4a34-9394-1e501ef8a22e", "value": 862272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686786260, "uuid": "81f8555c-9d14-4091-87a2-57d75a281d4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786260, "uuid": "bec3da84-ffc1-4203-b561-a29e8b7250b9", "value": "z44Paymentdocument.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d5a0cf-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686750672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750672, "uuid": "f485e9f5-aba5-46d8-a8d5-b15b30bf06ec", "comment": "Malware payload (RedLineStealer)", "value": "deae75b8a6220add962d77a5dfcaa0a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750672, "uuid": "82d65e74-c3d0-4552-8a5e-4089ab85b8a1", "comment": "Malware payload (RedLineStealer)", "value": "99f5727a8695624ad522b7f4b9a2b624437e8459dda3e55f06540cdebc95720e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750672, "uuid": "938a5829-c68f-4a79-ba98-540a293c1f79", "comment": "Malware payload (RedLineStealer)", "value": "68ce97244e53bddcb537d7a9e054b7ebbc785b50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750672, "uuid": "970fa118-b26d-4c76-9250-6ea337396e47", "comment": "Malware payload (RedLineStealer)", "value": "d412349a31fc8ea909bd4a7ce41a789cba3c136d5f11e868f3779492d441ef82cb71920d7a5a5306dbd35ef00afa33f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750672, "uuid": "26d881fd-d103-43e3-abcb-31f91dec1d01", "value": "T181543AB77796DB77E5D1D0BB9B2351A9C420A8F0B2DC24CED2806B1E56201E68FF0617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750672, "uuid": "ebee4ae3-cc98-4543-b956-7f1a53b87258", "value": "bb6d69b7632b1e5c0fdd9e8372c6b738", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750672, "uuid": "52c8c97f-5953-4f4d-9ebc-f22c73e54b86", "value": "3072:XSIb4We49v5yPE5PQcZ6qGtKY1r63fx8h0A2aH/qABx6:XvDe4wOPQVqGr1Qf6GQCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750672, "uuid": "b7b258b0-26df-4a8b-ac0f-4352029a87d7", "value": 292473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750672, "uuid": "2c1b35e1-ab3f-49cd-9e00-4c9f8e132e49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750672, "uuid": "240c8d9e-2e41-4726-bef5-462739ebd911", "value": "deae75b8a6220add962d77a5dfcaa0a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36bc7214-0a6d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686717468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717468, "uuid": "5099e85e-c863-4503-aef5-364838bf3388", "comment": "Malware payload", "value": "a094a2a5a82d30b38bc8e8e3fbe89e7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717468, "uuid": "82086e13-7b2e-4bb1-a626-586bfd3a1d78", "comment": "Malware payload", "value": "9a2e4ddf1a625c470c05a8ac7d1aa8b8a89f15c0100a673ec8cce3d8b42b7216", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717468, "uuid": "537e91c1-ced6-4a8a-9323-b2c217ea97a6", "comment": "Malware payload", "value": "fa73b9e755085cdad5964b7d86c3466359c5a4de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717468, "uuid": "8675dc8c-a7bc-464f-b886-1df63494807d", "comment": "Malware payload", "value": "f6c8afe091e999faa8171072958dfda91bb4756ece423582768742ee07babadce46cf81d97e25466101270410e3d9afc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717468, "uuid": "171cc562-3f04-407c-a59c-7e3fdb7031e3", "value": "T1E2B468710A002A32EBFED2766468921A917E1D5DE61D307215F076622FF3FBB872760D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717468, "uuid": "4bf8311f-1c86-4db7-aa59-1949cb143021", "value": "50014ad92586f6702c4c543829688c18", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717468, "uuid": "2fd0880c-9fac-4d82-be51-fbf0ada13af2", "value": "12288:0KPor4zohE15vt4Iip+j/7tnXh0HkSOui:0gzcCjG+fpXh0Jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717468, "uuid": "3009a2c0-0fd9-4fcd-b1f8-241c870d0b7d", "value": 538528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717468, "uuid": "4f0a8c14-12a6-47b2-b40a-2795f34e2cae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717468, "uuid": "880f1296-a543-4697-a360-825a2e727945", "value": "a094a2a5a82d30b38bc8e8e3fbe89e7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c2d849-0a70-11ee-b3cf-42010a9c0076", "comment": "Malware payload (TeamBot)", "timestamp": 1686718882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718882, "uuid": "453cc740-ed52-4524-b154-316c5e10e114", "comment": "Malware payload (TeamBot)", "value": "ba09cbf06628f48ae306d2d95b903426", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718882, "uuid": "c68590b8-3b20-4c13-8a36-5d9c3370a0db", "comment": "Malware payload (TeamBot)", "value": "9aad01b3903645a13000c12c9a1dde28ae8afb1b5750dc8893437c134dfe1fb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718882, "uuid": "2c4c74b2-154a-4059-823f-5465f7a7b0e9", "comment": "Malware payload (TeamBot)", "value": "5147bfa3f7215317244f6d804fb30c2a9f7266ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718882, "uuid": "56fd9e5f-4f61-4ba8-badb-381ce06df20c", "comment": "Malware payload (TeamBot)", "value": "4ac192780b84d00695020cbe1485a2a62ff167eac4fa34198821f464da5c639e92322f11a6dcd71621705bb1b4b4b190", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718882, "uuid": "6ff85beb-26b8-43a0-b95b-960f1abe3ef1", "value": "T17304C0A232E1E87ED0A756319C75C6A4276EF8124F70A78FA318163F1E701E159FE352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718882, "uuid": "fead87c7-b84a-4c78-a2fa-e631dc962e2a", "value": "f678da7882c86102a2a8a7a8ee56bca1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718882, "uuid": "c51773b0-c9f2-4d14-acc4-04030a190663", "value": "3072:IjDKxAHkZ5iYvRCpnMO4SaMY7JirOu+cCBbubvrflP:CDJH+LvRunMO494Olc/b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686718882, "uuid": "7f66bd0c-fdd1-49a5-a1cc-8121bd1cb177", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686718882, "uuid": "705cf811-8a42-48a7-ae06-134395572959", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718882, "uuid": "09adfc7c-90fc-4e55-a746-48370395c775", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d800a3d-0abd-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686751866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686751866, "uuid": "3d5851ce-5322-4040-804f-67e33919f803", "comment": "Malware payload (Quakbot)", "value": "83d718784ac4f16f2351a0bcc0ddf75b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686751866, "uuid": "192be0d6-3ab9-42d2-a636-fd69679c2d8b", "comment": "Malware payload (Quakbot)", "value": "9acd2fa1d89147b4f7f58301e5610d0b5533456da51214124be0a647cf007e5b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686751866, "uuid": "6cc4efe9-88a2-4a21-be3b-c83b40c6cc39", "comment": "Malware payload (Quakbot)", "value": "72f9d26b03bde2d2b4b35d84cbba806b498b3f6a", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686751866, "uuid": "95f2c68f-09fe-4101-9997-ffbe5d43d601", "comment": "Malware payload (Quakbot)", "value": "12f30b002cef7c8fef2d73a2338672a3b7259feb3d2d8ae91ff7a7c5881828e7f466773672babf9e329b911bc0119bda", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686751866, "uuid": "e0480c24-5218-4efe-a2d2-9f6159494bc2", "value": "T1458493985A51F0B18133B33BEA165850F96F4F1B5194CD66BD3C682CBF3C4186AB7E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686751866, "uuid": "c2ab2d32-d45a-4fe0-8d4e-0df05c140731", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbqY8B7HAjRXDkdNvbJcRWkIY:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686751866, "uuid": "a3ea8900-f04d-4ab9-b813-64a2b5e58e60", "value": 382307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686751866, "uuid": "ab752133-4649-458b-9e55-07b05f2ed5b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686751866, "uuid": "454796c1-17ea-419c-9020-508264b2a4ff", "value": "05BJncpTlEjWVV.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e42927c-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728298, "uuid": "e96357de-8839-4f86-a34a-c4ca34297d80", "comment": "Malware payload (Quakbot)", "value": "f9ce1a6edb250e1afe2d5f30f295ea0c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728298, "uuid": "58a7beb7-b4c9-4791-8d8c-6e13bb7010e6", "comment": "Malware payload (Quakbot)", "value": "9afc07d212d7e028829b7ee4cd644b0449b2a3b42e328211be67c040c9ab8981", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728298, "uuid": "6b9afa75-1dad-4fc0-924f-94370a04967f", "comment": "Malware payload (Quakbot)", "value": "9c49a75ef771ab36475b3c3b0155eabc922d0759", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728298, "uuid": "f5966cc5-a85a-4906-96ee-00122e85c6f4", "comment": "Malware payload (Quakbot)", "value": "160b141caf464b3221d40da0e02b87970e324de2c3d83626a1c897ec1783e90a1cf5f9f2d8010e47d2c0f7c79590a49e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728298, "uuid": "ed1bb888-b84f-4d63-9347-9564d1cd0813", "value": "T19E745344A656E0F15237B37BDA178020F9AB0F4B6184C972B97C50592F3D8297EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728298, "uuid": "60639612-1876-41fd-8fa5-94cb31e165f0", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb2WBwPRhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728298, "uuid": "3005e013-e30e-45cc-ac3a-8d8d459b2c9b", "value": 353411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728298, "uuid": "f293f6b4-0f45-4950-854d-d4ed58017b5f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728298, "uuid": "936e3ffb-af3d-4d1b-a775-53168e91d4ae", "value": "Zj68Y2WnMENnFt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f3d80d-0af2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686774668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774668, "uuid": "91117bd8-f3aa-4567-922a-c6b48d01da58", "comment": "Malware payload (Gafgyt)", "value": "f07c537f6cf0249a4a9e56eead4c19a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774668, "uuid": "8e5dde93-3eee-4873-b9f3-8b1d6d46378d", "comment": "Malware payload (Gafgyt)", "value": "9b233d8ca5a612e04c3e31f8d0bc5c29ffbb7467b27d587d45cefa70a54b33b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774668, "uuid": "7b539a3a-8628-4f6f-bce1-8492d7eee081", "comment": "Malware payload (Gafgyt)", "value": "86775078046630ed9082c9c4fd5874f1eb016359", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774668, "uuid": "49c17d87-6780-4efb-b694-cc7ecfba2314", "comment": "Malware payload (Gafgyt)", "value": "31ffaccf73639c3b8ead54cffbb337d72f92bc410b2dcacc535ede65df6227cd84a3a478947bd34c338d7c90c88e33c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774668, "uuid": "4da401bc-b9f1-4fa9-ac4e-0e8d72c05df6", "value": "T191933B56A780D5B3D14305B316979B620033FE7B1A5EAE0AE35E7CF18F3A0987221B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774668, "uuid": "c95abf18-541d-45fd-acd1-1b2f61bb036a", "value": "1536:msqmQTbw7U+OU0Cf5UI8E8WwP6kHzgk81VwcG2emcGMUNLe5um7WAgcVjmZIcBI:msi2UVUtBUI8GwPfHkk8rmeLesmqAgcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686774668, "uuid": "5163302d-4311-44c4-be21-3b0eed447d36", "value": 96268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686774668, "uuid": "60cacdf8-9175-4d3a-a28a-e9c5f509ce72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774668, "uuid": "625a569d-297a-4198-8dfd-b7d0554f2342", "value": "f07c537f6cf0249a4a9e56eead4c19a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af309337-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725830, "uuid": "1c38f222-f9b2-408f-ae91-bcc76a4eadbd", "comment": "Malware payload (Quakbot)", "value": "b8602dd2134a1501fd7c401f881ee138", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725830, "uuid": "bcfbe011-4365-4e17-af68-4f67d83de6fb", "comment": "Malware payload (Quakbot)", "value": "9ba74cdfcf6e2d03b7f89e6544307abaf18691cebdac6f90c483d3c53a75d7c3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725830, "uuid": "8ac1ca88-3539-45e4-94e4-8b66ee284a2e", "comment": "Malware payload (Quakbot)", "value": "ac53056065f979a9f9afd34efcc827047fe1d2b4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725830, "uuid": "e03d9ca1-6e02-4a9c-949c-ea310866c902", "comment": "Malware payload (Quakbot)", "value": "3298a46056beedccfcf7924a40ec4b58083819857fd0d34a2607315fdb03db28c5519c070b62f0a89a93494df41b610f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725830, "uuid": "770a8f3a-8550-496b-9916-c8b47d17fb59", "value": "T106746349AA45E0F18237F33BDA178450F96B0E5B2084C972B97C515D2F3D8287AB7ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725830, "uuid": "f7d6594e-9b50-4f69-9387-406c6706f7cc", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbZOZJ6IHlhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725830, "uuid": "eb26c7fc-57d3-4a11-a96b-1bab16147098", "value": 342774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725830, "uuid": "b139919a-ea4a-441f-9d6e-f9066c093ed6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725830, "uuid": "2281cab7-9a7e-42bf-a42e-f0179d54fce0", "value": "jQWEZa5Zg7McK.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45b78ec9-0a9a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1686736820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686736820, "uuid": "485a1b6a-4589-47c4-932d-c40c9bb16b28", "comment": "Malware payload (NetSupport)", "value": "6a678dcf3e07009b9647d3a5f5112dd5", "object_relation": "md5", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686736820, "uuid": "0a883605-a686-4bcf-b6cc-fdde53f12c31", "comment": "Malware payload (NetSupport)", "value": "9cab04450eca89bdaec458276b76e52e012117647573d8399ba874f1f50aa94c", "object_relation": "sha256", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686736820, "uuid": "19eb5ac0-9897-42f5-bc3a-3c0b2590b132", "comment": "Malware payload (NetSupport)", "value": "0e1d47c34752cd9f46455d21df8a7f2cfaa6a242", "object_relation": "sha1", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686736820, "uuid": "072bc6f4-079f-4aed-ba4b-7805c08f1038", "comment": "Malware payload (NetSupport)", "value": "3461b06ba7a75cb4b6bcb2f6a90c548287b04b1cb113488e2e755cb59ad6232b55ee43e1c12043419d146ab7fd9c7b95", "object_relation": "sha3-384", "Tag": [ { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686736820, "uuid": "d06c08cc-1eb2-4865-932d-b32c56cbce8e", "value": "T16962E13877CE3491F9E430B36097B38463A53D96E987FA997F2CF28429A01439621E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686736820, "uuid": "a98bb50b-9ce7-40c2-a71e-97077b653f7e", "value": "384:uzwITgVjaMl+yOuggzRAFpqG6eoOLEiJtuis:uznsVjahhuXNEquoOLZhs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686736820, "uuid": "cb5fa24b-9047-4202-9af7-26703e7e34eb", "value": 14534, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686736820, "uuid": "99652ca6-ad1d-40ba-ab64-89d19ce4b13a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686736820, "uuid": "03bae9d3-dc5f-4031-ac42-861a644a81ce", "value": "doc674.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d795e053-0abf-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686752956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752956, "uuid": "95400bec-16eb-432c-ac47-936dc770cd3e", "comment": "Malware payload", "value": "a0056759d3d69085e2b8c67a50a03c83", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752956, "uuid": "f31b7276-1ac9-4f21-840f-8e74fd216842", "comment": "Malware payload", "value": "9d1d0f5db3aa3591c461609c50de2543621bffb461aafe0c939df74612f54102", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752956, "uuid": "461af15a-a400-4ad0-beb3-171bd96987f8", "comment": "Malware payload", "value": "092deccd880a23b20d612f8b41daef61dfa96e83", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752956, "uuid": "67524c30-c694-4a80-88ec-9a2e88dd4fc1", "comment": "Malware payload", "value": "3721c02d3f7f1d2f23629e639af6e1d7e8c006a1e3860977e16fcbf234588f39e667adbd2d08eaa7f92112a92d323711", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752956, "uuid": "b19b3848-7bca-4126-9780-2ed0de9c7733", "value": "T17C727D5D57DE8475CB98B37B23B93989426FF2372B4998F1BC9C51C13A310229E281B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752956, "uuid": "b37b8283-0614-4b10-81f3-1f40aff33488", "value": "384:1EbSN0gkbI2e0GDd9Jjr7Jgj57VcSD2Q8+iqmDPIshxJf:1fNf4/3K9xXJgRaE6IKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752956, "uuid": "7c08a63a-cf85-48bb-acc1-cfb8fa730876", "value": 16435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752956, "uuid": "2e57c148-b59c-4c09-8592-4b96a2509a62", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752956, "uuid": "1eedfd3a-123f-4ef6-9a3e-2987c07130e2", "value": "PO-4501226854_WJO-001.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a59275-0ac7-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686756204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686756204, "uuid": "7fb7b6b5-4a10-4b2d-a863-1a58ff7f68ef", "comment": "Malware payload", "value": "c4c2c08265e96a97f7c9db2ceee8f989", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686756204, "uuid": "eff7e37d-f144-42df-91f8-055e564abaab", "comment": "Malware payload", "value": "9d36edc07fb56ddd36193c967dbec4a12509877fac045d5de700d25bf41e190d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686756204, "uuid": "3847390d-fbf5-4b97-b999-e8ceae15fcfa", "comment": "Malware payload", "value": "6cb101fdeb461566bcd50ffd62e3047851499848", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686756204, "uuid": "e935a8b0-1a43-496d-b62a-acfa9757407f", "comment": "Malware payload", "value": "73bb0e45fb44b9bea5f47b74ed07888d8ff0934bdb6687a48b03106617bd0e65ce52d02585e9950243e7e853cae75d38", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686756204, "uuid": "1d3390ae-dad6-4e4f-a95f-da6790e683d4", "value": "T11E5462996A45B0B1D133F33BDA1B9800F97B1B2B11848967797C50687F3E42896B6FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686756204, "uuid": "31fd20fc-105b-4b49-acc5-68248dc5dd92", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb5Vpf8bfhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686756204, "uuid": "90a76727-eef8-4f43-80a6-244b4fc064bf", "value": 281950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686756204, "uuid": "6cfe51b8-6b85-460f-b73a-24bcc943c59c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686756204, "uuid": "b80f72a5-e02d-4bbc-a717-8bfb2f3cda13", "value": "G7xtstPTqXlV.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb17d9c3-0ae4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686768827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686768827, "uuid": "2d735efb-146c-4589-b926-b282e7cf8e8c", "comment": "Malware payload", "value": "6b1ba532bbd0e06814e70daae3438804", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686768827, "uuid": "993a0373-b33e-41f1-bebd-fc3ac2550dae", "comment": "Malware payload", "value": "9d611670d5a5aa621e0e5f07e07b4ae0065a6a0e2aa7d4b370cd65fc03d1b36b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686768827, "uuid": "76b225f6-d54d-4596-b5bc-2ac43b9333a5", "comment": "Malware payload", "value": "922fd9d05a2ca57dd499b737c0e5f669e44f7b11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686768827, "uuid": "71b7b7f7-4b8c-4cde-8885-fa386b5d99be", "comment": "Malware payload", "value": "db7be16d5917a418abe51e9094d7b57c5ede12bdb5436b8a8dc9d1b2331b4c5a8b998fd74f47aa9dc29d22af515c1011", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686768827, "uuid": "a3e60906-354d-4c86-9c66-9053ecf72a84", "value": "T19FF5F195B8D80653EC2CA13B60EC5A675E784F1873E291CF9EF15FEC70848E906B4A71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686768827, "uuid": "21af1578-2699-4237-8821-1581fd35dfa0", "value": "d0e9a9842af23a2d59961265f1d86648", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686768827, "uuid": "830539b3-c9d6-44d8-86cf-305edec280f5", "value": "98304:9r1eGnF1ZNUdyNH0RnzTHx0XkSFNWfGbb8YS:9rUGn3YdcH0FvHWkyNkgAR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686768827, "uuid": "4fbde167-7156-4128-bd35-3fb4c822e6aa", "value": 3566592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686768827, "uuid": "7ba8353e-f349-4936-b35a-04f253a27c92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686768827, "uuid": "b459cdff-994f-44d0-a95e-f237e83f0baa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91a89343-0abe-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686752409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752409, "uuid": "0719f003-366c-44dd-a99a-55e2d1db3075", "comment": "Malware payload (RedLineStealer)", "value": "87b4f13b5e034d789a66dc21f885e110", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752409, "uuid": "398bc4a6-0b64-45d5-8398-5b388d0ec2bb", "comment": "Malware payload (RedLineStealer)", "value": "9d710b2c3966002ffa95d84eadd2b54e1db9e41d1573b64329e470e4e179bc0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752409, "uuid": "1a4cb902-ee43-4768-bc5d-1a1eedcb4e13", "comment": "Malware payload (RedLineStealer)", "value": "b75ad12f70a3129f93fdcd5f9ed013f5cbd8f3ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752409, "uuid": "5b6f19b8-56b1-4fdf-b5b4-2e82f22b1a39", "comment": "Malware payload (RedLineStealer)", "value": "c7d2475d07042342662b4e56d0ca693d9c5af5cb433aebe847bd98b6585e867671bfef0989c3c344f1e15c3fc5a7fecc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752409, "uuid": "114d01f2-3eac-4629-8c0d-8f482ca47e67", "value": "T102D41222FBD41071ECB527B018FA02870E36BE61DA39935F2785595B2C72284B576B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752409, "uuid": "d45f015e-2914-46de-9f5b-a2af48780a84", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752409, "uuid": "0c64784d-73a3-4e54-aedb-1ba79ef23b5c", "value": "12288:yMrvy90Mc29unStQYOqsbv73xCtjHmTlSabcfs:JyXwStQtbjBCt7mRSais", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752409, "uuid": "fb00ccf4-e78d-4fe4-8c75-480748f6f398", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752409, "uuid": "2ccbb239-9969-4592-9571-42c955409b0b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752409, "uuid": "d96ef921-b899-4ddd-a59f-9c73880a84ac", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7d5221-0a6d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686717479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717479, "uuid": "2bc603c3-c3be-4d0c-8f8b-16127318242d", "comment": "Malware payload", "value": "d0c942dbcadf61785bbbb6852bb0da55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717479, "uuid": "34adbb5b-5b2b-42d8-8086-ec0079290827", "comment": "Malware payload", "value": "9dfada80821fe75e20c9b41ea95780e70462e88f2a1590c74b9e0cd0ecd52caf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717479, "uuid": "4213bcea-d640-4d9a-a7a9-ce63282ddf35", "comment": "Malware payload", "value": "1ef1d3e9789a980b1f75b556d835636ad2d7a66f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717479, "uuid": "a54a94d4-1487-44f8-bbd0-048210e111e4", "comment": "Malware payload", "value": "d17aa6c2f54fd597be80ea7012059cc82394339e2a77e5969a06f07355abef5933a41bb8a6fb8373c967c5259cfb930b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717479, "uuid": "c138d5c4-2789-4227-92ef-70b192b85f61", "value": "T1F124E1A0B47739B5F78B18360E1A8FBAFA2D71735719E39021ADC4DF31AF7425295280", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717479, "uuid": "b8ac015e-e47c-4d86-817e-13153d80810b", "value": "3072:JJ0MF4Tka7FuvGCB9XT6oGhxi0rGiWSVFao+QWo6KhCJMQPb2bgxsH0lQnlXv:z0r77FkGmBGoGbimhhnnWo6KhCJ4b2wf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717479, "uuid": "88dfacdf-4acc-4e7d-9b58-ba60b65560f4", "value": 228557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717479, "uuid": "b456ef8e-90d8-4dc6-879d-febfbf5ecafc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717479, "uuid": "0e3c3a2a-2329-4578-bbb5-b920c197e08a", "value": "d0c942dbcadf61785bbbb6852bb0da55.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "271365c9-0a47-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686701120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686701120, "uuid": "d5b64d3d-a517-4343-82ce-85b9890d836b", "comment": "Malware payload (RedLineStealer)", "value": "5aef81c9587d495e0d52ab887f619ed2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686701120, "uuid": "ad13621c-83fb-495b-9202-8994bb01949b", "comment": "Malware payload (RedLineStealer)", "value": "9e462cd16656cd7f2ef0a93f7b5c7a23a27603d7923595718ab25382cc2fbaf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686701120, "uuid": "3091099e-5f38-4ac2-b46a-692a54110648", "comment": "Malware payload (RedLineStealer)", "value": "80b6c3a66b1b4b925046a0b0941a22d1f171d851", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686701120, "uuid": "2f43f28c-ffdf-4616-aff0-a0404a8c51f7", "comment": "Malware payload (RedLineStealer)", "value": "7a83a5ef51bee08cc3846e7c7c7a3b7abfdcd2240d124a376beae3f3c73e834b4922b117c921db015771828baccb3f72", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686701120, "uuid": "02537e75-bb93-47b6-81a2-71261678a1d7", "value": "T1C8646DC0A91CD231E2838472E87B4263960CE8767A54D3EF2F85A57CBA766D1CD54EC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686701120, "uuid": "4a5a0e4b-37ef-456b-85f2-a796de57c3bf", "value": "5b43169544844188711b217df61eb2d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686701120, "uuid": "6897d58b-bdb1-45c1-8c5d-0f5bc4be699b", "value": "6144:FdRU+upbdgkDXvatqY704pnH7hYx7oPG5RU0nC7:FPsp5dDXvkqYTVYxPRU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686701120, "uuid": "941e52d8-9beb-43d3-8477-a2e9d8b36588", "value": 326312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686701120, "uuid": "5c258e06-7d42-4a0e-8d3c-7c441acb2121", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686701120, "uuid": "c5d7cf95-0ced-46a9-b520-7433a9250f89", "value": "5aef81c9587d495e0d52ab887f619ed2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a1366b-0abf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686752783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752783, "uuid": "f7b7c4c8-ea0c-480e-bd55-89de61fb10cd", "comment": "Malware payload (RemcosRAT)", "value": "5f3e358fd5eb5839e4bb7a4d5e2f62af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752783, "uuid": "060bde2d-e6a1-43fa-85f4-93394727b0fa", "comment": "Malware payload (RemcosRAT)", "value": "9e6406269fe3e1f7a309e3ee01e4770d6f5c7abd2dead9afc7eddfedcdb04295", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752783, "uuid": "20a01515-18f8-497b-8b48-34467266d6c5", "comment": "Malware payload (RemcosRAT)", "value": "46dd3f88b0d4600c018c7113a142a13b3fc26c5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752783, "uuid": "fb87f85f-4361-4fa9-a01d-9cbcb45ab8b6", "comment": "Malware payload (RemcosRAT)", "value": "6fa8c8471b60ef0b3125a870d38b3e384f36732aaabd64f3a2bb5cae874f562a0fbdaff3cc0cd1f2cfee536626e12f49", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752783, "uuid": "f4dcb9d3-9a26-40b7-b59f-2cae99c6ca03", "value": "T1F83512949AFC831AD8FB53F9A96058310BF1F51E6432E35A0E42B0E66A63F115F11F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752783, "uuid": "d437ed19-61e1-48c8-8f74-1aadb87a4730", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752783, "uuid": "e69ba2db-642e-470d-8a21-85d347dff206", "value": "24576:obFruy7GRJmaoCwuxEd/Rh5Ciaqewx7guNYhDust4qXdVLT:ohp7GRJ9ovrHmXwNR0J4qX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752783, "uuid": "202614f4-5e89-45be-9f45-9a36a7e1a615", "value": 1104896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752783, "uuid": "cab99230-3af3-49ec-bc3b-e5ee4e1e37eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752783, "uuid": "11bc0c7a-e15f-464d-b3fc-3b78f8280cfa", "value": "5f3e358fd5eb5839e4bb7a4d5e2f62af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6912b48-0b0e-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686786885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786885, "uuid": "ea44a164-3d7a-4448-907b-763283924888", "comment": "Malware payload", "value": "a8e180e8405aad36f842347a505aab7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786885, "uuid": "bb0c7546-ac44-4b7a-bf29-f719205f3121", "comment": "Malware payload", "value": "9e6f8750e45bd4a16e7994f5fb27cd304b7b564d19ffe1f8bf3003fcc5737d42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786885, "uuid": "529edb84-c1b1-4eb1-bf05-9b6cf090aa6d", "comment": "Malware payload", "value": "af1ebcf11365e9c8ff6baf464ea7a8d3e74b11ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686786885, "uuid": "f4d857c0-e4bb-4bd6-9d78-4955e5aaa0f0", "comment": "Malware payload", "value": "463ad487c8373a48db5833d8f0cf0ff97a199439cd003dcedd28c7da0d9dc11a16ce4e8324d0f39a122e519922b78890", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786885, "uuid": "fae7774e-7dac-44cc-9f48-37e02913ca33", "value": "T1E414CF2271D1DC72C9A61F728C79CA95EA7EB8124F34A69B3728072F2E703D15D72346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786885, "uuid": "3db3f83e-5bff-4892-9c60-f6136c30bab2", "value": "554b97b4ca75d054417a17a8c740d1a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786885, "uuid": "55607487-4ab4-43e2-bf37-3914d228f160", "value": "3072:OARH7n2BtHA/FsO7y8Bam5RtTjub5h7cQR+b+96L:7RbnWC/FZymaMRtHmh3e+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686786885, "uuid": "3764a66b-6202-4954-b4a7-d1251f5f693c", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686786885, "uuid": "a454177f-ccdd-4132-a755-3634b388feb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686786885, "uuid": "61923e8e-c985-449d-812e-e974e2c736aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fbab890-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728381, "uuid": "db4bdd52-6854-4c43-8a0c-871779c85437", "comment": "Malware payload (Quakbot)", "value": "3cd9ebc0b8bd72afb0a58444d3d3cc0f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728381, "uuid": "f55dfad0-48c2-412a-ab0e-efb10bde8b62", "comment": "Malware payload (Quakbot)", "value": "9ea92b344586ead491a8abfffa283432b9119fdd13d753e83e5dd55465d0970f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728381, "uuid": "bdc69a1e-8fed-4a5c-878d-8a32255ee156", "comment": "Malware payload (Quakbot)", "value": "1ef77fddb508d607b2dddf491e6518048f095384", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728381, "uuid": "13163e8c-7a10-424a-9798-15e55f600e67", "comment": "Malware payload (Quakbot)", "value": "6d585d4cc31945e077c0eeb4b2db257d6dd33f44b07e8426f54f609fcd26e9299e00909603e683cc9ee43b2646ca0215", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728381, "uuid": "2caebb49-5d21-4669-aeec-593856485eb8", "value": "T1CF6412856A45E0F09137F337CA574410FA6B1E1B21848936BA7C61582F3D86D7EBBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728381, "uuid": "08df72b3-8a68-401d-bd20-3bcc9a0b7385", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbAMMCQ17JUCfa6hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728381, "uuid": "b2578a49-0be6-491f-b72d-82227ae65917", "value": 329597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728381, "uuid": "c30d87b9-f265-4e5f-9fae-98800d9608c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728381, "uuid": "bbf5a102-da17-4001-bbbc-df28d196eff1", "value": "XiDoiQZTeJ449.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "429cd2b3-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728225, "uuid": "7e812bd2-327d-4b52-843b-ea50a13b813c", "comment": "Malware payload (Quakbot)", "value": "1e38f5da0c3ad4b9e09008de7c91efd9", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728225, "uuid": "c124e08b-c70c-46b7-94ee-053b11d29e18", "comment": "Malware payload (Quakbot)", "value": "9efdf759a7bfbb48310e66c322b48ff213edac8fbccfa22e67e736ceaa0a79dd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728225, "uuid": "c7b8efbc-607c-472e-8560-37f3cf6121a5", "comment": "Malware payload (Quakbot)", "value": "e04ef9927e11e845a8aaf37c77010d513444c356", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728225, "uuid": "96a41042-052d-498b-a349-3ca3e1991109", "comment": "Malware payload (Quakbot)", "value": "302c010d8f1ab30ba4e81ed64657deba290fcb8a5832c2e9359a87a58c13ebcf4f7bbf9b5ed742fcf005af0e86eacc7d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728225, "uuid": "79d2f6e5-ae9c-46be-a4f4-082641ad2b89", "value": "T1D87433895A45E0F09237B33BDE178420FA6B0E5B1084C972B97C51592F3D8697EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728225, "uuid": "3c4bce00-535d-4526-bf6e-d7fa3d54fbf7", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbNyq1S3Ywxue5gJaTRF1GhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728225, "uuid": "093dc903-333c-48fa-a1d2-b5378dca9dcd", "value": 348621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728225, "uuid": "b32ac300-c762-477c-b5e7-0b29bd9a7a3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728225, "uuid": "e54282d7-6498-4d70-9883-ec1a33713b4a", "value": "b5LtrJFTn04eU.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc2a34c7-0a9d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686738361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738361, "uuid": "86dc6490-20b9-4bfa-be26-1931faa3569c", "comment": "Malware payload (Amadey)", "value": "6db65b9c3b8f24973b7ffc1e55c792eb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738361, "uuid": "18fa012e-ca97-4fa5-975b-5d6a9b596c47", "comment": "Malware payload (Amadey)", "value": "9f14458f2271a78307dbc3cd2c96e893e74d5af5eb2f72d031bd9e111430b8d0", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738361, "uuid": "7b40a961-73b2-4e15-87d4-41c0d64d50bf", "comment": "Malware payload (Amadey)", "value": "60015af3c20d6b5ed7c4ea365c1cc987cb3f9cd9", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738361, "uuid": "a6ebc6ed-859c-46b9-b4f6-e6077b76aa02", "comment": "Malware payload (Amadey)", "value": "da8269bc0652ca96356756fc5473ffede5523109519f6bd349eb9a1c761a818e8cda72dfb065c1a1cb032eff28594843", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738361, "uuid": "f714cdd1-2479-4bc3-8645-d018912d5375", "value": "T1D2F41242A7E845B6E9F123308CF607D30F367CA36E75831AA345589A5DB38C06536BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738361, "uuid": "0d7057cb-8939-487d-8950-4148ce5706d7", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738361, "uuid": "b5112fd9-e50b-406b-a5c7-bae157ae475e", "value": "12288:WMrWy90MjkUtCm5T/x1TejqpPzCeYWlk3BWEX197TOXlce:oyOUtn5lJ66/0BL11TOXlb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686738361, "uuid": "f4816208-658b-41bd-ae0d-0f42829191f6", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686738361, "uuid": "7db39d0e-f9aa-41f7-a414-a56fce1a04a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738361, "uuid": "867faa4d-3003-4cf9-83d6-4533af494d6b", "value": "6db65b9c3b8f24973b7ffc1e55c792eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb6b1a8-0a9b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686737292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737292, "uuid": "85e2afca-a56a-4bbf-ac67-5c21be86543b", "comment": "Malware payload (Amadey)", "value": "77a6fdd6c731f7da07ffc412c9f17347", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737292, "uuid": "92d29bb5-bb1b-4688-a894-036a1627cad8", "comment": "Malware payload (Amadey)", "value": "9f564eb9675e6159111b6d0b1ddf6389dc3d93cefd314443bf5a2b7e73c59946", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737292, "uuid": "536c6cf6-79d7-4599-a10d-3fccf58cc952", "comment": "Malware payload (Amadey)", "value": "0017710c7fc14022277ebf151964c79ebdf0106e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737292, "uuid": "cfa665cd-2aa1-48b6-a7f7-def8e15a342d", "comment": "Malware payload (Amadey)", "value": "6f0ff9b1d3f43f3f86b2acac7713a7d6f1cbacb70d60f6344273ae9e5e9191a96578e13b8458b52f556b843930c97ae7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737292, "uuid": "64566d7c-f01d-492e-81b2-91b857f9f155", "value": "T11A936C1030D2C071D97E55351878EAB68B7CB914CFE08EEF27551A7A8E702D1AE36D3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737292, "uuid": "bc45d6dd-b92b-416f-b6a9-b2af986f4cc2", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737292, "uuid": "01cd8838-8362-4e79-9d3d-ae23293f454e", "value": "1536:Qo4NPCKLbqoYkbpplW9YoUsxXzbcouNhj2ZszsWuKcdJUzKaB89p:QoUCWbBNpplToUs1uNhj25LJUOaB89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686737292, "uuid": "95974888-6b31-498b-a84c-ad76992a68c3", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686737292, "uuid": "d0578b04-20e0-4f1c-b5fc-4995e5cd4b8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737292, "uuid": "9f93a76a-5a72-465e-b2e3-ba407a97a6cb", "value": "77a6fdd6c731f7da07ffc412c9f17347", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccd07547-0a96-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686735329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735329, "uuid": "5099ceee-5967-4c66-9e29-8df9a62efb7a", "comment": "Malware payload (Mirai)", "value": "e588120086a2a6e6773bafffa85ed7f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735329, "uuid": "ffce001e-d317-4f1a-95cb-442a41f5dd4f", "comment": "Malware payload (Mirai)", "value": "9fb6a27521206c94dbe9da6101e2b53ad3588be5f0e40142e240ea3abbeeeae9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735329, "uuid": "130394ce-4b8d-4a4f-96d5-ca1f26b3eee2", "comment": "Malware payload (Mirai)", "value": "cd35b56571025a29b788f36d07a36acb784e4706", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735329, "uuid": "c7257552-6eb0-4adb-8e58-c8176015981d", "comment": "Malware payload (Mirai)", "value": "f9f9fb8d9f49ae6c7270a6afc68f16ba88c3f53fa279689633c91e1582f59227828ddc275b6c79f42d137b3d92e9fc74", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735329, "uuid": "34eed0ac-534e-4777-85d1-b066f7b412a4", "value": "T143330744EB87E1F4DD0B4C7104A3B2BF83369A569025DEAEE7487917F933A329025F19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735329, "uuid": "0c8ac8c9-32a0-4d1d-8c36-de95f2318b1d", "value": "1536:IESIuYNrHXOtK5duFaEfUy31A9nfB2qrP:IESIuYNrHXO04FK9fkSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735329, "uuid": "3abb0bd7-cf4d-463e-82b4-bc1b97084ad5", "value": 54136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735329, "uuid": "9e1cc79d-cdbf-44fe-ae94-6e7cf90851d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735329, "uuid": "cf043fcd-b7ab-44b9-b29c-6753fdc21556", "value": "e588120086a2a6e6773bafffa85ed7f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86905440-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725762, "uuid": "0a319a52-176a-4414-9dc7-b61bb81c777f", "comment": "Malware payload (Quakbot)", "value": "b5823513731d24a790d7176df5d76e14", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725762, "uuid": "b270789f-a7df-4c46-94f2-a014584cb9c0", "comment": "Malware payload (Quakbot)", "value": "9fc7cc72b20a7c3b6090fdc016d017ffb4ee406168e028e75aa6fb6d673508cf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725762, "uuid": "ae2c8c51-cffa-4c5f-b93e-2dbddd3f8ce1", "comment": "Malware payload (Quakbot)", "value": "ff858aeeca51a7fcaf84773e4306a15f27650eb1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725762, "uuid": "cc9294b1-4d62-4a2f-8da1-6115e6ecc3c4", "comment": "Malware payload (Quakbot)", "value": "011f0cbf779398e76d6141a1dcb50f05798917b7d6416817d11df3a4bd43062b772cc278ef6a36e652bc46adb0fdb3db", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725762, "uuid": "1e2e4f29-8908-4f23-8324-152ef285b709", "value": "T1FF742349A655E0F18237B37BCA168410FEAB0F5B1088C972B97C51592F3D4297EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725762, "uuid": "1ee2878d-3ff4-4b5e-a2d7-63e442c2c50a", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbxFgFkj+B/6K6SxmAH8wE0No:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725762, "uuid": "6040a56e-2073-4a34-920e-287e459f5aae", "value": 343988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725762, "uuid": "981bfe17-cd4e-4145-86e4-af8ccfd978aa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725762, "uuid": "b87c550d-d1ed-4334-999c-97652f8864f1", "value": "ky0scrKj8sFCx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba03890-0aa3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686740776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740776, "uuid": "de51cdb5-400d-4708-9c97-13a0c96b9897", "comment": "Malware payload (Amadey)", "value": "1104bf625798b96bc8b6c495139ad92f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740776, "uuid": "e68c59ee-679e-4950-8546-102e2646e59b", "comment": "Malware payload (Amadey)", "value": "9fe51401735f0d463b27f6df635200b35258f7424cee6e6af5e7f9e8f36a2667", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740776, "uuid": "0f3fbebf-832d-4b02-957a-abd30036ce59", "comment": "Malware payload (Amadey)", "value": "87b3014bd3ae364a66041489d0557b34d91d4e16", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740776, "uuid": "0f24b3c9-194e-4c51-b6c7-1e1e7b32435d", "comment": "Malware payload (Amadey)", "value": "d95fbcc426bbfdb420bd60920bf46501331ba2fde73527ef226051145224132a5e18b895997e1f358f880266bcfca3bd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740776, "uuid": "dba02f48-d959-4c25-b8ec-21da31401c88", "value": "T1CBF41203ABFA8573E5F107F459B603831E3E3C929AB453763745A89A5C32194E93237A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740776, "uuid": "192c230c-a0de-41bb-8c03-e2dd3df64f5b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740776, "uuid": "ca181ca1-4458-433d-b8db-0c434daee66e", "value": "12288:JMrEy90I1td209LcF2x4uTzYGnXV2AJonR9t5bP0DJnCr4mT4uYET4m/DQp:tydDfiuTssXV2AunRp7apCr4mTVkCQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686740776, "uuid": "34d753d4-2961-47d7-95fb-0dfd6735b0f6", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686740776, "uuid": "808e93dd-3171-47f8-a730-ae94beca64a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740776, "uuid": "9f845eb8-9197-45cd-90cd-1fd853b83a93", "value": "1104bf625798b96bc8b6c495139ad92f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5904af0-0b0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686785944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785944, "uuid": "dfe6ed83-08eb-4ec9-810f-593779c8cf7d", "comment": "Malware payload", "value": "d8e2655f4258ea53c7a0ceda5231fc96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785944, "uuid": "0440c51b-1890-4e47-9a4f-2717aebfbf28", "comment": "Malware payload", "value": "a0140bd61d20392a9cc93a61830fcbbfa400835a464e495ab1083642addc6b8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785944, "uuid": "9e12a0af-a9b3-4458-aafa-2d3034a653a8", "comment": "Malware payload", "value": "c8d70bf14e7e4bfe19f8988b4e4f4fd1ed64ec20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785944, "uuid": "fc2e772f-8bed-414a-964a-18dbed44aaa1", "comment": "Malware payload", "value": "3595de7c8ec9f48845cf2ca12c8196cc67ad358ec71980aec3a1aedec706c5deac4cbeb62bef6374b98c5177a9382fb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785944, "uuid": "619e0546-97e6-476d-ac74-e357b7cc9e44", "value": "T15A14CF1336E0D871D46A57318CB9C6A47A2EF9221F7467CF236C1A2F1E722D28E72355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785944, "uuid": "a1fdd2d1-e87e-4259-a8e0-3c42a8f4164c", "value": "3865ca37561d2aa29b9e83d3d87488fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785944, "uuid": "d73f9c8d-4758-459b-b820-9826607c1f02", "value": "3072:NplXdfW8K/fp2QdAr1OzICT8DhdM4qW/FA8CK8ClclswfbLm:hXhFUR6roICmhwW/crCyls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686785944, "uuid": "65192905-4507-497d-8cc1-e3f5401e79af", "value": 190464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686785944, "uuid": "0c8eca5b-0d8c-4103-956d-992bef7631b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785944, "uuid": "77e6d595-f90e-4893-b3de-5b9b615a5c24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d40fe33a-0a9d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686738347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738347, "uuid": "82849aeb-27eb-4f07-8d94-7fbcd21d98de", "comment": "Malware payload (RedLineStealer)", "value": "5ffd39a2b664e2f557e1784faddd6b06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738347, "uuid": "94773819-0fa7-473a-b90f-d5359a1ae9d9", "comment": "Malware payload (RedLineStealer)", "value": "a0301f1c8d44965b956f04f84113e6c0e4f1962276be7c7083136c5499a125d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738347, "uuid": "46301c1c-1ba6-4da4-b7ec-161fad14d1b2", "comment": "Malware payload (RedLineStealer)", "value": "7a5e69a1df6fce7cc0607144a747ef895b244d8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738347, "uuid": "26d8cb2b-8978-47a9-afab-06cb494eb046", "comment": "Malware payload (RedLineStealer)", "value": "b68378b4b5fd1ec86ee6c796fc47980f8f2b01671dabe37603532d38dc45923eadaf798242ed1a049608732ee62e181c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738347, "uuid": "e404e2b7-0352-42f8-881c-daaf6ce87b0f", "value": "T1FED412439AF88072E8B517B10CF213D32B367D6A9D75936B27165C4E08B32D4A93277B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738347, "uuid": "ffd683f3-ae69-46bf-96b2-06e744bbc949", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738347, "uuid": "81a9b2c3-bd46-4c6a-a51a-2202b2073bba", "value": "12288:fMr1y90eOjPCoRe6pcUa/Ks49fOcy7mRq/DGi:WyXmPCqa/KsvWRAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686738347, "uuid": "fb1ed738-f28d-4b8f-b5e8-ccc78bb06dc4", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686738347, "uuid": "4d3b3c0e-8c34-4257-a78f-964c951dd022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738347, "uuid": "f2380c3e-b67f-492e-9b1e-f90ec017830a", "value": "5ffd39a2b664e2f557e1784faddd6b06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d5acff-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725757, "uuid": "7c629fd8-5fce-4a6e-83ca-8f8d7efeddab", "comment": "Malware payload (Quakbot)", "value": "61c0abd8c5defc40cb66d301c532d48e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725757, "uuid": "0b9d3174-dd99-4685-a44a-d51df1818896", "comment": "Malware payload (Quakbot)", "value": "a03fb947611acd929d3f687dcb4e0ad9d229dd0b13c940713ec8ceb2bf94eded", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725757, "uuid": "c83cab7f-7f37-4a6b-bae1-f0b37087bff9", "comment": "Malware payload (Quakbot)", "value": "d3521e8c9ce461193696c5d2a7066be1c9b469ee", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725757, "uuid": "a0a21e02-6688-4249-b279-6f15c7172b82", "comment": "Malware payload (Quakbot)", "value": "68f1668c100c7199993eed6b14df4a1fea969dc41b1523f4db3fadbef91a7471bea133e2c1daad781354e7415c9903f9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725757, "uuid": "454d93b4-426c-4e11-ae75-6ccbf3851e72", "value": "T1F96452856A55E0F18137B37BCA578410FAAB1F1B2084C972B97C50591F3D8297BBBF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725757, "uuid": "00188538-c356-4c9f-8a3a-c2f6aebcc5f9", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbuRtPDiWaS4ZhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725757, "uuid": "8d61f821-a80f-4664-af47-f3269fc7a43c", "value": 319511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725757, "uuid": "6d178bdd-4706-4855-aebe-76a4bfe2acb1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725757, "uuid": "52f20525-f185-4c05-bfd7-a200be49af79", "value": "lNaGWDhsg0y7b.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d08aa13e-0a96-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686735335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735335, "uuid": "759d02ff-be93-4fbc-b728-c307ed6cdaf8", "comment": "Malware payload (Mirai)", "value": "1c4fb6a663470b0136e59e507a55bd62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735335, "uuid": "cee96cf1-9719-4d97-b111-7f65a742aeab", "comment": "Malware payload (Mirai)", "value": "a05bfcac259f78d2f31db3463f3dc0b86ab29f81949a2f7c4c00767e5bc34620", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735335, "uuid": "cee1fcea-b4ba-45c5-9481-65f69316fc4f", "comment": "Malware payload (Mirai)", "value": "286812f3ef2f59d8777c86084bb5a83b592d99e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735335, "uuid": "7772d22f-84bb-488b-b322-e892024b02e7", "comment": "Malware payload (Mirai)", "value": "c2d4ab7d3347a61f751c3f378299d32721218dffaf9a12ae1b503ddef3c9b9a8d1ce14de55f4041169de2d2cb3ac893f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735335, "uuid": "e2197d50-afa6-47b3-8d91-8062a4f9adff", "value": "T1D8434C01BB28045BE1E35DB03A3F27E187EA9E5130F45108786FFB49EA71D31498AED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735335, "uuid": "e83d9236-7a79-441b-9336-04fd00f206d1", "value": "1536:J3RqLIXin3GP8u4VB1NGY8fBkEHw/r4pdQX324RYA1H9O6erN:fqL2s3TzxN4f5gR16N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735335, "uuid": "c04c488e-e5fc-4111-876e-31e06d45c321", "value": 58992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735335, "uuid": "ab3d4d9b-d141-4270-b90f-47c06f46c062", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735335, "uuid": "6ca49749-77d7-4ef0-ac99-a8fa46a75594", "value": "1c4fb6a663470b0136e59e507a55bd62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42eeb310-0aa6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686741969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686741969, "uuid": "30b24862-79fe-44cd-954f-fbd7100b317e", "comment": "Malware payload (Amadey)", "value": "de3ac50928556baf756dbdebe04a7860", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686741969, "uuid": "5caf518c-f516-4423-bcd3-2a00308a4a04", "comment": "Malware payload (Amadey)", "value": "a06da987ee8166a67bc0ac8d160e7d0d169daf011b2903f1dec494a7481a05c8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686741969, "uuid": "07c62f2f-bf69-4247-8a5a-2a22373660dd", "comment": "Malware payload (Amadey)", "value": "5aa943d3dd6e750f4b5a4962765b602239ed41f5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686741969, "uuid": "77c14804-e1b2-4f1b-ad35-40c6621dbd01", "comment": "Malware payload (Amadey)", "value": "8c394512983fb120e96584f1936665fff2816fbe0630b8f1543a550a3f4d375b67425fea7e60349a04736edc06c920ef", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686741969, "uuid": "eb58cb92-f95a-415e-8c17-d608253c7e36", "value": "T18B24F7217D12C032D96161B619F5BFF2C59C6828ABB049DB7B800F77DA122F73961E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686741969, "uuid": "fc2c7c73-5bac-4dff-b17d-bd6e5623da6a", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686741969, "uuid": "7d160338-664e-44aa-bafc-17df4321b5e4", "value": "3072:CXkSckkHbzG1iXAt60p0zuNmnKG7peNMQbuZAIOb2y3xfbT:8kSDAzG1iciuInRexuZAIKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686741969, "uuid": "2422eb5f-6c5c-47dd-89d8-47dfa2020068", "value": 210120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686741969, "uuid": "ec7bb42a-885f-45c3-a826-4f44bdc86bc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686741969, "uuid": "dbe06f7f-3e1c-4f9d-b4b5-b7a7444096bb", "value": "de3ac50928556baf756dbdebe04a7860.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ea9a8b-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686750673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750673, "uuid": "9c7448bc-8652-4d04-9cdf-1f41d22b5d32", "comment": "Malware payload (RedLineStealer)", "value": "42fb96687fd3384cdb316865dfdfcbed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750673, "uuid": "6ae60732-b1f8-48e1-b92e-0fb3aced58d8", "comment": "Malware payload (RedLineStealer)", "value": "a0eea7a33131a9f834f89f355ca8f56b53a6586e514f5aac1925fe3025f074aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750673, "uuid": "00fe0cbe-b07c-4558-9d8a-f10f1749e3da", "comment": "Malware payload (RedLineStealer)", "value": "85ba5861a5c512ab82f7a772b9eac5f0ad4ea409", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750673, "uuid": "b557e8a2-88d4-4923-a55d-3e41b90e3bc6", "comment": "Malware payload (RedLineStealer)", "value": "4ca2bcf8b3c166e52b8515b201f4120c8e56cc5ed3ed8e921dd4327aa9f2d8a74b40df1021235e3f9b58de6c34c3b205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750673, "uuid": "16f6eada-8640-43bb-980f-b4559fef0a6f", "value": "T11BF41203BBD89176DCB1277068F706D7063ABCB19E75871F2284AA5A0C729C8E57173B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750673, "uuid": "1cb7713d-3270-4bed-b5b1-d7bc796df49c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750673, "uuid": "4e5ca3f6-c206-43de-b08d-86351c9aedf9", "value": "12288:3Mrny90LK35Lup+gnjDbk/dtoGeiTdypuv+jMIgyNlpPAhu9Rx/b5Va9zAR9Q8XM:kyKKJLcXvbTAYM9y9IhiRY9qf58NuFpQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750673, "uuid": "5382f581-a41d-4892-9f4f-5b11b9a0b880", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750673, "uuid": "2642c0d0-c7fd-403a-9a7d-eee923608fd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750673, "uuid": "d8c33905-8c1c-41c3-b9ad-4bddd2b60f88", "value": "42fb96687fd3384cdb316865dfdfcbed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9918d8e1-0a66-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686714626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686714626, "uuid": "c4b858ea-0914-4505-8926-37962666ac1c", "comment": "Malware payload (Amadey)", "value": "76bb79059fdbf2c7ae82f636e6a3b98f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686714626, "uuid": "9bd080d8-d168-4a55-a33f-53c212fd4380", "comment": "Malware payload (Amadey)", "value": "a114fe7e35ff2a50efbb96aec80799c31b0736d9f00df41c94a6bde787318e71", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686714626, "uuid": "822dd9dc-a631-4b50-bbe1-50654d679769", "comment": "Malware payload (Amadey)", "value": "a016a6c3bfe2196b3a900de5bc79de235e938b3f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686714626, "uuid": "6062c29a-d75f-471d-9965-f33d2e324403", "comment": "Malware payload (Amadey)", "value": "f436f2bea1996581b9a7b3452c694d201dabc8cc1cfe9a48d96a9378ae9b8f67e73e0439982c2ed3ee9018702fcbd314", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686714626, "uuid": "fb86c478-f018-4b82-b107-de8ad7dea4d3", "value": "T1C9D4122797E99072D9F14770A8F613C71B36BDA658B8C72B23565C8B2C73580A83172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686714626, "uuid": "95719681-7f4a-4c47-af2e-5ca83a5cf7d9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686714626, "uuid": "87742bcc-518e-48a2-bae9-588f1415a7c4", "value": "12288:IMrPy90isAr09L/A0eA8CUXQa8WriQ/q5Mu7+yxsO+Gt2Vq2:XyXhuI/V8Ai5Ma3T2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686714626, "uuid": "04c33f45-c511-41e8-a011-b45585ce59c7", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686714626, "uuid": "9cfd5044-9d1e-4d5a-9006-7628e461af45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686714626, "uuid": "4b2dc969-72b5-4882-acc6-0ee8e55806cc", "value": "76bb79059fdbf2c7ae82f636e6a3b98f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f6feb25-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728649, "uuid": "4548495a-e7ba-4717-83c1-20de78ed7829", "comment": "Malware payload (Quakbot)", "value": "b6391c42ed2032a55410972d6eaaacf5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728649, "uuid": "e47f3e31-667a-41c4-a390-83adc9d94be7", "comment": "Malware payload (Quakbot)", "value": "a1b497bd1aced6b5fee5f8047389f7ee2356a9a964c8e5ecb4456cfdb4e66b46", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728649, "uuid": "c4ba6691-44b0-44ec-bf0a-5a7d5c2a4fe5", "comment": "Malware payload (Quakbot)", "value": "d953fa46c2f6a4ac4cc24c54a334432010f262f9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728649, "uuid": "2c1926f4-e01c-4438-8673-0cbafa644e71", "comment": "Malware payload (Quakbot)", "value": "f3513f69e681f128218250d987d52dcfd6c1e1cbbbc496f535631e4cebec60951a0d37d46878f821a9e225732d7cfa14", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728649, "uuid": "ce18da1b-419b-40f3-909b-c60bb7879cb4", "value": "T1777441896A45E0F19237F37BCA579460F9AB1F1B108489727D3C50592F3D828BA77EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728649, "uuid": "45c7f715-7867-435f-814a-7a38b2895966", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbo2NhP5AjBiWo758+0cqbeld:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728649, "uuid": "16e8c9b8-6b99-49a5-8e0f-9e1b15181975", "value": 339700, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728649, "uuid": "39b218f0-59b6-470a-b91e-19a8ca2fed16", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728649, "uuid": "3fb9d18f-9b0a-4734-848a-8d8b7162ac7b", "value": "SQy8xBEpG62uXY.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2865a6c-0a72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686719903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719903, "uuid": "98ebdada-3e73-47c3-bdda-8094c7aef8c2", "comment": "Malware payload (RedLineStealer)", "value": "e88b6f1a98daa1371f87a1160a2d9df3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719903, "uuid": "24169cd1-3511-47a1-a85c-39334ba3d24a", "comment": "Malware payload (RedLineStealer)", "value": "a1cc7f7c8cfa50e1ab86e8d5f6763540fe41fba9d3886919a08b60e3a06efdf0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719903, "uuid": "5f7dd7cb-d33b-4eda-bb73-71c2dd4b590c", "comment": "Malware payload (RedLineStealer)", "value": "5702c74b2e7ed41f51a67de82a8a48ec676f575c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719903, "uuid": "e36a583c-e431-4825-ba61-aee19941bc45", "comment": "Malware payload (RedLineStealer)", "value": "1fd4dbffcb506787d912b02eb1e6d2191e4aacb6fcdf51f1fd29b8efe8d68293649cfbf91a7d90cb9f2158253ae7041c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719903, "uuid": "c6a88709-265b-4913-a196-e745d14449a4", "value": "T10FF41213A7D88032E8B11BB15DF713971A32BDA19EB8829717896D590CB3AD4E03573F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719903, "uuid": "4283e9ef-16b0-49a3-a32e-ceadb285c3ad", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719903, "uuid": "9d1cd69d-d7fc-46f1-abfb-7e5c67f23e5b", "value": "12288:vMrBy90qo8lQ3r6zp5xubNma/wNNnEZ2BUroPFHzKip9E/oc1L2iCsEpGCFvo:SyjorAgb4VNJpzK89FIL3CppGwo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686719903, "uuid": "8e17bb41-2e0b-4ecd-8514-98ba83ca857a", "value": 758272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686719903, "uuid": "05bd0027-bc33-4613-a773-2acb4c8a935c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719903, "uuid": "5c5feeba-0e37-4ac7-97e7-d5736ff76c7b", "value": "e88b6f1a98daa1371f87a1160a2d9df3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "864d648e-0a9e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686738646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738646, "uuid": "c1dd4c3b-b73c-4373-8599-5040ff5d3a6d", "comment": "Malware payload (Amadey)", "value": "d4d92cc4cbc762cb86dd16f3777e2628", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738646, "uuid": "25900faa-f932-428f-9cf4-cb16d5de91b5", "comment": "Malware payload (Amadey)", "value": "a249b7052962686a60fca02048df52b00286b7af61f8ddfda8a93c7ee1c3b64f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738646, "uuid": "6624eebe-6659-445b-9af6-edab85457b44", "comment": "Malware payload (Amadey)", "value": "23d96900e448ba185ca989ec4230efeb237dcc45", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738646, "uuid": "3f1ab362-42c7-4418-9539-292e1a3fecab", "comment": "Malware payload (Amadey)", "value": "42cdafa653854c2fd0b06af80ce52cf837fbb8f18cb281604e47973aed99539078553257b5e1e4bb9b7604c75eac3a14", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738646, "uuid": "d999f5b1-a70a-4ef4-9b6e-7a7c86676e72", "value": "T130D41212AAD88063DDF427705CF246D31B37BCA25C70933B3BD9A95A1CB228165B6377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738646, "uuid": "68f42be8-4aae-420f-b8a4-f4512fbd06f1", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738646, "uuid": "d13489ef-0411-442c-bc81-fe0ce9f070b2", "value": "12288:YMrJy90VV4iP9ItIamMVAhZkDJq+Va5kyvpRq+Wkz:xyC+rtIafmKP0RqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686738646, "uuid": "f4ea15c8-b31f-4805-b194-908fa1f3d3c2", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686738646, "uuid": "f485d378-61fd-4828-9b50-21be711d3222", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738646, "uuid": "1179cace-15a3-4716-89ba-4dc3ec4f0411", "value": "d4d92cc4cbc762cb86dd16f3777e2628.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08fc6874-0a73-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686719968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719968, "uuid": "93099e8e-eb21-4a46-a8ee-5ccbac61ce3f", "comment": "Malware payload (GCleaner)", "value": "f89dab152f9dd88ade9196f1c36196b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719968, "uuid": "84d1fc54-cd02-4bed-bcab-f4f32193c266", "comment": "Malware payload (GCleaner)", "value": "a3a9ff3c83d0f8d62372e771ce86fce67eda5fa527784894442e92d515e5c69a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719968, "uuid": "92e70702-9ed8-41af-91b6-310e63870664", "comment": "Malware payload (GCleaner)", "value": "6381fb160544382c0c1d2d38e6d35c38666f1bc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719968, "uuid": "1a44793c-ea43-42c1-a211-df7066ebc77a", "comment": "Malware payload (GCleaner)", "value": "351784cd143400b483c091ae82673e773a3f95298791e758959508d1a76c08d8f7fe8b3710153987ac097f4e62055074", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719968, "uuid": "87c1703c-3c34-4256-9999-147b8296ad4d", "value": "T11D54D0517AF0C832E6F755308934D6A4277BBC735930998AB6A43B6B6D323C16E31393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719968, "uuid": "afbd5659-21f2-4f6e-9404-264a256df348", "value": "56d10481189f6a27053ef040fb6b42af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719968, "uuid": "d2a1abc4-6238-432f-bc22-ab50de1edf6a", "value": "3072:bw9vc6EfH0jiIy9n6mZM3UbahZMDaggjJ6RqTQGNitb07bjZqwuKYc7EcOWwYT+T:ffH0jiI+nJMds6agQTb07RGKA2bN0Qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686719968, "uuid": "196c3de0-2feb-4c4f-9067-8fc8b74ad579", "value": 280064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686719968, "uuid": "33bd8793-0564-4381-ac0a-fa19cd4ddd5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719968, "uuid": "66749917-ae76-49a3-a6d5-04cd3f4a4be5", "value": "f89dab152f9dd88ade9196f1c36196b9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b14cbd9b-0aad-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NanoCore)", "timestamp": 1686745161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686745161, "uuid": "fb6e75e9-a1a6-424d-99fd-81007385c4fa", "comment": "Malware payload (NanoCore)", "value": "e609c811e09ca4731b2d9f5ce00f1455", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686745161, "uuid": "fee133cf-1d98-4f6b-ad37-95d77025d1a5", "comment": "Malware payload (NanoCore)", "value": "a3d233a87114b7ff5648e4ee135c6fc69245c2a2b9c37dd7e340f3de5864f946", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686745161, "uuid": "9ef41e6c-7f70-480b-924b-35a6c91dc9c6", "comment": "Malware payload (NanoCore)", "value": "4d4a92c900b91ef7ae5e7966fd6058c76210068d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686745161, "uuid": "8ff9a0f7-b544-4e97-9b29-8bcc93ea74cf", "comment": "Malware payload (NanoCore)", "value": "dea5532e8f17753cdfcebbb5fd1c3f893cea9e02bdd86c513d44072d09891688700ae3a4572768aee385a038cc6e2187", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686745161, "uuid": "b492676c-5e82-4ced-91f6-d9dbb904ed3d", "value": "T10614CF5637A84A2FE2DE8AB9701241428379C2E7E9C3F7DE28D465B78F127E506071D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686745161, "uuid": "ea5828c8-eddd-4134-ba2a-96d68e29f55e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686745161, "uuid": "b1eb6eee-4f88-4530-853f-cb5099fdd85f", "value": "3072:wzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HI9rmgcZH9Kz2fCdfeCpIT6/Jc5:wLV6Bta6dtJmakIM5kYHk6adGl2w0ssy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686745161, "uuid": "7b2f5cb1-9af8-43f9-bb3b-816f670d49ff", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686745161, "uuid": "ecebea99-095a-4b63-8a46-862b61235e7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686745161, "uuid": "4d5d6890-22c1-42ed-b0ed-6f175e06b363", "value": "xU5pnvaXAYdX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0380a02f-0a6d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Lu0Bot)", "timestamp": 1686717382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717382, "uuid": "a152f57b-dfc5-40ce-9d23-f5ea5dd5cc33", "comment": "Malware payload (Lu0Bot)", "value": "4f4c902e1e3f5f09f5e9222dbe854d5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717382, "uuid": "844d0979-3de1-42df-bbef-fd4107af27df", "comment": "Malware payload (Lu0Bot)", "value": "a4a0e26bb4aa352f66952902cc9704d130593adacb46017c0b2a1be2b7a9269d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717382, "uuid": "256c5d2b-6a70-419c-a6c1-3a842255f665", "comment": "Malware payload (Lu0Bot)", "value": "60c57e3ddf1cc2f542db8a34df9538106b9e1860", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717382, "uuid": "9c4bc970-389d-4e9d-ba41-90d6b0a7c048", "comment": "Malware payload (Lu0Bot)", "value": "e4cefea259f1f15ce274964d9aec894879815f748e467c13da6865641be738ad62e40aa5c7657517b8809c071378bf77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717382, "uuid": "e754f561-c310-4be9-b31f-cdd21ab3bf54", "value": "T179C53392EBF52132D8F917F08CF605070A39FDE4DA7882BB952A268658717D0917273F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717382, "uuid": "602311a6-da96-4ad4-b653-f63f565a4efa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717382, "uuid": "c535411a-0dd7-4c5e-98f4-e14f57ff8476", "value": "49152:6/+TH+w4lItEGTDpE+GkIrHtGsZ3JUe495xxJbDjeFl3yx8v3gUua2LE/:qgH+rIhTG+fov3Jk9vxt2LCy3DmLE/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717382, "uuid": "1a7810ce-963a-4b65-95bc-59356f86225a", "value": 2699432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717382, "uuid": "845e95d5-476e-4433-9b36-e7621d1836dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717382, "uuid": "2dbe2820-1d5c-48b6-b373-0310d7c7eace", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fce89cb-0ae4-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686768512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686768512, "uuid": "1b17112a-537f-4662-a28b-cd859f243bcb", "comment": "Malware payload", "value": "526130633cde09373ee1e2f831b595d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686768512, "uuid": "6fb2abea-1c96-4a79-87b7-a0eb317f96c1", "comment": "Malware payload", "value": "a53afca42d234ac81a441c4fb1c5278614fb07202f7f8018eaa5457a777fc5c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686768512, "uuid": "6afc4f52-b669-4eb1-8045-6f7e7fd589f8", "comment": "Malware payload", "value": "beea6f1ef9a504149be068bc5dabce77a11ecee2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686768512, "uuid": "bc11d596-f8bc-4cd0-8d2d-efbec9bf47c5", "comment": "Malware payload", "value": "5441e1709dc240bd1e5365a9171b145f0ea11f4b0549e0224b7723bac4bc0dbb8b2e08a5e4a58fa74dfd390eecdc435f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686768512, "uuid": "33ecd4c0-48fb-484a-a250-6b065e00e44e", "value": "T19E445A81A7078A9EC81847B577B347C606F0ECAD41E8831F67CAAF781EE26F95C41257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686768512, "uuid": "56bdfd5a-adc9-46b6-a956-1ce2b5d93799", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686768512, "uuid": "7df98783-8939-4e33-8da7-3388a5801fdf", "value": "6144:Xf+ikWrpWAfR66LW9zQ/JaQ7HGhy4ngqQ7F4VvbmIyWb:vqWtW+We7wLQgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686768512, "uuid": "b8cd003a-b53f-4318-a10e-6c4ebd1c22d0", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686768512, "uuid": "71dbe24e-b068-4ebd-89de-6176717104b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686768512, "uuid": "ab572828-5f60-4f43-90c1-4b7dcc85b175", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e03ddfc-0a97-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686735546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735546, "uuid": "7ff96ddd-8735-4510-b951-1ad021558e39", "comment": "Malware payload (RemcosRAT)", "value": "1bd1724013e35ad963f66ba97f31aafe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735546, "uuid": "9544d107-15b5-4be9-8858-dd931f546283", "comment": "Malware payload (RemcosRAT)", "value": "a5568136305ea90dcc7d03b44a8797a2c3355ea741d509ee8a62a339159c8e73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735546, "uuid": "c415696c-3480-44eb-8638-5cee8e6c556f", "comment": "Malware payload (RemcosRAT)", "value": "b0a731c353a45eee4d5cf5e8707e2c2f3c20328e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735546, "uuid": "8535cd6d-ec15-49b8-9dde-0b770db17842", "comment": "Malware payload (RemcosRAT)", "value": "7170cc81b1c320b0149157de8ed7c0df6c458e2923b688868c532bfb2ec2650a07ea96382d93d796bdbd4d684d520692", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735546, "uuid": "5e00fd30-8a2c-41c8-a434-a5224004d1be", "value": "T1A7F4AE16E2D06473D3261A38CC87939C9D2ABD701D2B6D8A2BDC7D7C5B3D6422A1C277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735546, "uuid": "3598ff38-3364-4cf2-8db0-9446cd125618", "value": "c5ddd70a2f2ce9f4b9e5f4b86e781216", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735546, "uuid": "b1702e00-83f4-4e2a-a93b-2bef26c2ef20", "value": "12288:D4iyBJSbLJfaMAhJVNRdfNl6lFqZLDZGqtV6ZE:D3ykf9AJ5vcADH6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735546, "uuid": "2269ddd0-0db6-4e8d-96c2-41666223d9f1", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735546, "uuid": "e17411f3-1d46-4705-80f1-5b935dd12746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735546, "uuid": "79e97370-b75c-4626-afbb-d437334a8115", "value": "BancoBPM SpA Payment _Swift_copy.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ca6023-0a72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686719862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719862, "uuid": "bfd2f2c7-e5f4-41d9-8af9-f4ddd203f795", "comment": "Malware payload (Loki)", "value": "55a38c6f8b4cdadc96ec934807cb639a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719862, "uuid": "63b7ee9e-8c48-4f86-9cda-077e12b4965e", "comment": "Malware payload (Loki)", "value": "a5748dcf451f0661bdb05c9075327bd7ea6cb654b05140f4f2dd0b169ac26bc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719862, "uuid": "6c4d3134-3804-4835-b425-34b81824f2dd", "comment": "Malware payload (Loki)", "value": "50b4f4cf258e9914200f18cc81c5d0db22a9465e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719862, "uuid": "d02232b7-1599-43e5-a41a-3be2a51e9725", "comment": "Malware payload (Loki)", "value": "12e4fb4ff9b91fc3e9d8917ca4ae1aac86ca127e8f25001a2ba4ae4f5f1425548c8d16296537e0247bdf758046751737", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719862, "uuid": "e40f81a6-f95a-4989-b97a-db79dd525514", "value": "T1E5F40100ACAA0B53D67AB7F54F1032B033EE6AC93955F39B1DCBF0D69564F090A42A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719862, "uuid": "021a6555-d13b-468c-a50f-eaf188628cd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719862, "uuid": "443b17aa-cbd2-4342-9185-dd827d8ecb8e", "value": "12288:3DcvG73htU7/2eQ1x9L2c2+2u9E+8SzBhOxnxhvWjsxcGEw4T/UD3U:TgG1tCueiFd9l1hgDvxeX/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686719862, "uuid": "f3cf0000-dd89-4112-b4c8-e6cc6df46759", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686719862, "uuid": "c66e2c22-265a-437e-862b-839f056a400c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719862, "uuid": "57e4f33c-0d04-4812-9051-886743737d75", "value": "55a38c6f8b4cdadc96ec934807cb639a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5712357-0afe-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686780065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686780065, "uuid": "2031e232-b580-43ab-8736-5cfd382fe848", "comment": "Malware payload (RedLineStealer)", "value": "872192011fce20a44869b81d95043bbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686780065, "uuid": "beffca5f-4b70-4b84-883b-fb246ba60a6d", "comment": "Malware payload (RedLineStealer)", "value": "a615cbc5dd94fcea348533f243bddc34f9802ebbe38516f14f08e9bd3a3186c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686780065, "uuid": "17f289b6-a923-41c6-8179-d6c05be07520", "comment": "Malware payload (RedLineStealer)", "value": "d884367548c1f60263007a48cdcef84e7cb67a68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686780065, "uuid": "4ba4e64b-ffb9-406c-a04c-b6fcd58419d3", "comment": "Malware payload (RedLineStealer)", "value": "19a83df462542cf5c113f1b61adb85b18ed92df6943e4ccc6877bb3c06bdfc44eb3f78447e918b39a8b422fa32cda8ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686780065, "uuid": "2b4a88fb-3a38-4df0-9c98-dcf237aac992", "value": "T19524F7257D12C032D56061B619F5BFF2C59C6828ABB049DB7B800F77DA122F73A61E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686780065, "uuid": "53a0f8ee-7969-4ee3-bd86-50c9fb62b686", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686780065, "uuid": "c5989651-e635-46ad-bc37-1bc6bfcca898", "value": "3072:meTRJ0kHbnpN23kQKp5XzutZXKGrpeN84LuZAIybiy3xEfbi:FTR2AnpN2wDurXBeBuZAIMEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686780065, "uuid": "626df0e5-4c9d-4699-986a-f2e7f1fe518e", "value": 216640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686780065, "uuid": "77cbaf76-e6e3-480f-ba86-c9e96712dd9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686780065, "uuid": "82c9655b-254c-4a77-be34-200cfc290768", "value": "A615CBC5DD94FCEA348533F243BDDC34F9802EBBE3851.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3393774-0aa2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686740547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740547, "uuid": "10582c8a-e378-4229-a603-c83136012e09", "comment": "Malware payload (RedLineStealer)", "value": "f66034c0954ecb4537f4456e1120ba0b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740547, "uuid": "1ff31da3-2dfa-4f06-ab06-f297ee212fee", "comment": "Malware payload (RedLineStealer)", "value": "a717582ff1c57c24eca7bd9d6ac8985adabe770c1ac226aab63cde00b8d5731f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740547, "uuid": "2ea26b1c-b2ad-4117-9a5e-3437e7a1dc48", "comment": "Malware payload (RedLineStealer)", "value": "15197161146d3ae392fc954680ef211c38553787", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740547, "uuid": "a820ee90-e6ae-4079-988f-9f8e404ee9c4", "comment": "Malware payload (RedLineStealer)", "value": "e3fdc7c87e39cc432edff7d80130f3fdc82b82ad2ccb43c2b87633ed1792b33798379e6347aa0a5b01b7696a80bb40c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740547, "uuid": "c72209e4-9ea3-4c22-a3db-388bfbe72b54", "value": "T158F42301AFD88832D9726B30A9F217C35B3ABD621970C6AB3B484D560CB32D57A35777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740547, "uuid": "699ee68f-69ee-4b4c-b278-4cbb8bc5cc54", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740547, "uuid": "b4d1f186-dc5a-43ea-8169-74973219c77c", "value": "12288:9Mrby905Z79ODkoLbHg7JYnQduNvBuL+zvwoAuFjly7hUACDPPgMLzicX+:Wy/QKYJxQNvdzwoAuMhUAC7fzicO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686740547, "uuid": "f8afe99b-d776-4a23-9804-2b8b0f6db039", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686740547, "uuid": "fcbf627c-c3be-45c7-a0b1-08c865e0f8ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740547, "uuid": "d021b9b2-bb77-4c9a-b974-0617c5069c81", "value": "f66034c0954ecb4537f4456e1120ba0b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ca02dc-0a73-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686719962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719962, "uuid": "d261df81-6496-4fd6-9efe-f4153e3333f6", "comment": "Malware payload (GCleaner)", "value": "71dff14ffdc3e09c404c2a55e84430ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719962, "uuid": "b50f959b-ec77-4c81-8b72-c4ae04b5f967", "comment": "Malware payload (GCleaner)", "value": "a77732ddffe3379c1637253174c4ee2f4b6b3f619efcee3bc2e9da2f39608bd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719962, "uuid": "8b9c1c54-36de-49d3-85e6-f0ca0093619f", "comment": "Malware payload (GCleaner)", "value": "bd4f363cfa68f9988c38c4c5bb08935081486ec0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719962, "uuid": "bb22635f-1284-4755-9690-2643c567bde1", "comment": "Malware payload (GCleaner)", "value": "a0cbbdb151ff3ce633bb318cc20825fe4ae7c43e74b8d44a7415fd973fb7dce4e7528ee26ec61a281fbd882abcb3c7af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719962, "uuid": "18e67195-79b1-4287-aabf-f4fc3d22a3cd", "value": "T14444D06135F1C432E6FB65308972D7942A7BB8636A31848F76B43A295E333C19E71387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719962, "uuid": "e5b7f61b-3192-47bf-83ba-755827c1a886", "value": "56d10481189f6a27053ef040fb6b42af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719962, "uuid": "6a97cc6d-fde7-40f4-9796-132fc3fc14ab", "value": "3072:4wvy57PHN2Zl7uToLz8UxzD80+djrEnHWGYaaSKDrj206FqvPuMS2L5YW5uub:WPHN2PqToLAa80yXm2GzPGu06cvPuMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686719962, "uuid": "ce28fd87-7ceb-4c6c-b11e-44cb35e25592", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686719962, "uuid": "f0d455c6-54dd-4605-b4b8-be63ca8a16c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719962, "uuid": "c0965d71-2f56-4f03-a877-beffdd974179", "value": "71dff14ffdc3e09c404c2a55e84430ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79bd18ac-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725740, "uuid": "280ff4d5-e5e6-47dc-b9bf-73a908be4bea", "comment": "Malware payload (Quakbot)", "value": "ffa0a80fd297a4e6a988813a6a87df1b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725740, "uuid": "56326aef-de90-44c4-beb5-87414229b02a", "comment": "Malware payload (Quakbot)", "value": "a92d920c5f0993e08e2ccf2f003d53ca0f1f4f2ff4ddaafc2d3e0b7fa2d9edbe", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725740, "uuid": "80b6785e-fcf2-4b13-8601-32fa77c29933", "comment": "Malware payload (Quakbot)", "value": "f9b80e902fb6df8f1b21fb52d2ca7409655ef475", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725740, "uuid": "d28ec8d0-8829-4e67-80c9-e2639da4da0b", "comment": "Malware payload (Quakbot)", "value": "9a03ac81ef703d88e744f834ed565d1397b87a24635597093199f28517262094ec2ac5a7704f2ade970ba149b20cfaae", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725740, "uuid": "ae954caa-b0db-490d-b8d1-b606c3d12ec4", "value": "T1F46446896A45E0F05137B33BCA578410FB6B1F5B11848932B93C61586F3D86D7AFBE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725740, "uuid": "aaef7cc9-fcd2-4b59-9718-dcca96ede844", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbfRCaj2B6ihS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725740, "uuid": "3032012a-3887-442a-9497-8f28bcbdbc84", "value": 332235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725740, "uuid": "833449a3-e27d-41e6-b0ea-fbb13a0d02f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725740, "uuid": "b41cc8b2-c894-4591-9b88-e4cca337d521", "value": "lgGcGg5QTG4yz.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ad3fbd3-0a90-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Blackmoon)", "timestamp": 1686732507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732507, "uuid": "4ab12579-0e4d-4eb7-a5ff-86be4410828f", "comment": "Malware payload (Blackmoon)", "value": "0558b31bd9e3e8233ca74837754882d7", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732507, "uuid": "e0ce95e2-0f66-42bd-b598-b0736c83d082", "comment": "Malware payload (Blackmoon)", "value": "a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732507, "uuid": "99f82ecd-1584-4a07-825d-c86678f39819", "comment": "Malware payload (Blackmoon)", "value": "a4bcad094372c9348bce850034a028460d19b0a6", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732507, "uuid": "97dd8516-ca31-4090-a3f8-56df9092b49c", "comment": "Malware payload (Blackmoon)", "value": "b33561f1d000d732ad2fd6a5e9759104f06f7de61d70700cdaa85be04e5364cd23071cd6c0f87db3848ba16d9cf65560", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732507, "uuid": "d48a1cd0-d2d8-4598-a485-b4f6f8698f5a", "value": "T1CAE323B25778AE17EA50BB39241780E948CD8DEADE2F369C5B2C83DF7182BE4515D003", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732507, "uuid": "3a7df366-6bf8-4a1c-b936-5777638c9e76", "value": "7d81d828b583b677f122925ee5e17f7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732507, "uuid": "d7f1e40d-5e52-47eb-a008-75dd70422370", "value": "3072:GB1Q3LeTWmL359vd0OmS7ok57ORL2G4kOqOcPxab/gp2pFuuxE6l/:E1WeTWmLp9vd0Om6B57ORaG4Rqh51p2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686732507, "uuid": "1aea437b-fd5d-4775-ac6b-4e20840b1840", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686732507, "uuid": "85572266-708b-4bff-87b1-fb0594de8158", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732507, "uuid": "639f0e69-5487-4fa9-bbee-c9dff4b75962", "value": "a95737adb2cd7b1af2291d143200a82d8d32a868c64fb4acc542608f56a0aeda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf1d626-0abf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686752885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752885, "uuid": "5e1a0a01-77f3-4e60-8459-7b16e84d53db", "comment": "Malware payload (AgentTesla)", "value": "dc82b4273b5dea74f79af07769ada3cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752885, "uuid": "406a0e53-929e-45d9-bbdd-10776c70067b", "comment": "Malware payload (AgentTesla)", "value": "a9c079c283fc38c4a400ed02cd39e4095beb83e8ba30f89d0d5649435d7cec3e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752885, "uuid": "af5c9ec1-2b6a-40b9-bfd6-02b411477cb2", "comment": "Malware payload (AgentTesla)", "value": "4f5ecbd57dcc6ae159b86d4a08f86b0bccd6d4e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752885, "uuid": "c329c52d-365d-406d-8ea4-a316e1de05fc", "comment": "Malware payload (AgentTesla)", "value": "f1f3acd58bece1dccf9d0de3727de42d96392ea7d393be9fdc9696fa8b5849632777d3e97a4e30248be9bdf18530bcc5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752885, "uuid": "42ce5891-2101-4383-89dd-5abedee4538d", "value": "T13D43295AE79F02688F510277671B1E89AABDB23DB3505471386C833433DDC7D42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752885, "uuid": "f935fee5-1726-4511-9326-20d8d7873447", "value": "768:kFx0XaIsnPRIa4fwJMfFx0XaIsnPRIa4fwJMYXvjZZGnJKX6eSkwbhIKSU:kf0Xvx3EMff0Xvx3EMYXvjDGnALS9S8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752885, "uuid": "29d39abe-8e7c-4abf-87cb-81ad68aadbe0", "value": 55492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752885, "uuid": "93286a0d-2413-4eeb-859f-d4bc74c19c90", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752885, "uuid": "b1cdd9ca-8286-40f4-9a35-6d3e1f3d2476", "value": "ACH copy .doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26e2575f-0a6e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (zgRAT)", "timestamp": 1686717871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717871, "uuid": "cd11b2f0-b03c-43df-99bc-cce477e8d8ce", "comment": "Malware payload (zgRAT)", "value": "0abb6fd14dfbe1f34e1f0153a146452d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717871, "uuid": "83232c18-8fbc-41a3-9f5e-d967bdd11243", "comment": "Malware payload (zgRAT)", "value": "a9d1ed959532734984b565728a387176f19964e668e8e0183cd2b093e6eaed73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717871, "uuid": "a62799cb-b1e4-40d8-895b-bf93532cd12c", "comment": "Malware payload (zgRAT)", "value": "2a22b08cc7dd519b84045857b2041475e7b2cfe9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717871, "uuid": "55bd5325-957f-4683-9eb5-c91606187296", "comment": "Malware payload (zgRAT)", "value": "151a00ce7b9ed8fef7485f2352a11e7019343f185a5bbb06da8d05209a86745a5a587308e484ebdd5a2c4af8aabc1fb1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717871, "uuid": "62b1ba30-4d72-4a2d-8102-9629f616a006", "value": "T1E7A5F131CD41BEE9E6F8CCB98CA715810DCC5BE7E26890D4BD8415DAE2F3914BE5A870", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717871, "uuid": "c69758a3-5c77-4110-bef2-2bef3954a440", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717871, "uuid": "a9582238-a80d-4883-ab4c-c8049a92779e", "value": "49152:J6RRNSN8hNZrCwQ/L+bbDwszTLp2WN/jF:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717871, "uuid": "795aa579-4d32-4893-b3be-2a4a6ff0c42e", "value": 2179072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717871, "uuid": "b235c655-6dd4-49f3-9c0d-7fa64fc60e28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717871, "uuid": "f8598860-5ec5-4da3-b8d4-caa5edae1513", "value": "0abb6fd14dfbe1f34e1f0153a146452d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5faeeca6-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728274, "uuid": "83e3ecd0-9d81-444e-8ff6-2ede2fd43e7c", "comment": "Malware payload (Quakbot)", "value": "651f45a047694300134e645dd187ee1e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728274, "uuid": "2257d64c-9c9b-4813-98de-c01a758a038f", "comment": "Malware payload (Quakbot)", "value": "aa3b90a263a600deea80ebf948b7497631bd26618e5a626e3a54fbbd42c63e07", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728274, "uuid": "ec93c01e-3cda-493a-aae5-aeb9e74701b9", "comment": "Malware payload (Quakbot)", "value": "eb3863ce9815c7c28e490e0752a6c76c1a9abb39", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728274, "uuid": "6addaca2-d43c-4b05-b6b2-6a0ca1f91f0c", "comment": "Malware payload (Quakbot)", "value": "6486b2564df49a4add95d33eba477ec7ae274c8adcf8bc56290bb029f8d4ce92e2da7dece9acf16c10f093f32b41d2bc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728274, "uuid": "6d5fb351-e458-4f52-af0e-b96db2a03e4b", "value": "T14A6443896A45E0F09137F33BDE578410FB671E1B21848932B93C61586F3D85D7ABBE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728274, "uuid": "bef9238b-c0b9-461a-acf4-eaa3e30d45bd", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbsqGds/+chS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728274, "uuid": "9bb0a52d-e156-455e-bba6-d6cb23cd9ca0", "value": 328580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728274, "uuid": "8db96a90-195a-4499-b2bb-2cc1833519bf", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728274, "uuid": "f724d1a1-682a-4b53-9109-ca883884f5bc", "value": "ZzDuhaU6F3O83A.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f344d429-0af4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1686775766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686775766, "uuid": "6ff5149b-5efb-4adc-8918-681cd86481d3", "comment": "Malware payload (AsyncRAT)", "value": "1d04efd3c005feba5161fd2ddd8d7194", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686775766, "uuid": "b770d66f-a146-425d-8b4c-2f97cd235669", "comment": "Malware payload (AsyncRAT)", "value": "aa44b193e2eb0046c55dc1a78fed298c361f06835256504ff42db39c5692df10", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686775766, "uuid": "df116d7c-0e8a-4292-849f-debf46e3ad7d", "comment": "Malware payload (AsyncRAT)", "value": "da4d6966afc58bd5b4f0e76b3af422f1b0235fce", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686775766, "uuid": "dbb66752-62b5-417a-bd52-841586f4ed58", "comment": "Malware payload (AsyncRAT)", "value": "9d0d1b330a0d2819bc1dc5ff3f289bc2b5a96e6f83529c375c77cde88dd849538f35f75c2ac1a6895ca5a36b4e92347c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686775766, "uuid": "c76721c1-4dc3-4962-a44e-52d75ae1931f", "value": "T1AE236D4037988136E2FD47B8EDF2A2458279D6672903CA5D7DC810EA1B13FC59A136FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686775766, "uuid": "c3ca0d89-ac23-41a7-8d45-6c6e5f868862", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686775766, "uuid": "d433164a-6d2d-43f5-9653-0405f75f0929", "value": "768:V9umxLiIL1CaS+DiNzTlD0yO5iBBYbugeVFybEvEgK/JzZVc6KN:V9uAPWNzTlwyOgybRmybEnkJzZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686775766, "uuid": "41ab776b-89e5-4e48-899b-79abd2e074e5", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686775766, "uuid": "a2e8c292-7f6e-4669-b579-91a4c14ddf6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686775766, "uuid": "edec7637-8a3b-4b5c-a67b-7907d0b3d83a", "value": "xPo8U6ZjwEaV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "069b51c9-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728124, "uuid": "57c36091-3218-40ab-8e23-126cb7d05b65", "comment": "Malware payload (Quakbot)", "value": "170587a10ba5fe9b4c366adf05048982", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728124, "uuid": "69490649-3af5-4a13-b6ce-881f0cf29686", "comment": "Malware payload (Quakbot)", "value": "aa798bd878f345c7a7a24acc5dd5e5128d8ba0ac3ce8b1c9fdc4b4c34a5e7639", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728124, "uuid": "ac8fabb5-cce1-4362-a97c-aef36d8ab4e4", "comment": "Malware payload (Quakbot)", "value": "d86fccf0a58ea957701849bbc0180633da1a0331", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728124, "uuid": "dfd8dd37-7398-46d2-9a93-1c86510406c5", "comment": "Malware payload (Quakbot)", "value": "717f2d20d6430da4dc1e8dc1e90cf277b439d798c3dc42835ff447037036ff7f5aee891cdec2f2136ad363303d6e59ef", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728124, "uuid": "98276780-df7a-4c16-9723-247daf2fc387", "value": "T12C7442896A55E4F15137B337CA164420FB6B1E1B20848972B97C605C2F3D86D7EBBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728124, "uuid": "41097405-7864-49e5-9144-8ceb81b3aded", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbmdQrQ2+maQv7D855ythS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728124, "uuid": "fbc77626-6e5e-4d27-b104-980a6457e815", "value": 357719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728124, "uuid": "408d27f1-741f-4ec1-814d-e9d15796f57e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728124, "uuid": "6c85b7f4-bc13-41f5-b241-caccf237c5ef", "value": "e1JX17pDt8UYTk.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2779971f-0aa3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RustyStealer)", "timestamp": 1686740635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740635, "uuid": "c6905407-07c8-42de-82fa-de4cb925f8a0", "comment": "Malware payload (RustyStealer)", "value": "7724310712cda6afc7e8de332856abaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740635, "uuid": "0a73dd5c-b1a8-4853-bc64-56058c8e84c5", "comment": "Malware payload (RustyStealer)", "value": "aad0d8084ad577183b6417264bbb630d01fa1c76792b12ad7efbddc9e5a9365f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740635, "uuid": "44cc88b4-1961-4897-8272-8158de4b3154", "comment": "Malware payload (RustyStealer)", "value": "4ad0b3d2150004b07157b5dc0a02f0e1ff12ecce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740635, "uuid": "a5daccb4-4e07-492c-be71-70759f521a67", "comment": "Malware payload (RustyStealer)", "value": "f60512f99cea53a252a6dea59b105dfd8af83a8dccf58d7615d7523fbac9d32a7f7ceef8b7c3f2ff5f66ae7c00ba5547", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740635, "uuid": "b340be00-69c8-4290-939c-0b72fbf8a6c8", "value": "T1DB66C826672950D9C07FC079E2839F62B9207C99573D77F78A80A6652E30EF86D3D318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740635, "uuid": "bc64e6dd-d71e-4de4-8049-a097d3959e49", "value": "a4317b89e1aa249a670caeb44b1690b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740635, "uuid": "55002906-b999-4f2c-b784-defab33f3c7e", "value": "49152:cMUhJV+145MuXTnoixHZlxhlx4uV0rs+fMLMFBk4tHO+O1Y2LBFZicYUAJ/TUqqO:UHMuXV3Bq4hxY5rhnPGr2DiTYsB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686740635, "uuid": "1d19345c-5827-4a7a-8236-3b3b72b3e296", "value": 6918800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686740635, "uuid": "53f9390f-91e7-4103-8379-e29dc56d3847", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740635, "uuid": "17598229-45d9-4e2d-86b1-26ad50ca01a7", "value": "aad0d8084ad577183b6417264bbb630d01fa1c76792b12ad7efbddc9e5a9365f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e35e7a23-0ac2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686754264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686754264, "uuid": "c4ec90a6-3b22-4468-90d8-0078d09b963a", "comment": "Malware payload (Amadey)", "value": "810337be43c929a390af706015f6d36e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686754264, "uuid": "19cc8554-c100-4c30-82e7-fb369598f8fc", "comment": "Malware payload (Amadey)", "value": "aadcefd3d8d5f073866b635a1cee10e76428004e5b714657e7118e33008a5945", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686754264, "uuid": "13a4afd6-fe8e-4b7f-8b83-e1d6258bfc90", "comment": "Malware payload (Amadey)", "value": "28f7475237d1db13dd8219107c66935dc8ffde4b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686754264, "uuid": "5be096ec-531c-4d2c-bb50-e82d3a6ad311", "comment": "Malware payload (Amadey)", "value": "09ecbd14b3892e5c84d25a528e2ee6c795825c05553d27cb4696e92ca50e30fe2173081ba0097741c40e7fd589091c3c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686754264, "uuid": "dab5a9cd-b1bd-4d63-9472-a63f8939045e", "value": "T159D41213EBD84076EDF55BB09CF703930A32BCA05EA5835B2B9A585F0DB2695A530337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686754264, "uuid": "85d46520-e4f4-4892-81f5-de55739ab78b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686754264, "uuid": "fd05220d-789c-42c3-ab53-18975be21442", "value": "12288:nMrcy90V/l6LIPQvy1TxQLPAXpQZFIDTheVdeyreSPItj3p:Lywnt9aLIXpUKDS5NPI9Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686754264, "uuid": "4df5a7f5-bd2c-493c-8226-59b05fb7261d", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686754264, "uuid": "45899ca5-6a70-49d0-a25b-4fa3fa4cf854", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686754264, "uuid": "b802ffdd-0fa0-46a8-98ab-d05299481e31", "value": "810337be43c929a390af706015f6d36e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21b5d39b-0a9d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686738048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738048, "uuid": "bf5ad151-1081-4274-856e-d810704504d9", "comment": "Malware payload (Amadey)", "value": "1a66e4cdfe3293fabb78fc949656c8c4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738048, "uuid": "df674d74-ca2e-4144-9896-f5e8aeb4e0ad", "comment": "Malware payload (Amadey)", "value": "aaf68237e25f419cf5312359a50c52088737f3e13727622d5c486a8b349c5a49", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738048, "uuid": "9da598aa-0802-46fd-af6b-402ae1bc0d49", "comment": "Malware payload (Amadey)", "value": "8ea8449a04f6cc19c24192b26bf5a33a95e2a162", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738048, "uuid": "9d5e915c-a2de-4024-8be6-8d6118358a95", "comment": "Malware payload (Amadey)", "value": "3cee5f03cf620894112767024492425d9a0646f29e7852277b9c845fb19be59bace2600fa10c547497ff401ec5539039", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738048, "uuid": "e233a47d-b607-4726-a62e-ee791ae16a93", "value": "T112F41241FFE80433D9B027B168F602931B727D628AB5866F3759985A2CF32D46439B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738048, "uuid": "ea79e683-2ca6-485a-82c3-53e9637c085e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738048, "uuid": "bc4e7a77-b8d5-45bb-ad02-c3346f7a068a", "value": "12288:HMrzy90VIbpOovH53dS6TtO5EAeHZX1LtqyJ/Ue4n+U9uVC:oy02pO8jTU5EAe5X1wsse4+XC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686738048, "uuid": "f5061e29-83e6-4a41-991f-8a1b87c1d66d", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686738048, "uuid": "1af2fc39-c82c-4527-a3cf-deb8d85a6650", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738048, "uuid": "ff19c61f-33ee-4c0e-8cab-bfb10bb56de0", "value": "1a66e4cdfe3293fabb78fc949656c8c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f42744c-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728166, "uuid": "1076063f-5170-41d1-bfcc-859806925704", "comment": "Malware payload (Quakbot)", "value": "d623d0fd6f1846142ba72cf27dff418d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728166, "uuid": "938f9f7b-525a-47f5-8c05-8f2ac72630ab", "comment": "Malware payload (Quakbot)", "value": "ab6cc425644b42f639218a6bf4f73fa86170ce55b72476221d77756a14ee5b8e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728166, "uuid": "3eb48c12-a7ef-478d-aa6e-d83aa88ebfef", "comment": "Malware payload (Quakbot)", "value": "4fc47ce969a8af6e543ba069d0fecf5ca26ff466", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728166, "uuid": "e57fe7be-46c0-470f-8b2c-58096b55c72c", "comment": "Malware payload (Quakbot)", "value": "ffe94771bc01903069c382c941cca6d0b059f98603378f2b6e9c54f15c53f6675d2263a52e6243f8f8fc9cab6b25f06e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728166, "uuid": "2ba63c5c-575e-45ba-927c-f2b007887424", "value": "T123744389AA55E0F18237B337DA574410FA6B0F1B2084C972B97C50592F7D8687E7BEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728166, "uuid": "c2e85498-1d3c-46c7-93b0-44162b0c677e", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbCufyYew3pXf/hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728166, "uuid": "e6adf1c9-335e-45d5-b008-ed9aec8cca1b", "value": 337707, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728166, "uuid": "d44f8f6d-ff1a-4583-9506-5e93735575c3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728166, "uuid": "e250c585-3f38-46c6-9e03-5feb60094ec8", "value": "cNqEGGuTBmIz.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da86cbe4-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686728909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728909, "uuid": "84b8c03d-4a89-40c9-be5d-1864e4d78cac", "comment": "Malware payload (Gafgyt)", "value": "ac2bd6aeabedf08ca4913f35a45e4476", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728909, "uuid": "07f82f07-0390-48d6-ba36-26f74baab49f", "comment": "Malware payload (Gafgyt)", "value": "ab8ceaaa7635002129bce06bca7205f380585ae9c87602cbbfec0d03ffe5ba75", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728909, "uuid": "5ef49b7e-b655-46d2-bdf6-8ef2f8577887", "comment": "Malware payload (Gafgyt)", "value": "2082095f05443ac42713b0a8c8457f7ae674f24b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728909, "uuid": "54a500cd-50b2-448e-8028-95953f39aa41", "comment": "Malware payload (Gafgyt)", "value": "956cac5b9556d1ea572200b66fa3af3fcd58ab6c9ce7733883ea5ea95cb147bc8790e48277184665433c056c9499766c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728909, "uuid": "355ed37b-c738-4fc9-a322-2c4c68eca516", "value": "T123836B23A651C6BBC0875BF91BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728909, "uuid": "a56b0d38-35ad-4f71-9168-a0986c5d61e2", "value": "1536:UB7crF7FePF5tZuEqdPUq0aJb9sqx3CjrM3XmuWIr8UmoIYuOVje+ZNne:URQFet5O7dPr0oSwyjr4XmuDnmrYuOVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728909, "uuid": "4c71c6b5-8193-4872-bbf3-5ce5f937934f", "value": 85803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728909, "uuid": "811358c4-e2a0-40ef-a17a-30315b6846d6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728909, "uuid": "4496227c-fd69-49d0-a6a1-6b6eb074f153", "value": "x-8.6-.SNOOPY", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17fdf254-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686750487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750487, "uuid": "accd0310-401b-451e-840c-b0fbb7a5707e", "comment": "Malware payload (Mirai)", "value": "2711a7aeedabdaa82c115b028543506f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750487, "uuid": "2698029d-1259-4c71-975e-56f74787b430", "comment": "Malware payload (Mirai)", "value": "ac39a42dbf4e9c9c5bcbb291ef07ca1ca4a2e472973d4ec484150ffb0881db76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750487, "uuid": "dc638dc9-dac0-48a2-9194-31a2126529b4", "comment": "Malware payload (Mirai)", "value": "8f907e66bcf4d90bc6352a0ded238716506a6a52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750487, "uuid": "74a8d82e-d683-490b-9ff7-38ba19678e0e", "comment": "Malware payload (Mirai)", "value": "5aaa418f9aa81ad0dd55e88d2f65f08f3a111ea4260a21855f61ca4ca4f0ee477d625c6b17a2b02d58057ba667582682", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750487, "uuid": "201e826e-58e4-4052-ad6c-c019256ff65b", "value": "T11BC2D15509AB20B5B300957FEA7CDEC1F8B7237AC476646B7478C1B05282C68ADFC947", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750487, "uuid": "efcb67bd-d4e4-42e3-913c-3bb200456fb5", "value": "768:sPqK9H/5K+3RWsufdc7/xXsnKsAL44nns3UozR:sPqK9H/hR7SVnKzL44nazR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750487, "uuid": "d7a2b092-1f4e-4346-a7c0-59f28ae236cf", "value": 28188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750487, "uuid": "b5c43b30-d59a-434d-abfa-c0bf7836b90b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750487, "uuid": "790b9ea2-b4e5-41c4-bd96-d666752be6dc", "value": "2711a7aeedabdaa82c115b028543506f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29cecbc-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728520, "uuid": "8d7a9697-6fa1-4929-8214-a20622f5411e", "comment": "Malware payload (Quakbot)", "value": "7214bdac4c0134bfea9f6502ef5fbae0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728520, "uuid": "59a358dc-268c-4069-a096-a98726b9a440", "comment": "Malware payload (Quakbot)", "value": "acda93677c677caaac6fee4a01309a113455105a91a13daac4403e869c83cbe8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728520, "uuid": "d3a4bb58-b605-40d4-b73f-4f9869c01075", "comment": "Malware payload (Quakbot)", "value": "75850889f180b5cfa0dde66e84c1266a88a7b3f6", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728520, "uuid": "c9dc6d37-bbb2-4f1b-87a1-e57ed221129d", "comment": "Malware payload (Quakbot)", "value": "e05d36e6b5d8dd13134819be3628b223b246b354cd98a2c6ebbc0dca339de4545fd11ee91819f11997eff4d7b08f5062", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728520, "uuid": "132af6c5-641d-4b83-9248-0d5c556f143e", "value": "T135743588AA45E4F19237B33BDA174010FAAB1E5B10C48932B97C515C5F3D8697EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728520, "uuid": "b8b0c9d6-2f3e-4db7-8006-9d710a2df5f7", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbDqzM8X5KGbohS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728520, "uuid": "bc5e475c-f514-4f23-81b7-0e9da3d7821a", "value": 360718, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728520, "uuid": "656953ea-3bcb-4eb3-aee2-80f748108ff7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728520, "uuid": "7efa338a-756a-4912-a34f-9d13eaa4878a", "value": "UVc4VkYwzoaHq.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715d137e-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728733, "uuid": "69684b9f-c74e-41e4-85e0-103e7dccbaae", "comment": "Malware payload (Quakbot)", "value": "d50e6c81b9db9bab416cd3b2a974d33a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728733, "uuid": "e8e27eee-389c-456e-a95f-46591af08a83", "comment": "Malware payload (Quakbot)", "value": "ace7e54ad918b9e0d402b739f428fc4ab0e95c43b528047136339fac1caca828", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728733, "uuid": "cfa07143-81de-4351-bfee-19ce96949f62", "comment": "Malware payload (Quakbot)", "value": "b4b7772427643c11337a55e7ddd097d371d5d8d2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728733, "uuid": "d2d00824-3f15-461b-9934-afcaa49fa8e7", "comment": "Malware payload (Quakbot)", "value": "44c3c350b88f4a8977d01fc76ff8965b30318c3f18f10548f04c095613584950cedc5734673deb6e19cc048cf9d795de", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728733, "uuid": "7bf41209-536d-4650-b7cb-d4e2cc3d6e3e", "value": "T18A7434846A45E0F15137B377DA578420FBAB1E1B11848932F93C61682F3D85D7EBBE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728733, "uuid": "209001da-d080-41a5-8bdd-f2b3d6061b4d", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbPgD81WTAkzJ7/0FFmTCqbqo:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728733, "uuid": "b3a2ded0-01dd-4b6e-aabc-8ee0f8d6cfdf", "value": 360703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728733, "uuid": "7f76a043-8887-4f99-b0ef-e77384571646", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728733, "uuid": "532d9756-948e-484b-86ee-1c6088c39ea1", "value": "RDaVUOTJvy9B.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b9a88f-0ac0-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686753060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686753060, "uuid": "91f192e9-0585-448f-ac5d-fc2dd566c8f3", "comment": "Malware payload (RedLineStealer)", "value": "656d9e6e8378540396cc16c06f9fcc9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686753060, "uuid": "589bdc47-df9f-4d89-b394-9888e7025015", "comment": "Malware payload (RedLineStealer)", "value": "adc89e4db0fa86bb70583350e2b730b8cd621cb7e5b1821cbb6dfd764340040f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686753060, "uuid": "73125711-a7b6-477e-91f0-83318b0f40df", "comment": "Malware payload (RedLineStealer)", "value": "55851b16feba0b211599f634c603dfcf4f34301a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686753060, "uuid": "6be82d9b-3483-4a52-9ecc-1753959fc53d", "comment": "Malware payload (RedLineStealer)", "value": "0434764ca336c0e0eedf16924a4e77a117eee85b0abc571260b76007e4e246af89f55a6d9c2ff7b7d1fa517e4c17c9c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686753060, "uuid": "b90fab73-d4e1-48aa-a4a7-d14d7a0a41d2", "value": "T11B052383BBD58172E9F227B02CF706D31F3A7C91887446AB2655641A4D73294E8387BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686753060, "uuid": "a3789900-77de-4dca-91f3-ee916383ab1e", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686753060, "uuid": "c6d272da-a723-492c-9aec-aef2e75d6336", "value": "12288:WMruy90PmQweZQriafngFMWB3+HC18Cbv21zLQ9aWFIwe70EfBlnKJ3hP:kyEjV0HniMw3jxeizLe7XBlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686753060, "uuid": "1f863a00-f4bc-4dad-8b85-bcd0c37802f7", "value": 833536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686753060, "uuid": "519ce5c6-76d7-4c2a-859d-b8956e2415e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686753060, "uuid": "6fcc4eb2-90ce-4a7d-b02a-f3ed28412555", "value": "656d9e6e8378540396cc16c06f9fcc9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f765b4f-0a6f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686718368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718368, "uuid": "05350209-2623-463e-83ee-ccbb171237e0", "comment": "Malware payload (Formbook)", "value": "4ea040df51267d35a686217df9619599", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718368, "uuid": "13d19959-3950-45ba-ae03-9344167e75b5", "comment": "Malware payload (Formbook)", "value": "ae5bd505c20878ddbb8a2b9c2c0dc687d2168bfc83e563442f2a89ea14601f57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718368, "uuid": "0f25fae6-65e2-43ad-b841-2e1fc8330884", "comment": "Malware payload (Formbook)", "value": "7dbe82acfe0b211d25cd0c4eaf1b87b7de3fdf9c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718368, "uuid": "370ff442-9e74-46a7-857a-ff4ee3cd019f", "comment": "Malware payload (Formbook)", "value": "c2e97c0fd790ef1a9d9caea989ae228b968cfe657e8373f905e69b9d582fb5b623c57a5aae802228846c2cbf992e01b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718368, "uuid": "5a4f9010-689d-4060-bbb8-e0248606e6c9", "value": "T197D4233565A9E5D2CE7223346BBF07363BBB9701219D93860BF0EB967D721058B0E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718368, "uuid": "8ef5148b-df99-48d0-9594-fe526cdbf062", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718368, "uuid": "5c46cf68-a06e-41ce-957f-015aea8c4ca9", "value": "12288:ZYD70GBqHALOGDy/ikPJTeRJvyeiaVPKUNKXW7dg90hTdguoTgDO3sUvF0:ZYD70dW+/LP9YJaeFVEud2EDOp0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686718368, "uuid": "3c3270c9-df24-41bf-aecc-adc56d7a8bcb", "value": 640435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686718368, "uuid": "e4acae4b-1d99-487d-b2e9-0e9abee91d11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718368, "uuid": "d29e84d5-f5f4-4462-a2a4-b84b09d0bef4", "value": "ZANTE - VESSEL'S PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6092560-0aeb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686771905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771905, "uuid": "3a2c8ac3-3b90-4466-bd45-4d55bf7f53e7", "comment": "Malware payload (Mirai)", "value": "07e5afa40d1b195ad4eec1267d685ebf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771905, "uuid": "f4771e36-f80b-4f3d-b92c-aed22fe9baec", "comment": "Malware payload (Mirai)", "value": "af4cfc9caaed9233267fc64d0499fb7698c9b4efbf33e858cd4281272cd4c555", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771905, "uuid": "d1ce5157-d681-4c5d-8ea0-3deadaedcdd0", "comment": "Malware payload (Mirai)", "value": "fc20e0d7bd71d3fc6ff41c44910e824af3adaac6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771905, "uuid": "e430ae07-a4ef-47a2-be20-b547d5e64ce4", "comment": "Malware payload (Mirai)", "value": "1dd5fc96edd0aef7fc34ef4ea392e0a8e8ef770771337e0ebe8623f28ce5008e99221bf09e75885e662c425897b8266f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771905, "uuid": "1da6a890-5a72-4931-a4fa-8133dc6e4e94", "value": "T1FFA2D060E2E59EB0F6FDAD349D81D2C1BBF20BD87AD58AA300451F63832A8536744DD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771905, "uuid": "dfe2eaed-2296-47b9-ab7a-a683c11fcefe", "value": "384:w/gNyF/M84Tp2YshxqlDZv4nO23Y1n3nkxRvnKx3kM4uVcqgw05VxJU:woNytlSVsMDZgF3Q3kGJ74uVcqgw09a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686771905, "uuid": "e6ee2e77-17ae-41e5-92a9-5684467c6d1a", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686771905, "uuid": "ceda0600-3d13-4587-b07e-a018272d5b22", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771905, "uuid": "fde52843-11f7-48ad-a53b-74ff601cc123", "value": "07e5afa40d1b195ad4eec1267d685ebf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "676cf8d3-0b0c-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686785839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785839, "uuid": "5e0ed00c-c0cf-4c4d-9392-bdf8165478f1", "comment": "Malware payload", "value": "8a2fbfde8db24aec6addfd0fd37eb63e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785839, "uuid": "5adc1043-faec-413a-9d7d-fa7064643838", "comment": "Malware payload", "value": "afd78ef3553a916ecdcf074bf723cf591195039efe6632ffe822e9b021c9d2de", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785839, "uuid": "987f1a0f-c905-46ed-b1c6-e4d377bacf11", "comment": "Malware payload", "value": "245513265dc9159835de61f1c310454f9c1dc6c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785839, "uuid": "8b38fe58-8a2e-4e24-98f2-bd5af6b0b30e", "comment": "Malware payload", "value": "2cc66511917c45f053784087286bc5bb9d70ddd7b9eb60d3a10ddc4b5632f51a520bec3337eb1f8b57f6705452bc898b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785839, "uuid": "a0fb0a12-d048-4e10-ad48-1aba340ce0b8", "value": "T1FFE4313D6CB61D239438F99E87D47067B5298B27B70E4A25C3C357863A2E82777C212D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785839, "uuid": "195d618e-97d1-425c-9632-95cdff48ad4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785839, "uuid": "9c6138da-2bdc-4298-a0a6-1acc623cd0d7", "value": "12288:hSFiTB2QwcCnDv9g0M0v+UsRsstUQ/eo2E:r+DVg0M0v+9sc/exE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686785839, "uuid": "5479182e-5f89-404b-818c-e7ca13887162", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686785839, "uuid": "b700505a-88f3-406c-a2c3-16af3a5e20bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785839, "uuid": "faa3efbf-3298-4f7e-9fcc-5571df1934a2", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ef12cb-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728313, "uuid": "72ebcdb6-e698-4ac2-9730-ceecff3c3f9a", "comment": "Malware payload (Quakbot)", "value": "3d1552725b4c99b4cc74a59bc8827f58", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728313, "uuid": "f0e9a0a3-913e-4200-8cd9-20fb58878d46", "comment": "Malware payload (Quakbot)", "value": "b0a4887bd2cc2532abbfc931767cd93fc025b0d06f89e99ff2dd90e48830dce6", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728313, "uuid": "deb555d3-3ae3-4dcc-bdcc-da5774c6b592", "comment": "Malware payload (Quakbot)", "value": "880783cd2e0373f6575bd97b412c6ef5062b0c5c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728313, "uuid": "bec4e11b-ef15-496a-a2d4-c2798778e2f6", "comment": "Malware payload (Quakbot)", "value": "bd05c250dacbf581a6415fbd97bcd27202bf3cb9690d97eef641431b0393761d5b362f2f147c8038d4b0843fa5f83af5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728313, "uuid": "05cf55a0-966b-45b1-b53c-939ee5bebe46", "value": "T1786433856A44E0F05237B33BCE578410FBA71E5B11848962B97C60586F3D86C7AFBED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728313, "uuid": "6505c669-b2fe-4155-99d4-cef97cdf3e9a", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbeSSvhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728313, "uuid": "80d21c3e-6bfb-4f09-a41a-5124fc7a086d", "value": 329871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728313, "uuid": "26ba29e3-e4fc-43a2-b56b-77507db192b1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728313, "uuid": "9b84eb9c-f6c7-494a-bb12-7afd6a1290cc", "value": "ZUlcPumzJa2C.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caedebfa-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728454, "uuid": "647bdae9-0afe-4cde-8de8-abd8a4ce3cc0", "comment": "Malware payload (Quakbot)", "value": "89534df205226bb62d04261bd99555f3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728454, "uuid": "59f7a55e-480e-40f8-9269-7192281a8bdf", "comment": "Malware payload (Quakbot)", "value": "b0cb831be2fba7c1e18dc93eabf1349f35e31cc4121678cb52996e95b6cc8e79", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728454, "uuid": "52767eff-b5ea-4f17-8858-0dba5223bb1f", "comment": "Malware payload (Quakbot)", "value": "923dd7c240b0ae1a1018dfa18d4588c99966af48", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728454, "uuid": "b7b40581-a94b-422e-866e-92f02ed8fcf1", "comment": "Malware payload (Quakbot)", "value": "e15f2a41a25fc705ba63bac8ec0b50de9d2b51f29414037cb55b8920069fbe64d39a96b1e4fc981fe61ed09d2fbf9a14", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728454, "uuid": "ef001b8a-782c-44aa-ab66-d98b396f75a3", "value": "T1786422496A55E0F08237F37BCA178410FA6B0E5B1084D972BD7C506D6F3D8296AB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728454, "uuid": "4d1a5db2-70f2-4e5b-8997-69f3c3d825cc", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbhVK3ShS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728454, "uuid": "34bfd736-03ab-45d3-9469-dc861a5d2f3a", "value": 309704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728454, "uuid": "4beb2f1f-c0b8-4622-9f3e-5fae82b80f7b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728454, "uuid": "ce570ed4-5711-472e-9cbe-dd2842757c45", "value": "VVeUNhHwbH3d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0892db75-0abb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686750891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750891, "uuid": "1e6cd302-beb9-4284-ba74-f939969a6878", "comment": "Malware payload (Quakbot)", "value": "c6c69d731f0d8972ad9c949054fe3a61", "object_relation": "md5", "Tag": [ { "name": "1686735623", "colour": "#C7EBF4", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750891, "uuid": "46b2442e-5953-4100-9b20-9f2e3a554844", "comment": "Malware payload (Quakbot)", "value": "b0deea498617139a91f4fa0c43645268d0cdb0e5e7c19f31957c4708b7675875", "object_relation": "sha256", "Tag": [ { "name": "1686735623", "colour": "#C7EBF4", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750891, "uuid": "f0ee8fcf-c514-4c69-b355-f4a5a9acc23a", "comment": "Malware payload (Quakbot)", "value": "c5d8530883a26074eea3bcaee046930710b70c53", "object_relation": "sha1", "Tag": [ { "name": "1686735623", "colour": "#C7EBF4", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750891, "uuid": "db2e48ac-e9c2-4edc-b8f7-04b045e0ce19", "comment": "Malware payload (Quakbot)", "value": "c52eacd5832bd7202c2b1f710c3d57df50398a598318c8fb238363fadc5e306891b32b93b37e8e08c59e863b15ab62cf", "object_relation": "sha3-384", "Tag": [ { "name": "1686735623", "colour": "#C7EBF4", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750891, "uuid": "b4d614d1-526d-4910-8ba8-943e4932ddee", "value": "T12FA298A45E8E50B98636B82594CFDD63DFE2C62D021E15CEA7099F32B11785CD0B26F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750891, "uuid": "0e8b007a-116d-4508-b0d1-05ce17cb7d5e", "value": "384:IlxwNHnWmEwxhJyyzgZT7yOjOt4kmtd70Sft:IlxwtWpwM9yV2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750891, "uuid": "e88df8ba-9b2a-46d0-99be-4dde50324e95", "value": 22991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750891, "uuid": "05390917-0e40-4e68-ae70-d2360654283e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750891, "uuid": "8ce3ae8a-0ad5-404f-a84f-2db90a2cb164", "value": "docu_DF631_Jun_14_3.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1006bf43-0a6d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686717403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717403, "uuid": "4b29475d-9f19-4bb3-986a-9e7b07df3db9", "comment": "Malware payload (RemcosRAT)", "value": "cbcd9c5203d515618c2e95c8bfbd216d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717403, "uuid": "28aaa072-b58d-4d94-bee2-6fafe9e133b9", "comment": "Malware payload (RemcosRAT)", "value": "b20c6f8b483814a96dcf489365aab049a9b6cf9f165b02c087dad363594fad65", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717403, "uuid": "5a041d79-52ab-4661-98d4-3d8bebd31193", "comment": "Malware payload (RemcosRAT)", "value": "9bc4138c9f7b51bebc5efbc29e6f3bd64847a401", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717403, "uuid": "e4b5c982-f628-4b23-9584-f5b4f8a56ac6", "comment": "Malware payload (RemcosRAT)", "value": "c0d66331d4c1d315ce308b531cabc6ebc0a3cddde5f716a9a6a60c5def64c16a3686c64f696e7949d65ae6efe57c070b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717403, "uuid": "5937ed24-c6ac-4ec4-ac50-21de1f4c31da", "value": "T1209412D46921C8BBE8360E70D8AB43F54AB5EF86D850828F1B84BF6C3537AD1C51B395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717403, "uuid": "563c7be9-6673-483e-a3ad-a16bd436adc2", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717403, "uuid": "2286375e-1e4a-42c3-9b0e-6e6b958375bf", "value": "12288:D0+FrXbGM2i28hs/FiGIxu+blHZkDgPim:D0YraPL/0xu+bl5kDU/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717403, "uuid": "4848bdf3-a271-425d-b7ee-57f215c5f251", "value": 422664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717403, "uuid": "f99f409f-88f0-4704-8a1b-47dc7347ed0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717403, "uuid": "45768257-a2cf-4c6c-9f7b-0af58958369c", "value": "Invoice BH-230250.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eafdb623-0ade-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GCleaner)", "timestamp": 1686766303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686766303, "uuid": "8c52ddbc-1146-4f3c-9dc5-d9c851046d62", "comment": "Malware payload (GCleaner)", "value": "774e16ae925265cb3a3f9df59ab31653", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686766303, "uuid": "0b219cd0-7eff-4f1d-8c7d-af8407874e30", "comment": "Malware payload (GCleaner)", "value": "b244853baa82f81070b008b20d319e500a8b42061f484f276d865b41eae76240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686766303, "uuid": "4d86f2af-2426-439e-ac1c-37e0cf8e3ab5", "comment": "Malware payload (GCleaner)", "value": "9bd57ce862ceb099d35783c50481c7e5f10503f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686766303, "uuid": "2b0405ec-aade-4850-b186-3c01f02acb2d", "comment": "Malware payload (GCleaner)", "value": "faa2efe85c0e6e773dc91c339cd57981448779bf3e8d183c885f9d7a55c44552071ca86dd18c20dd5ff56c4db1d9db75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686766303, "uuid": "422c8379-fb1b-4bd9-abe2-421f3024edce", "value": "T1C4E5022220A3722AC1C2517A5F08C075E7E5CC11663ACA2D56F1FE7B773E3A305DB56A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686766303, "uuid": "02c32db7-d4a8-4182-ba23-31a9c83fab98", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686766303, "uuid": "58eb67d7-9d04-4fe9-9764-137ef5e0b596", "value": "49152:X6dPJkttttt1ttttt1tPqVFQttt780tkbx+zeksq5xg7R2WFqKVCORRf8e4q7pwt:qdPJ8qVFY8qA+zeHq5C7MWrTfP4uGvWM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686766303, "uuid": "325f2c46-14c2-42d5-9170-fe9f9bb78558", "value": 3067985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686766303, "uuid": "6bbac69a-c1ba-4ed7-938a-7a7664aff2ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686766303, "uuid": "f33b9443-c981-4d24-bd7a-f4256075c17d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756b0ec4-0a8e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686731746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731746, "uuid": "9a5d8f43-5aff-4029-90ff-58ba02de93ec", "comment": "Malware payload (Amadey)", "value": "69bbc6e14794db8dd53a97bd5e0ae2c3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731746, "uuid": "981abc32-f2ca-4269-9394-ce669ce444d5", "comment": "Malware payload (Amadey)", "value": "b250bcf018c8994b58fbc6c5b682d4dc140da6194b45841d9752f2a1c9a64b95", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731746, "uuid": "d2cc0352-8d68-404b-8124-2342db7bb253", "comment": "Malware payload (Amadey)", "value": "9fb8770e28cb47809b0d111c9c2c226a26832d30", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731746, "uuid": "cd73f00a-5452-4597-b427-60537b0aef69", "comment": "Malware payload (Amadey)", "value": "f6066b01394af8fbc0f7da651e2c93e58ee78d706a4ba09bcad742ce5e1497a3c19322ba71449eb9e78df3f7d36b9648", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731746, "uuid": "4eef9049-d72d-4eb3-b4b5-0a8970390cce", "value": "T1C124F7217D12C032D96161B619F5BFF2C59C6828ABB049DB7B800F77DA122F73961E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731746, "uuid": "8bf2c550-44c6-438d-ba02-df1bb3527d3a", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731746, "uuid": "d358351d-0d46-4465-bd20-9109f57768b9", "value": "3072:CXkSckkHbzG1iXAt60p0zuNmnKG7peNMQbuZAIOb2y3xfbT:8kSDAzG1iciuInRexuZAIKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686731746, "uuid": "cdff0083-903d-4389-8821-1e79259f7d09", "value": 209936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686731746, "uuid": "eea1372a-8a1f-4a86-adf0-f42a3da26a7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731746, "uuid": "e7867119-276e-45f6-9fd0-a25ee2f76735", "value": "69bbc6e14794db8dd53a97bd5e0ae2c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d030c06-0aec-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686772105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686772105, "uuid": "2b51b372-580b-4731-a3e8-d963d08b7006", "comment": "Malware payload (Gafgyt)", "value": "be1d4033854814cd14a69bf8f1cba003", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686772105, "uuid": "8c1b4c24-79ae-4a84-a34e-7c8e83ae6d4c", "comment": "Malware payload (Gafgyt)", "value": "b295c5f4601711e060c6b46a076a5cbb986e25176d5ab6b7a5c25b413e7087d7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686772105, "uuid": "7800f7f3-6256-4cb2-a565-156a74301fd0", "comment": "Malware payload (Gafgyt)", "value": "d429f36f7f0b9cb235244773e486e8e61373debe", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686772105, "uuid": "8be3055a-46f3-47c8-8325-cb960d26903a", "comment": "Malware payload (Gafgyt)", "value": "881acff7a2a292f78021a32ff286cb3b8c5172438233a6f677d6b64931271b20b3c0560597af6d0e95bdddaf689ef185", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686772105, "uuid": "71eadf0f-96b6-4fbd-bdd4-41817fd8cc98", "value": "T1F9B31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686772105, "uuid": "65dff3b5-ee74-4581-8262-40912c72866b", "value": "3072:od0w4SAewzi+Xn+8Uhw6W+aPRJmDk1c8xF6KjW:zfO8IBkJmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686772105, "uuid": "2773d5cb-d795-408d-a365-50d6d50ab061", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686772105, "uuid": "033f4ec6-a621-48f1-abe3-8010195a1fab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686772105, "uuid": "64b43bda-b435-470e-956c-9bc8b553ffde", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee1e926-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725803, "uuid": "053c677c-5211-493a-be73-0c2bf4d74cb3", "comment": "Malware payload (Quakbot)", "value": "23304850c65f5993e3cbffa6818ff34b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725803, "uuid": "7447fea5-ee61-42fd-8ad7-f11345ec15fb", "comment": "Malware payload (Quakbot)", "value": "b3211a16069b7928e1bd457442e5816b09d29ed9baa96db0c8feea2e00069609", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725803, "uuid": "f906030b-4b42-4f00-9c9a-eff6563bc39f", "comment": "Malware payload (Quakbot)", "value": "1ab5da08b339cae6aa22f1c527d14b0fe7804312", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725803, "uuid": "112a817f-6ec1-4625-9964-3c55aef8d30d", "comment": "Malware payload (Quakbot)", "value": "240ed1881ecbf08aff4c1f633f197c289400f1d4521858eb91fe4d99bfa87da1e27670c9601d28ba456729e66fe0e02c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725803, "uuid": "a1a70915-75d1-4167-9d5f-28d88318a5f9", "value": "T1C7542F856A44A0F09137F337CA5B9410FB671F1B25848922B97C60582F3DC9D7ABFE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725803, "uuid": "3d05e01f-7f7e-425c-95ec-70754eab4b2f", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbogU43qDdhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725803, "uuid": "90b34ddb-6d22-4d60-962f-8f4cb0a55992", "value": 303991, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725803, "uuid": "d7cf9c0f-5925-479b-9663-457eec0c28f3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725803, "uuid": "414e062f-3964-4348-9b49-02056d61de83", "value": "k2mJBs7NdJdGw.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756c03cf-0a75-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686721009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686721009, "uuid": "f0683da5-ec3f-41ee-9bbb-7da4b35c9cc3", "comment": "Malware payload", "value": "34d5e842caff285b933f0fddee2845ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686721009, "uuid": "d02a910a-b924-41e2-8f9c-00ebc31cfe66", "comment": "Malware payload", "value": "b33084d78b58b7e5117ef9c18d0ee8b4dcc0e03357d8cc7eac6fb79bc14774c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686721009, "uuid": "d40b6c51-783b-4ea2-8ba8-6e1b8e40d973", "comment": "Malware payload", "value": "257b5fa9af3e130ce4bf133698bbbaf7deb5a35f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686721009, "uuid": "08c715d3-60fb-4c16-87b7-190d501512c4", "comment": "Malware payload", "value": "205dbc42fd332b097dab368257915e0b34ce23a2021da9af012dccded5ca77cd027f013fbc18337bbe98185f65d7131b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686721009, "uuid": "514a8f94-561f-447b-8536-072c5029b571", "value": "T15A33F204F12A8954E1E7B9BC3B5763D377C84B9D3DB98AF5138A7B61AA38E3049134C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686721009, "uuid": "3a4220c2-94c8-4138-8592-f0b7e8636258", "value": "1536:2XqPFeJxGYm1IbS5obehUzAr79QiP4u+qgw0cWXxR0B:2XqdeWYm1J57CAH4u+qgwRWhR0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686721009, "uuid": "8aa7eed2-0820-47d2-b105-256a1b2dad4e", "value": 53484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686721009, "uuid": "03b50a0d-9d17-4084-8f95-51108529cf5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686721009, "uuid": "f192163f-db5a-4cfa-93b3-d9c3ffba4871", "value": "34d5e842caff285b933f0fddee2845ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ad835c2-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728749, "uuid": "fc8ca1b0-7a85-46a3-b12e-aa9f50f024f9", "comment": "Malware payload (Quakbot)", "value": "60ebd0d4c2fcbc63e2fe63cb863b7b35", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728749, "uuid": "889d03c5-757b-49c1-b54d-ae8e13ebf847", "comment": "Malware payload (Quakbot)", "value": "b47346d6ccad24ac4dfd9109016c3c3c9035effb8092e3f7fae79935768f436f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728749, "uuid": "d39653d9-c94c-4e67-b897-a4e77842b708", "comment": "Malware payload (Quakbot)", "value": "dad16972c9ddd19f65951ff3fe4769242b7507a9", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728749, "uuid": "d8c98196-9490-4305-b987-bd3ab5151e1c", "comment": "Malware payload (Quakbot)", "value": "f35171aca7642eece8c93221e51619191ff871a1a7b8ca88fcaa2435303655c5c115778aa348b7c5a1aae049a2d02cc0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728749, "uuid": "60631619-83cf-4c00-a1c2-c637c7b44f34", "value": "T12A745185AA41F0F19137B37BDA179410F9A71F6B21848932BA7C505C2F7D8247EB7E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728749, "uuid": "5c74a5c6-cc18-4c47-b8ea-01490a73fa9f", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbS+dB901arHHE0YHvATychS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728749, "uuid": "5f38d313-872c-4ec4-95b6-23755d20b76c", "value": 342550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728749, "uuid": "b589d2b1-6a70-4a52-a5ad-ef6fdcd595ac", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728749, "uuid": "3a34c472-5341-4bec-baab-9cfef7740dd3", "value": "Qkar5wIR4erg0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "948f73ef-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686750696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750696, "uuid": "339279ae-931d-4100-8346-68b78b74f49e", "comment": "Malware payload (Amadey)", "value": "be0670bf9f42c142729e35f7c102522a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750696, "uuid": "4b9112a9-8bae-406a-baa0-6890d9a154b6", "comment": "Malware payload (Amadey)", "value": "b4dbd757a351e6e3920b469c117d3f8b56776ad8684c351b84ee2849803e91a9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750696, "uuid": "7df93a24-4ef1-4b1c-a0c3-647a2d833916", "comment": "Malware payload (Amadey)", "value": "bd8008c0c3b88ed258ec33b4c8ebd92029132131", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750696, "uuid": "78235c96-68fc-4aaf-bf92-ae965f3e728b", "comment": "Malware payload (Amadey)", "value": "983fffda2476f9bb00461c0000bc7bf2cc87d673111688a46f2a11327d5fdfec7c636cbb41320382051865603df1bcf3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750696, "uuid": "ba5c55ae-7200-43e3-bc49-6f3c3c7e32a4", "value": "T151F42206F7ED9462E8F46BB0A8FA02831A31BC901C75966B3249995A5DF37D46C36333", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750696, "uuid": "eed3a4c0-a32b-445a-a705-13d0ee36b529", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750696, "uuid": "3cfc0211-db4a-4493-ab93-fb67a2f091e3", "value": "12288:/MrDy90G8Y+2tlHV605zUw9YGYRtZbMdkt1LXTLIkaDu/MIG/3cyfwZkVNfsr:IyP/+wB9Nt9/YRtqdkzLDLIkaGE/3ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750696, "uuid": "751931a6-0438-4c68-a82f-d48c4a9d9364", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750696, "uuid": "c831464e-9e81-4b93-9b98-09ae15554a6e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750696, "uuid": "6b24f24c-b85d-4dec-ac6d-98bddf25d611", "value": "be0670bf9f42c142729e35f7c102522a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eea98d9a-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728514, "uuid": "6069a73e-42b5-40f0-b060-df1edb6c966a", "comment": "Malware payload (Quakbot)", "value": "4ff3ebdf58f19f658864ca05df2eb1a0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728514, "uuid": "eca7a14c-8c2a-40af-99ce-921541e83e3d", "comment": "Malware payload (Quakbot)", "value": "b4e17241304cddc6bb0ccb0fdcad130a8c50c007d3850e39ce6c8d3f24865201", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728514, "uuid": "a4b41e14-57b9-4e53-9afd-9a435e2842f7", "comment": "Malware payload (Quakbot)", "value": "c1aa91d30993e1db4ddb3bd671b7351c43952b67", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728514, "uuid": "1b82f216-c78e-4c94-b39b-0c48c79b9c11", "comment": "Malware payload (Quakbot)", "value": "8b7143958a25d7f5615789b23a6ffbf29cc687d191e94abb5efc19852b295bba5d6571f6cabc02613b7fa44bb6a90e70", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728514, "uuid": "b2601438-43e0-4292-a469-58afec23a6f8", "value": "T1E2743185AA55E0F18137B33BDA174020F9AB1F1B1184C976BA3C51592F3D429AEB7FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728514, "uuid": "681d6a62-b2ca-4b15-8e2e-daebd09cf989", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbAPC8GYyB4ZEfNqK0ailDuq1:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728514, "uuid": "3732ea59-d089-4098-b4fb-cb0349bdd25b", "value": 345311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728514, "uuid": "b496faab-dbd9-4c5b-b9a6-0dc81bfb4dda", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728514, "uuid": "5ef1daeb-a011-48a0-a9be-206ca0e69250", "value": "UT1hcionG3ul4U.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bee921-0a6f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1686718291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718291, "uuid": "69dfb4eb-ea63-46c3-a47f-3ea1a560bd2e", "comment": "Malware payload (SnakeKeylogger)", "value": "dfc860d83aeb21a872a29fb78be730a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718291, "uuid": "71e0f9ba-0fd5-4390-a883-cf547226cf21", "comment": "Malware payload (SnakeKeylogger)", "value": "b5529b428ff680691a65bcfaf027b1c7d454dc51185b0544766abc98817864b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718291, "uuid": "f5839547-b7a6-4f1c-bae5-e8734b6e765a", "comment": "Malware payload (SnakeKeylogger)", "value": "68a3ca99d465b3cae4f536a9146ab27936058f4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718291, "uuid": "03d9631c-758c-485b-b70f-d98f00fec0f8", "comment": "Malware payload (SnakeKeylogger)", "value": "2458abd86470d0609c7d2c136b7bd3d3dc56c6c898743b39b20afb7b096b51bd408a776fba34ca94afb3014d2d36240c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718291, "uuid": "65053e08-69ba-4f0a-bd26-86f48463943a", "value": "T16234F125F4BC1B8AD5FA02FAB5F5132086F1BA0B2952F66DECD160DA1C19F816F04E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718291, "uuid": "fa27b36f-e298-4652-a342-85dd15d319b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718291, "uuid": "15c27d36-75aa-4f65-b593-9763b9cc6242", "value": "6144:lW9Ef4hV0Ih3Panv8NFiWuN/rvpGrBoCQGIcisJv03pESnM:Q9EfQV0Ih3Panv8NFiJNNGtVvuOSM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686718291, "uuid": "3884711e-faf6-4392-92dc-c9fb78a2cfda", "value": 235520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686718291, "uuid": "054e859b-f921-493c-a047-6fbae1ecfc99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718291, "uuid": "f6628283-9214-4a22-903e-36e399e10cc6", "value": "Banka Kredi Kart? Ekstresi - 4543xxxxxxx2827.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed92ae99-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725935, "uuid": "cab691bc-1476-4133-87f1-e01894f17f89", "comment": "Malware payload (Quakbot)", "value": "cd0a52d75bdce7150975118f744199c6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725935, "uuid": "45734a76-d7d6-4fd3-baf5-67c90b15c1f6", "comment": "Malware payload (Quakbot)", "value": "b592b583ec4fe3d3a0a91d204443326f43257bf574b300bd0600d05de26dc8c3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725935, "uuid": "7d91ee09-21ab-4e3a-bbdd-fe367668f5b3", "comment": "Malware payload (Quakbot)", "value": "6867060f3eaa65566febb80d4c766c822e6ecdfd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725935, "uuid": "9e193ffc-dbd2-40b0-9302-764a511dcb53", "comment": "Malware payload (Quakbot)", "value": "88dad33a635b1dd101f368d7be101c6b1ea91c551e00e24078b94a0e04a70ee55ee00aacfbf738979aa977728e46cab5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725935, "uuid": "086f2913-2977-4219-83a0-c8cf130f1273", "value": "T1396444496A45E4F08137B33BCE574414FA6B1F5B20848A72BA7C51581F3D829BEB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725935, "uuid": "0e2a76dd-cdfd-4fee-b79f-96eecc45e83e", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbY6DlhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725935, "uuid": "b28e617e-0184-475c-b0b8-61426a8f015f", "value": 331030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725935, "uuid": "fc8a9eb1-5322-44c2-a87c-4423ae17608b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725935, "uuid": "b287ff06-e8de-409b-a00b-2ea02ccb77ef", "value": "hKS41C4naG8L.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d179abe-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728135, "uuid": "4e83448a-264a-41e0-b9d5-2a35ae110c8f", "comment": "Malware payload", "value": "b5e7d3ef3ae2ecdd904998285c2bd3bd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728135, "uuid": "39e90a12-ca37-4959-9569-cc03c649abd7", "comment": "Malware payload", "value": "b5c40040c76e177f3ff8104c1846ad28c3b2e474491f8e569925807d189959bb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728135, "uuid": "b79b7184-9f38-4fb6-82aa-5dbfec9c01a7", "comment": "Malware payload", "value": "0b537776848135626daadc622e14b435a3ba7d76", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728135, "uuid": "5f10dd2a-74d6-4314-bbd6-a17030b3fa6f", "comment": "Malware payload", "value": "639afbd109fa858cb5659d7b48b71b71400238203d808d8e0ad10ea200fb729cb5e217f9d2b87aea17310ed4b7c803f0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728135, "uuid": "e5bfb925-b698-4028-bda3-333a735d4a7a", "value": "T1816433496645E0F59137F33BDA578410FAAB0F1B20848932B97C50586F3D869AFB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728135, "uuid": "e15e02c8-d955-47be-a173-54f8bdcaa540", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbfRNSDXWsuhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728135, "uuid": "15dc9c56-33b5-40a5-a503-806f3c775def", "value": 326153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728135, "uuid": "48be1942-c143-4ff4-9d7b-881b0f1dd54a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728135, "uuid": "cfe05ff4-f3ea-4ff3-95b7-e5570ddcefe9", "value": "ds3U0T5ga7kXT1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68975e4d-0a62-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686712827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686712827, "uuid": "8f1bbf2f-fd35-4ceb-ba06-66184bc2d58d", "comment": "Malware payload (RedLineStealer)", "value": "e5c2a82d33cd1a5b19bcbccf966461fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686712827, "uuid": "95c825d5-a8bb-4941-9cfb-29fd548d19d1", "comment": "Malware payload (RedLineStealer)", "value": "b633d9a688f0f2f77a082ee004b39d262a557836a166486d909564efcc480bc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686712827, "uuid": "1c2b6087-57e8-4fd4-bda6-c5503a773b00", "comment": "Malware payload (RedLineStealer)", "value": "e1c1c96608032c931d4441ac83d3cead0bfda484", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686712827, "uuid": "fccffc46-ca15-4274-a9be-ab62be425cc9", "comment": "Malware payload (RedLineStealer)", "value": "b23e40fc6db8bb8357ebe7ee95417c121c952c2fcdaa3928991da7d836f73db4012bfda73f76720f54c979eb6bbf3b04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686712827, "uuid": "2051d080-2697-4d17-a55d-ff1f1b5ba478", "value": "T13DD41203BBE98162DCB527705CF612830B3A3CA76A78932F6B8265591D722C4E53177F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686712827, "uuid": "b914d8ce-e769-46d7-8400-cb61401cc7b3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686712827, "uuid": "b132b6a0-5e9a-4f6a-b816-f0c3a6093c42", "value": "12288:cMrly90UJ3WFnoZDoTKesIHkM3lCdhwQu/ERuqTcP7o4jy9C1:Jy7PKT1nkM3lAhdupgk31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686712827, "uuid": "d8bf6b18-5a9c-4184-93fe-1b68e0769752", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686712827, "uuid": "d3373ab2-d849-4a51-aee8-bff68e60fd2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686712827, "uuid": "ead049cd-fd51-4d0c-86e3-d422892ac68a", "value": "e5c2a82d33cd1a5b19bcbccf966461fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6a83445-0a85-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728071, "uuid": "cae42641-5f46-495c-8b50-496f76fd706a", "comment": "Malware payload (Quakbot)", "value": "fed36bd78c1c6f301c93088b9155ccbf", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728071, "uuid": "539b901f-23e2-433a-a538-06ab54c55a46", "comment": "Malware payload (Quakbot)", "value": "b6a5500d74194a37da84437b133a789b7fa7b6cbbd3cafc4663cebeda05abac3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728071, "uuid": "2ddcfcfb-e3b1-4a6a-b4c1-0ec9402b731a", "comment": "Malware payload (Quakbot)", "value": "6e8bd7c856a09eadd284b1a8ea73e48c1db91ab0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728071, "uuid": "3e3fee66-23c4-4f6d-9b64-7468ab2ac2ad", "comment": "Malware payload (Quakbot)", "value": "49e07b7b1d5110d09d8f8471cba7dc1ecabff6c9e42a96bb86c3bfde4b63291f8886eecaa59cebeffc40e38e01b8d973", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728071, "uuid": "e00e2761-3879-4a6c-8b49-d4310f9a2445", "value": "T1626433896A55E0F09137F33BCA178410FA6B1F5B2184C972B93C505D5F3D8297ABBE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728071, "uuid": "284c0879-852a-4322-bd56-8dbff435a6f6", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbOV4tbbhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728071, "uuid": "9fb02fff-5e7d-494b-8221-ae6c7bda86f2", "value": 319741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728071, "uuid": "29195adc-64bd-489d-bcc7-e5e79919f186", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728071, "uuid": "27e09a89-2abf-4101-9f72-66c86afc1b05", "value": "fEUrnpPCsqLM.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebb855e4-0aa6-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686742253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686742253, "uuid": "ac30105e-68dc-4738-b5a7-81e860ac8ccc", "comment": "Malware payload (Amadey)", "value": "a93b4e11016180e7b68e0979cdc761a9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686742253, "uuid": "028488f9-bb09-4c89-91df-66f80a762fc7", "comment": "Malware payload (Amadey)", "value": "b6d938fc1184448513a173888740c48a77a04b368cb79b720bf83e9b21e9b242", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686742253, "uuid": "4ef99a53-bbb4-4917-95c5-332e227b0e45", "comment": "Malware payload (Amadey)", "value": "a969a5c5fb81ea7f1715bbc551b9613d9f242e23", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686742253, "uuid": "a578682b-352b-4721-af62-af4c0681c432", "comment": "Malware payload (Amadey)", "value": "8190ad438879e108ef08579d31bc0ff952c9dec1be66062ec80654b8c8950b72a04a6b16add146009ba7de1a869e9e15", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686742253, "uuid": "13ae7091-4832-4e31-9fea-903b07e32401", "value": "T185051257BBD88872D4F517B048F653830B36BD618C78D76B26499D0B08B3399A97132F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686742253, "uuid": "13ccdac2-b61f-4139-8e54-89e55a69b26d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686742253, "uuid": "070663be-e314-44af-b261-e9185aa055e8", "value": "12288:EMrDy90LM3/3fGw+zikSLK5ykSH9CcY3AbDKTC9K9hGg+tkN:/y8MnGHzpSmct9FeTC9K9hR+tkN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686742253, "uuid": "7d459294-b109-4792-8059-24416244c7dc", "value": 833024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686742253, "uuid": "357348d7-61c9-43e3-b2a1-c55ccd47463f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686742253, "uuid": "14fe6df4-9373-49d0-9171-9ad568d790b9", "value": "a93b4e11016180e7b68e0979cdc761a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "978f2cb6-0abc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686751560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686751560, "uuid": "14a58439-4244-461e-9f48-5874228c651e", "comment": "Malware payload (Amadey)", "value": "da485161c5d2dd911ef5896742395fa7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686751560, "uuid": "9ed210c9-9732-4fe8-bfa3-b0fe5de0d7dc", "comment": "Malware payload (Amadey)", "value": "b70026523e2092a0cf20cbc4e72df014743d3b439fed6b94d9b1076c36bc426c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686751560, "uuid": "472f73fa-0b64-45d1-b876-9637b460f902", "comment": "Malware payload (Amadey)", "value": "7096f4e5b20a4690d90314dc6f4969955886773a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686751560, "uuid": "eaf45444-6709-43d5-a35b-7d3009815508", "comment": "Malware payload (Amadey)", "value": "e28941bdda299fabebbd0e9c48fe17b4a04194b1c3a3dc3a7bd5c7fa4145721b64b0422ac5a55367058966e2e5dae47e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686751560, "uuid": "734bc583-10fc-435a-979c-bbe1c3085d1b", "value": "T1ECF42261EADD8435E9F523702CFB13C31E32FDA49974D3973202AA5D0972A95A530B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686751560, "uuid": "d2e9c7f0-cdbb-4122-9fa0-2578cb9f9bdf", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686751560, "uuid": "b4e4d365-1486-4291-99a8-0c869a9d262f", "value": "12288:TMrXy90aNhTy9sKjuLcgPuL9oWCLWNmTLLJ3PcC3V5LLRGKSr:EyRJKjugnZCLWs/RcIP/RGZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686751560, "uuid": "52cb7f1e-c11f-4d8d-aaf9-370db43df0bd", "value": 768000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686751560, "uuid": "c44f54b7-40ad-4fda-8007-ea60296eb271", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686751560, "uuid": "f5a8b3b7-8c5b-4409-91ba-282347d76e08", "value": "da485161c5d2dd911ef5896742395fa7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6016513-0aeb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686771878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771878, "uuid": "78f16189-5f22-4bbe-9ae3-fd8053cf8a9a", "comment": "Malware payload (Mirai)", "value": "7626b12508eb7044b697939d402fe9c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771878, "uuid": "930dce9d-681d-49e4-bdaf-45c1bf0281be", "comment": "Malware payload (Mirai)", "value": "b720391a77f5d48f4ea4795b272b5f121a863ba9b52c277a890cf91f6bc2ad98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771878, "uuid": "8e4d06d2-3092-4f5d-87dc-c88739ad798b", "comment": "Malware payload (Mirai)", "value": "88eb7c85df9460b51d844d4137ebe9e56e80d33f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771878, "uuid": "9773e50b-7b55-466c-ab69-db463a5bc3b8", "comment": "Malware payload (Mirai)", "value": "d2ef1e9915691e39d2a38bd54f93538ef23470bb4ad3cc57e29c587dcdebf385cd9350379efe1a172241975369909eae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771878, "uuid": "1263bcda-7a3b-430c-b12d-e689cd604378", "value": "T188B39DDBF2470160C8624AF007CB4BED3E2723815F27C5E76C6A657968791CF8906F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771878, "uuid": "2165fe8f-131f-42de-baf2-ffc2402a459f", "value": "1536:xu27gBY25SSpHP9pEFwiLShWnwg12/LWK:Y9zSyv9HiLShWwg12q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686771878, "uuid": "ba957b4c-b7d4-4ad5-9201-b836aab1eef2", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686771878, "uuid": "99d78005-1f0d-441b-a368-bbc39f914fb0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771878, "uuid": "5ddbfa9a-64d4-4736-8c6b-affea4cd7041", "value": "7626b12508eb7044b697939d402fe9c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "079f8ddc-0a9b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686737145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737145, "uuid": "c878f73a-bab4-45a5-8fdd-f18057af9324", "comment": "Malware payload (Amadey)", "value": "530177f4c0538fd5c0566e7c6b390adb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737145, "uuid": "640f73f1-126d-469c-9890-8f3805db70b5", "comment": "Malware payload (Amadey)", "value": "b7af1dd848338819a3f570ea5b5f09361e5dd9b8c4467a7e1a0a88f4e43d87a1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737145, "uuid": "2e48e198-f319-4b1e-92b2-0637f6da8b0c", "comment": "Malware payload (Amadey)", "value": "395be58bb0bcd73780175aa66b00c83999e1b7db", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737145, "uuid": "2a39cd69-74f7-4ba9-b8fb-20d8f9ad871b", "comment": "Malware payload (Amadey)", "value": "0255ce6b9e1924b7dd288265d3d3ce0094dc3caf5978ffb48e263dd9826e5ee8b2071ac7b36cbb1106dd60071ba566f1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737145, "uuid": "f0b2ed73-39ca-4e4b-bf84-20e9fc38dc0c", "value": "T1F3D41251AADC9473ECB52B7128FA13831E35BDA05C7C93272395AE8E4C72AC5A131377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737145, "uuid": "7769b4b6-4379-49c4-b00d-44d641d613c6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737145, "uuid": "6c6006bb-c273-41d7-95b3-0387660d83bc", "value": "12288:OMrKy90GzGWF05HuPM1WIrM5h5I3Cu2EsaF2c8DRXGX2vco9zS+i:IyMe05H+M1zY5KCTLc4GXfoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686737145, "uuid": "5542bf0b-c388-4a14-b143-bcc02e2a583e", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686737145, "uuid": "a17342da-3205-4984-bb61-d4bf52761ceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737145, "uuid": "aece7dc0-d98b-491f-a1c9-6b48d8e2ab1d", "value": "530177f4c0538fd5c0566e7c6b390adb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff66b85-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728543, "uuid": "2cb999a7-10ac-4b6c-9265-eae5aa6e104e", "comment": "Malware payload (Quakbot)", "value": "eee22461c1fd22d909b7b7ef200a3f3f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728543, "uuid": "bf325070-e234-4ca0-88d8-ec2555e64431", "comment": "Malware payload (Quakbot)", "value": "b7d3d9170b9c0608e3fdd7305a783e833cb0797041f5c18547800b53269c7a3a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728543, "uuid": "196aac7b-61d9-4b0f-8731-01835fa7562a", "comment": "Malware payload (Quakbot)", "value": "28789261800477f74da58e2cf2d3db125ea186ac", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728543, "uuid": "6e266766-5dd2-4c3d-8b34-2598ea77bb69", "comment": "Malware payload (Quakbot)", "value": "769d26e4d1ebd1e8b37bcd3394c8bedaf657306d53810805692f2b08655a507dec5dd34e6b00fbcd9feb0521f14c4669", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728543, "uuid": "7f358875-8ca9-4948-899d-fab75f8f1fc3", "value": "T13F7431456651E0F19337F33BDA165420F9AB1E5B2088C972BA3C50592F3D8297EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728543, "uuid": "2903b5c7-cb10-4717-abb1-955dd62b0b61", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbPBcJgBXjcFhEHB/dhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728543, "uuid": "9784945b-4456-4767-9d4d-bf280c418980", "value": 347704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728543, "uuid": "7e67fb92-8cef-49ab-9c33-8425eb22910a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728543, "uuid": "f4f51a65-391d-4765-8c8e-857c49c57831", "value": "U5eMkRL6CbFETE.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f358660c-0b04-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686782638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686782638, "uuid": "414e6631-3eaa-469b-a029-0878fd18631d", "comment": "Malware payload", "value": "0aa7e7ec52198dd4b30ba5fdb315236e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686782638, "uuid": "4718830f-8d8f-4aee-a423-7c1cf96ad47b", "comment": "Malware payload", "value": "b84a1f37ee590a2da265257df6951bc976cd2ab4828d2e37d9a3356b28b4f6eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686782638, "uuid": "c2745f59-bd57-46b1-82f7-e9d19a1feaa9", "comment": "Malware payload", "value": "62459e2139e86a3deaa0b0d310f2c7538694ef6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686782638, "uuid": "738ef29b-0056-4794-b680-456cf99d95fd", "comment": "Malware payload", "value": "eb51252216865ae067c1a07a6ec57fd808543eca830d59b170bb30d6b95b813292fd5a255a8ba81ce0365a1c44a28fb9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686782638, "uuid": "4e7ac746-5867-4551-856e-b23e87dee09d", "value": "T128E4120377471910DD5A88F2C0E7652442F69383A633E3CD3A9493961F4B3E6AAD93ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686782638, "uuid": "90011fcb-b247-4417-bb91-d54132352277", "value": "12288:ec1z1kQYUgM288/PJe+uozc7qmuhyjAHkRbgtIIN6ip+UEKLL+w+:r1kQlgM28Seqz8qVqbgtIItPBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686782638, "uuid": "0d2750d4-71bb-4032-aabf-22002b9fe174", "value": 709184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686782638, "uuid": "b3bf5e6a-1a38-4aa0-bead-3164f9be2dfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686782638, "uuid": "04e62b7c-1a2b-417a-82ea-271ffec68a1b", "value": "fa45fffc-aa99-4336-b8bd-73112a5725d7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a53d0861-0a8e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686731826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731826, "uuid": "d610ceba-b258-42ad-8612-f626e99b46a7", "comment": "Malware payload (Gafgyt)", "value": "8966b2fe090d05c04cbec2a4c3ce9fff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731826, "uuid": "2747de5a-509a-438a-ad8e-2444444aaacc", "comment": "Malware payload (Gafgyt)", "value": "b9002d77c6f62db2dbbf5ac19ac79b43e728bbf66056bb7b820dba519827b94d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731826, "uuid": "f6c4f8b6-7622-43ab-800d-fbd7e170e2af", "comment": "Malware payload (Gafgyt)", "value": "32f34ab2ab2ff94ce2759e9e45615fdc2f3b50a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731826, "uuid": "0de1c38f-bf62-4316-9430-178e73753336", "comment": "Malware payload (Gafgyt)", "value": "5f7227554f9e7461ac0e3bbcd5f15707d24b7cf153dcb8bc2bc6877a5ddcbb7f5b77865510b895bafbd5f27e0b0ff723", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731826, "uuid": "a4b38174-6f3e-4720-ae27-7527f4dfbc41", "value": "T197831943B72D0B43C49B6AF12DF72BF08769F96117A76180A11EBFC44772AB02522F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731826, "uuid": "aac5cdc6-6dee-4d33-be6b-35230ca2206b", "value": "1536:BQOc40ozMPjej5qckA39ikRFa1nrWBfOEmQ9VqXjtWf2Xe:Bl+3y4ckA3BkrWZOEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686731826, "uuid": "6dce3a8d-2f0a-4c7b-ac87-ffc72f93edc0", "value": 84796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686731826, "uuid": "1ffadbcc-1dd2-425d-aaa5-6abd49cccd11", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731826, "uuid": "d5931e02-3ca0-435c-828b-a241d91735b8", "value": "8966b2fe090d05c04cbec2a4c3ce9fff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa73d7e1-0a72-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686719943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719943, "uuid": "659f9569-2e61-4ca6-bf31-64b6f51c6eb1", "comment": "Malware payload", "value": "931ad3f922298f9804c6bd6b5bc03ab0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719943, "uuid": "157b8f14-fd74-4066-9b20-fdcd954b5ff3", "comment": "Malware payload", "value": "b90523524065d4358df2133602b87321037a2050b78f4e1e19c50a4813a0b052", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719943, "uuid": "bb0a0bb9-0ba2-449a-9306-4622d9fb2280", "comment": "Malware payload", "value": "20726fac0a394b5c7497b2484bd3886131542950", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719943, "uuid": "da7fa2bf-81e3-48da-9609-20f6bbc9497b", "comment": "Malware payload", "value": "551d75e6f15c977187ca7b228d7dc3120464cc54102c88f9e28f7e69f574b1b35dccf86d4c7c86fcad057a0362a3de61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719943, "uuid": "1f074b47-e8b1-4a97-bab6-c23d9610e966", "value": "T1AD46230638CE85F5D8C52430961F7A9F37B116F14BB24C9A7EC45DDA4B22FB06235AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719943, "uuid": "a77bf06e-3b1d-419c-b0cd-8a0c8d8adcbf", "value": "e168b9d4131706bae4420b007e9cc65c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719943, "uuid": "29543665-067d-47f8-83e9-5339454bc4ba", "value": "98304:/iGf9T5rIulJffsrdUXNYAtEsp+nvGLHHtQnikbAjpQVfp67qH25QXvKlbGfFnyu:6OsuXfsr+XBEi+OLanlbAGfkWXvzfFnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686719943, "uuid": "64407bfd-8730-4181-9116-2925ed2f8c8b", "value": 5367808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686719943, "uuid": "312753e6-7375-458e-81ec-ea4e05bd4cab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719943, "uuid": "6979f51e-f7aa-48a5-9884-b5bb0852ceec", "value": "931ad3f922298f9804c6bd6b5bc03ab0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c4123b8-0a90-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686732643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732643, "uuid": "daa4c4dc-6fd8-4c58-978e-f4f81b0797aa", "comment": "Malware payload (Amadey)", "value": "183792ecf2eb81344c03be37091935e5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732643, "uuid": "b53df302-d771-474e-9ae7-75f578de3090", "comment": "Malware payload (Amadey)", "value": "b9892a1271e9383be0202403c7c09e6712fc51c28f69385678dd13a2aea823d8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732643, "uuid": "9f37e15d-9ed3-4986-a46b-a94677a9a13c", "comment": "Malware payload (Amadey)", "value": "573df69587760a63e8e8a7b6a26021f66071dc02", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732643, "uuid": "e9991a68-7520-4d93-8e6a-94eb356c63e7", "comment": "Malware payload (Amadey)", "value": "0219fd2ec842d0c06dcd0e764a565498ccde3978369444a75224e5c551a8a85ee9fcef2fe281396fa084b89827f68bfb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732643, "uuid": "67b2d6d8-5bea-4be9-9565-386c32720914", "value": "T1A405230217D93076D8F62770A8FB07833B36BCD18D3456761686B99E19B3B84B836727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732643, "uuid": "fc13a8dc-3874-4a77-a89a-33ea8fc07762", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732643, "uuid": "94af9659-8c26-4938-a512-29d206836149", "value": "24576:ayIqN8I8ndfRw7kogn8/yOtqX84g0yhc7qvIl:hIquLndKwog8qOtqTIm7i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686732643, "uuid": "39ec428d-b23e-438a-b6a8-ca848415a41c", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686732643, "uuid": "aea6463f-d1ce-4b6a-8ccf-dab80bcb78c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732643, "uuid": "ab5538a1-9f6a-44c6-9257-971114aa9ed6", "value": "183792ecf2eb81344c03be37091935e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214f509b-0a9b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (GuLoader)", "timestamp": 1686737189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737189, "uuid": "600cc60c-85dd-4b19-973b-9c7d30814fa1", "comment": "Malware payload (GuLoader)", "value": "3d623068053a4274e2584cc38c9371bd", "object_relation": "md5", "Tag": [ { "name": "45-81-39-192", "colour": "#C80259", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737189, "uuid": "1b723bd0-babd-4baa-b5c9-d8ed32f0ea9d", "comment": "Malware payload (GuLoader)", "value": "b9eec8af046ab48024083cd1de7d594d718137ed5c1ad2b8458ee797ab3707c1", "object_relation": "sha256", "Tag": [ { "name": "45-81-39-192", "colour": "#C80259", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737189, "uuid": "f2e44c77-2dea-4f64-b121-3eef78657734", "comment": "Malware payload (GuLoader)", "value": "207916902af716062cd47473cdfea5aff1563669", "object_relation": "sha1", "Tag": [ { "name": "45-81-39-192", "colour": "#C80259", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737189, "uuid": "4d763559-c939-4a4b-a7a1-fc4450703ba1", "comment": "Malware payload (GuLoader)", "value": "476a2b7e4fc246df60876f992fc82fa49b21fde0cee9f5f8ebc55eeb9e372faa0531e0b3d53b7ab6c2c63613d9c8655c", "object_relation": "sha3-384", "Tag": [ { "name": "45-81-39-192", "colour": "#C80259", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737189, "uuid": "a6d162b1-e44d-4a5e-9711-62c71efa0c65", "value": "T135F313F95702BBFAF2DAC0B785E7741FE23511237AB0319EE321C12C5AF964916A1213", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737189, "uuid": "52b673ad-f108-4c9e-a29d-b0047bf2ae6d", "value": "3072:uKb7TzfMeFSONum4bxW9Sb8FPIQtfm6i4QXEwMmvzxcDxe8bL:33jMeH8TAPxe6iX0wMmlcVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686737189, "uuid": "c91bae86-9291-4ddc-8232-b3d1f1f26e26", "value": 167696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686737189, "uuid": "e9200ba0-c2f6-4094-b52c-66e75933e124", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737189, "uuid": "f18c65c7-0885-4f39-bb0d-00005f8e5a56", "value": "PURCHASE ORDER.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac57bfb-0a6e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686717931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717931, "uuid": "2cb5cbe4-2098-4293-aef5-09910ab15c11", "comment": "Malware payload (Mirai)", "value": "24da745bc6c0b0bf3853505202325d77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717931, "uuid": "06cc13bf-4758-428e-a6b3-8e46ae588aa3", "comment": "Malware payload (Mirai)", "value": "b9f45ed9353f986a111c1c3fa00f92bb8c5250cd95191b16cc37495dcbdce042", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717931, "uuid": "d78275f2-18f3-439f-ab55-7885ea788a9e", "comment": "Malware payload (Mirai)", "value": "46343a911cb94f520b8d1f6a39e4c794f7387119", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717931, "uuid": "2d8f6e6c-b197-4e0b-911e-cc8443ab0619", "comment": "Malware payload (Mirai)", "value": "cc76b3a2d381fc1681da0b500580b37c6a928376915d4a8d0ea2e0a61335e2bb45485c85a23fdede8503f9305596eaa0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717931, "uuid": "1427b290-1e4e-4449-a836-f7704777d939", "value": "T14F93A51A7E268FBCF799863507B78E22965837C62BF1C141E15CEA015EB024E741FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717931, "uuid": "8dbb24fa-1215-409d-b7da-79d3ac11c238", "value": "1536:AKzqmzfphPukFhyx2XgHI3eFz0HDDZ5KHZXvEY2QPoH:AKqYhueXWI3eFwHp5KHZXvEzIw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717931, "uuid": "b6376c42-45a5-4beb-820f-a5aa811e7b7c", "value": 93472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717931, "uuid": "5db982f1-b066-4a32-a84c-8d7a8ffcc8ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717931, "uuid": "c03c1ffa-51a8-4ce5-bb33-4d8969d4555c", "value": "24da745bc6c0b0bf3853505202325d77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941de2da-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728362, "uuid": "0ff9e7b5-e406-426f-ad0d-27b2af5bf932", "comment": "Malware payload (Quakbot)", "value": "c3be709170e0e869bc955b591b010071", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728362, "uuid": "eeedef7a-0455-45b2-b58e-ed6b91b47e61", "comment": "Malware payload (Quakbot)", "value": "b9ffb402836bd3d588877a6c08f403f6668733547cd631d175d9ff91e19e5516", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728362, "uuid": "836fc5a2-3a39-41ed-8626-4a351c30c5a1", "comment": "Malware payload (Quakbot)", "value": "e38be3750d342f77a51c9e6687a7b6289b95a8ab", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728362, "uuid": "aa66ebd1-6c43-4458-8c7e-afd119e02220", "comment": "Malware payload (Quakbot)", "value": "728bde6e0ab74721f8a6fea413e7c96572a56bc9e39c9b8c3121d97842d8c0c291e8e668f0b021980374aef0b96835dd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728362, "uuid": "814d38c9-7032-4600-8d33-a5edc117809e", "value": "T1717430896A55E0F08237B37BDA178450FA6B0E1B20848972F97C515D1F3D8297EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728362, "uuid": "1b496047-d69b-4780-88a2-36d4ec1a716f", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbw704AT6/RShS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728362, "uuid": "ca95c378-ff0e-4c38-871a-ded27764185e", "value": 338138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728362, "uuid": "70769c50-4531-452e-bb32-fe16e05ebe8e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728362, "uuid": "2ad0763a-4462-4451-ac93-0c5603bd47b9", "value": "XrCUi3s7h57d.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be672d69-0a8e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686731869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731869, "uuid": "f96e01f2-e96d-4c76-acd0-7030562a30f8", "comment": "Malware payload (AgentTesla)", "value": "e3a81cc88ae36d8737892170c85ff5d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731869, "uuid": "9457e6bd-e9a0-4cfd-b5c4-1ffd48e5c0f0", "comment": "Malware payload (AgentTesla)", "value": "ba06102388ef51532a4571113245afb0d6850395b10d5e5651549862a8c34a04", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731869, "uuid": "5e3233f8-0cf1-43d8-aee8-127e41d0e91b", "comment": "Malware payload (AgentTesla)", "value": "c1cce27d2b47370380ecb2ac1d97beb58fe1bd19", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731869, "uuid": "2df54de7-5a85-4b12-aa3a-e2e36e01f741", "comment": "Malware payload (AgentTesla)", "value": "01024b37bb0398cca5ecc65618c1fdb54cf63a12d7bf22345230f5b337c8734ab4e4b5487a5ec19bcfea15a429c563bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731869, "uuid": "12f25629-3861-4e79-9549-f35d5ee8f9f6", "value": "T1B505020168A99B17E67AB7F90F0072B533FE5FCA2855F39A0C8BF0D1A564F490A50E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731869, "uuid": "189b2c01-28e5-4696-890a-599fe0c4fc84", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731869, "uuid": "d71cb481-e0c8-44d3-84dc-4466290fd779", "value": "12288:2JcvG73htU7/2eQ1x9s8hEzTOsmc/C9wQNNSTbGmwNkhUjgXzZmP:kgG1tCueiKXPiMSJ69wQXzZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686731869, "uuid": "b34be337-e428-4e88-bc09-e21133cc32ba", "value": 822272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686731869, "uuid": "0c098402-86ce-4f7c-af35-ea2063d7e2b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731869, "uuid": "79f18aa0-d2ab-4630-9688-f8dfeda1cedc", "value": "INVOICE SHIPPING DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8621774b-0a5b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686709870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709870, "uuid": "1033d9b5-e7cd-477d-93b7-561ab50af4e0", "comment": "Malware payload", "value": "8e81361d4232909b7280877e0ca40eed", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709870, "uuid": "8cdcbcf6-7861-4205-845d-d26b976db8a1", "comment": "Malware payload", "value": "ba251cc0fd960b236d43ddedf956c770364914efcf8ebcaa421526d9b7c09f08", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709870, "uuid": "4942290a-c228-475b-88f3-7a28e2155b85", "comment": "Malware payload", "value": "fae684fc7b038ed8c0e78aadb42b5e87947f4dd0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686709870, "uuid": "41ffc0ea-08b5-451c-acac-cc7075f9a41d", "comment": "Malware payload", "value": "6fda92cfe9be2687541ec0d3c2fd0f5523ed71187ca23870933f5f4ded54e8ce3e124d041804a3c0feae3850fea01ce9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709870, "uuid": "785d87e7-fb41-40e7-824b-c0af4eda7fc6", "value": "T1CAE4F7106C01712EEAFA207BC8B765FF426DE6718781A8DF42CC187F0A9D5E279B7419", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709870, "uuid": "8c6c4b65-b434-44b1-a229-915f67d2504b", "value": "2b464709f4b94c4bc043fd735f7d08f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709870, "uuid": "d85be1ee-89c1-4b69-8f48-68a1552d5040", "value": "12288:cBtB3S+QBsZ7b73xLjmSKMQhjeNnvkH0wN7rp8wC3nMJWJ2IbZDA/N2dEcAK3sV9:cvB3S+QBaDUsSecVo9U4WVEM4H9hy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686709870, "uuid": "941f4652-44f3-40b3-83b8-4fc33eae18e6", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686709870, "uuid": "7badeaf7-a965-4ffa-8f2a-2ebf02aaf900", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686709870, "uuid": "900bc760-669a-496c-9c3d-adec2aaffab7", "value": "SecuriteInfo.com.DeepScan.Generic.Trojan.Genesis.Marte.A.198AE9AC.5405.19147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca58136-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728430, "uuid": "af6af500-fe88-4ee6-9165-a6a23f44daa4", "comment": "Malware payload (Quakbot)", "value": "bb9d138e83e99a33433433e4ad748b53", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728430, "uuid": "b8883bc1-e962-4129-a4b0-d3c6e5e7069c", "comment": "Malware payload (Quakbot)", "value": "ba6ae33aac46c547117046524d4642fde6b2bad02224fdd96966517b808ffd87", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728430, "uuid": "a95db548-ecde-4da1-9fc9-650977497770", "comment": "Malware payload (Quakbot)", "value": "8a43582e7b3a2e5b8afd567cd2d7ee6c2cb84de0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728430, "uuid": "897d3fb1-6ef3-4eb3-a1c6-90bcfc4a65d3", "comment": "Malware payload (Quakbot)", "value": "a85337439c005f47e7160f7f58ea506d1e70e817b088238ec292eacef1d1841af0e440960b4960780444bb1b56bd37e7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728430, "uuid": "ba9b850a-c456-4465-a727-4fdb523d8b71", "value": "T1FD745388AA54E0F05137F337DA174420F9AB1E5B2084D972BA7C505D2F3D8697EB7E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728430, "uuid": "42ca2376-8e33-4105-a390-6e9a4cd43fc7", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb//Tuqv5m65iSFci/ag6B/hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728430, "uuid": "2c122bee-73ee-468c-81bd-ea05d8f114d3", "value": 361383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728430, "uuid": "4533b502-487e-4de9-b332-737214dea359", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728430, "uuid": "d65f4211-8e30-4fb1-9f50-6d63154db00a", "value": "Vba0fW4B286EB.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0d958d-0af9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686777554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777554, "uuid": "c94ada04-04fb-411a-b29b-20eafa124e02", "comment": "Malware payload (Mirai)", "value": "a99613ba883dcc5ed6a52bb2e3ed6ccb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777554, "uuid": "3527a3dd-e6d6-4af4-afbe-bbb975b4af55", "comment": "Malware payload (Mirai)", "value": "ba9f9f517703d96f1974ef529679ab8109f31620856a1bf4f344f58649bdceb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777554, "uuid": "9196f464-472c-45f6-b4c7-3f6488dd38b9", "comment": "Malware payload (Mirai)", "value": "4f8b2b24c189f9c7789c0ce353882741a72d92dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777554, "uuid": "269f540e-6f67-46a8-8cf7-a5fe8fe18d3c", "comment": "Malware payload (Mirai)", "value": "da3f2d5594b44bbaa1c6d79979ac216e843d0e36398121e27f83ffdaf191ad526394899db57c8b4048854e6b01cfef24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777554, "uuid": "711e3c1d-d7df-415b-b3f9-cd3e900d0db4", "value": "T1B913F1659B49C0B1C9F014BFC2629145B34730E8B68BB2A5590583ECF9CFA372EFD062", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777554, "uuid": "82bbacc1-7b7e-4748-9011-62ed7d654f3f", "value": "768:3XqFqxdFohwtZ537brlfwT/whdbRUG3TFkYVWQ7Jqik1RJSailY8ylGdxcD3UQ:KorFomtZZbJfwT/wXz3TFhVVk1RJSaFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686777554, "uuid": "ba0a9ed5-67c9-4adb-977a-29b7c6cfb059", "value": 44380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686777554, "uuid": "fb9cbe75-c3fe-40c9-9aa3-264ce69ba1eb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777554, "uuid": "b8a4c47e-7aa8-4cc1-a075-68207a463800", "value": "a99613ba883dcc5ed6a52bb2e3ed6ccb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0620c907-0abb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686750887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750887, "uuid": "6becd246-a477-4b36-9d2b-aea2d5f71dd3", "comment": "Malware payload (Quakbot)", "value": "22b517f791f11a7bba44e96ad9b98989", "object_relation": "md5", "Tag": [ { "name": "1686735623", "colour": "#C7EBF4", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750887, "uuid": "d7f244e2-2b38-4f00-bd4b-c21dc5868926", "comment": "Malware payload (Quakbot)", "value": "babb776566afc06cab8b4bc1d21a89a670e803e8995cdd7107860017ad9f3b05", "object_relation": "sha256", "Tag": [ { "name": "1686735623", "colour": "#C7EBF4", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750887, "uuid": "c78b30f1-c105-4285-8274-1335c527e0ec", "comment": "Malware payload (Quakbot)", "value": "46bbe311630a99ed215d3d8c97289f2ef38710b8", "object_relation": "sha1", "Tag": [ { "name": "1686735623", "colour": "#C7EBF4", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750887, "uuid": "f0026df5-6d44-4816-b092-9fbfed3b445c", "comment": "Malware payload (Quakbot)", "value": "2722cf648896893ac6aa14c5312299074032b82da133f0fb8079587e5b291c85cafa1515a3e92c2b2bc536eb3751f26a", "object_relation": "sha3-384", "Tag": [ { "name": "1686735623", "colour": "#C7EBF4", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750887, "uuid": "ad028886-bf15-4c2e-8cd3-39c657520bea", "value": "T137B124E51E0E40B58676F865A1CB9CA3EFE3D62E031E55CE93049B22F91B81DD0726F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750887, "uuid": "399470d2-577f-40c9-be06-47d08c8d0f09", "value": "96:QsiJeHcvAjHsVKzbXVVkzNIUfU2UgNnkRfqeYLLVNeI9MbX/u:QBsHJURrk+CZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750887, "uuid": "b0ddebf4-523b-4c46-b854-9ee47367f4a7", "value": 5427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750887, "uuid": "5a8bd3a2-8b17-4452-af2c-873f6b2ae228", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750887, "uuid": "39efe5c8-a76a-4c75-b7ce-221cbdcaab1d", "value": "docu_AE724_Jun_14_1.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f36333-0a75-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686720983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720983, "uuid": "b867248a-fa48-449d-876e-2adcc59412a9", "comment": "Malware payload (Gafgyt)", "value": "521e4a4c54b411d1d03127fd65f727a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720983, "uuid": "4dcd7ba8-ddb3-4396-a003-06f6f0545ad3", "comment": "Malware payload (Gafgyt)", "value": "bb23572da298c61a85d6c26ab73d267e65379395dd2649e511ae5c9e7e204c55", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720983, "uuid": "10573342-8be5-4c07-bc36-d917eaf3b43d", "comment": "Malware payload (Gafgyt)", "value": "a546d47263bb0eb331882ea2d7ba917fda28377b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720983, "uuid": "2312da9d-509a-42f1-bdc7-82b6f93b5303", "comment": "Malware payload (Gafgyt)", "value": "a2c2e4449565cd27637f8ee601a61785eb0e76d7f6b0c0222450397c6b44fbc29e66eac7f909381b7f71e0d8e6b6f70b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720983, "uuid": "242dbbd6-67d4-4853-9f44-63d4118b192b", "value": "T14F5302F045928AF0D5F31D7020BB46D9724E0BF91E92322537A549E65EC6983D1F2F83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720983, "uuid": "984dd525-8a37-4e04-b3af-9a30dce357ea", "value": "1536:LaiO9ONjwNRhIrfP0j3yuC1pOr826T0qGdsS:LT9wNR6rfP0GuC148aqGaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686720983, "uuid": "7e279f06-f603-44eb-a477-ef1eb418a7a3", "value": 62304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686720983, "uuid": "546793a4-37dc-4754-a153-9efc76860d37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720983, "uuid": "dd85b0c7-09ce-420e-a24c-a441b3c584fe", "value": "521e4a4c54b411d1d03127fd65f727a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ec1673-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728739, "uuid": "3cb40d16-ca69-410c-9801-f541d7b03f0c", "comment": "Malware payload (Quakbot)", "value": "45175cf63537289c15e1c724954e6fc8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728739, "uuid": "091d4401-a4d6-4b06-bed2-d317a25da067", "comment": "Malware payload (Quakbot)", "value": "bb8759ef43fe68f47088825593a27fefe39693d115e9935c8d7c14201e0ac965", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728739, "uuid": "51a030a3-346d-4408-96e5-69ec761d7afa", "comment": "Malware payload (Quakbot)", "value": "cd36f32dbd7390565a0eaa4a466a98ee3e971b6f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728739, "uuid": "f354b18a-d627-46eb-b3a4-59625425b59b", "comment": "Malware payload (Quakbot)", "value": "a9d346516065587ea2ebc65d86dc9d6471016978028e1d4d3eba63f446f5cc7f1dc5415e77d9db9628ace46a8c8bcd0a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728739, "uuid": "c977570f-b6b1-465f-9351-f129d6003886", "value": "T1267431896655E0F04237B37BCE164410FAAB1E5B2084C972F97C50592F3D8697EBBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728739, "uuid": "57d5ccc1-cd6b-4ada-a2c0-17e592f2fb34", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbCCAV66PNbbbkwq1hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728739, "uuid": "97a5a034-56a5-462c-902b-41e5c5f3c5e3", "value": 361100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728739, "uuid": "23a94070-c85d-4daf-8611-7ad200e154bb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728739, "uuid": "cc38349e-b8aa-4e75-8dcc-a2c7ed14396b", "value": "Qg9I11tJ7Arm.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b8bf43-0a83-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686726940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726940, "uuid": "06dbeef1-d600-4aa5-a0a4-10ff3b897000", "comment": "Malware payload (Amadey)", "value": "6223aa5300721b92f4ef37fa3a6e582f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726940, "uuid": "cfe0d30f-24e8-4fb3-b305-0388b20d79dd", "comment": "Malware payload (Amadey)", "value": "bbc21ead00fd6f513c18d6b185082cd04583d1ccb2862732c5535b8eb37d53a3", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726940, "uuid": "c8870801-6331-483c-9e17-9732052138ff", "comment": "Malware payload (Amadey)", "value": "141ee0d8c17f2d94d71c0002c581309ae155fcb5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726940, "uuid": "0007dea7-7dee-46b2-9704-0dea7cf25f83", "comment": "Malware payload (Amadey)", "value": "9b943a06746890773104627de0b0f75ae55cdee69c4dc870375b654330a2bba787e1b7be7da46daa81807d764c95573d", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726940, "uuid": "c50c81fd-8c72-4643-bd6e-1f0e6b734e54", "value": "T14ED41253F2E88532DCB313706CFA06972B31BCA26D78866B17846C5E4D726D4D831B6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726940, "uuid": "5e78bb62-db1e-4a8e-8bc5-87373524487f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726940, "uuid": "552f3d91-521c-49e7-8c00-7c00d0d14c63", "value": "12288:lMrly90IiRm/Ypw4q//qfKeycAuutOZJk1lAt9ijGuLhANPBPs+ow:UyBiRrvq/ifKeynAZOlA7HuLhANJkbw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686726940, "uuid": "f69e6539-2873-4a37-a834-a699a961b08b", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686726940, "uuid": "e773c7c4-020d-47b3-b1fc-423f107baafa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726940, "uuid": "c7a96daf-e0d7-4d61-9d0f-4eab74e303de", "value": "bbc21ead00fd6f513c18d6b185082cd04583d1ccb2862.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25dd5861-0a8b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686730324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686730324, "uuid": "85082132-83b9-42b3-a00d-6c62257dc7bf", "comment": "Malware payload", "value": "a6fd40bf52ca005515b84b2bbd2041c0", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686730324, "uuid": "581fd4e0-1f04-446b-9101-155127eef5e6", "comment": "Malware payload", "value": "bbe0a419567e7e1b82cd55e23dd009bab6568f7773f1d3b559f5ffd39b2139e2", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686730324, "uuid": "8e6a103d-b602-4ffb-8233-b86078f82195", "comment": "Malware payload", "value": "b666f34198d513f5b96bc8844500c5c2ec9333a0", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686730324, "uuid": "62bbe4e8-f181-4f4d-9711-72f97bda083a", "comment": "Malware payload", "value": "e433267caeab5033849ba5af9b019128d67a0b36b3d72311c98c3b76d85893e1aee0a9d81576206e3d1a9c697880635f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686730324, "uuid": "9e18141b-a54f-4bed-846b-56194ac2cb51", "value": "T101C5F2C0345B0D979D0BB039AE67E15CEABC4C78F4BB2F42138E8BAD84D9076259D95C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686730324, "uuid": "d2a62389-681a-48fc-94ae-bcbdc791226a", "value": "49152:F8KNAj3IQrryL2bebn0d4Fdwg4NbK56AdlqiNkp+TOOi:9Ny3IQqLli4FGhJJyIiNkp+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686730324, "uuid": "ad3ac0b4-e439-4d34-9964-10db2c72cf9d", "value": 2614409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686730324, "uuid": "32689c8c-832e-4f15-8ac7-bb1b752f5caf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686730324, "uuid": "69eba43c-a719-4e8a-87a7-925788406c98", "value": "Check___.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7f5d6e-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728644, "uuid": "941a4bdf-3583-43ec-ab1a-bb7b379e8d96", "comment": "Malware payload (Quakbot)", "value": "f4d01a3dfebf02d1f312629b8b4d4c64", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728644, "uuid": "60a9dcc8-a28b-421f-8beb-6ddf99e3e70e", "comment": "Malware payload (Quakbot)", "value": "bc7f8a0c0173cdb7fe20372bc4ed888006702d7882dd8a12d619afd70fbf1024", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728644, "uuid": "2bccb0a4-1227-4103-aec9-430a6048cf77", "comment": "Malware payload (Quakbot)", "value": "c5c2f158ae750b9ef94763d484dfef2925a16f62", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728644, "uuid": "d29f21c4-0392-4467-a0aa-aac3d06d5869", "comment": "Malware payload (Quakbot)", "value": "f09e305b43953f1ad3ee30e26416d6aeb52b962d85d55486abd79c6bb468923f880fc37be77b27672da9955a56e5feb2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728644, "uuid": "2412c55e-6c84-4b9d-ac23-4bb5792b6cca", "value": "T1C07421496A45E0F09237B37BCA178420FA6B1E5B1084C936B97C51586F3D85C7EBBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728644, "uuid": "1a8c9ccf-2e0d-4f4b-9ba5-c7ed5be8a5a4", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbRlrO/qOl8ThS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728644, "uuid": "c31a40d4-72f3-49c3-929c-857451959ccd", "value": 359893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728644, "uuid": "a015d778-972d-45cb-b91a-2a0b0aa30463", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728644, "uuid": "e377d061-311d-4cd7-8747-15236721515f", "value": "Sjeq7vH8HEmx.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302b670c-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728194, "uuid": "cdd94a66-2548-4d07-9c9d-9e82e5984cfd", "comment": "Malware payload (Quakbot)", "value": "0abc097894120ead79d4ecc14df89474", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728194, "uuid": "5780d990-5855-4ecd-9815-8e9313fbac30", "comment": "Malware payload (Quakbot)", "value": "bcb8e0e2c9a1c3efb3343b6ec859826c2b2b40acb43b6ef4b975ba8418da08ae", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728194, "uuid": "b131b79a-b8e2-4268-bc92-cb5616ac97ef", "comment": "Malware payload (Quakbot)", "value": "0b45b4e2ece461944fd1d4be9854039541ea03e1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728194, "uuid": "d49eca64-da86-433b-ac9d-6f7e509b01a5", "comment": "Malware payload (Quakbot)", "value": "0d747625f1db4951d35c81ad2b83354bc0e6d56fea3198802c33cb8318b9c2e06c80de41d6060464f7726100c5dc9e9d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728194, "uuid": "c68040bf-0ead-49a4-b4bd-32aba9efbfd1", "value": "T17B6453496A55F0F09237F33BDA178410FA6B1E1B21848972BD7C505D2F3D8296AB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728194, "uuid": "6153925c-e94d-4266-903f-e08d1ad4eae7", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbVrRYSwNChS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728194, "uuid": "30e34b9e-96a3-4782-b767-7d83ec373607", "value": 323757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728194, "uuid": "466bb07e-af09-43d4-8f29-d86415386f44", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728194, "uuid": "9dd252d4-5f5f-4a45-a332-a552ff38fcc0", "value": "bowsVUIhXG6l2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5872b65-0ae1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686767529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686767529, "uuid": "452950db-6704-4c14-ba79-f9277f48d41f", "comment": "Malware payload", "value": "58010a1b6bc687458700c7e2e663fb79", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686767529, "uuid": "0348062d-73fc-4f41-ab37-489c78a87253", "comment": "Malware payload", "value": "bcc6c5ebaa7ede4e4485cc0a1884e6e12923e4c7aca85283b2a546c2b8034055", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686767529, "uuid": "4dd32fb2-e401-4c2f-a189-6cc36c34f9f9", "comment": "Malware payload", "value": "50cad0117a9b13d530fb4861170c48ac0a2c671d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686767529, "uuid": "faa0d823-bcbc-43bd-a990-ae317edbcc57", "comment": "Malware payload", "value": "e204534cb20c1ce8a3da0577b6af0e8bdda98ff68567aafd889af7b24e178c3db3def5d048a031216a96cf43a5639256", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686767529, "uuid": "7462a7cf-9628-4274-ae22-ec8b9e94ac48", "value": "T16594012372E0E431D06753714C7ACEA56AAFF9016F34629B22481B2F1E736D0A97536F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686767529, "uuid": "3205bdfe-aaa3-430f-bb74-b1143ecee1dc", "value": "b14a6a82fd1c1e39d5e11c743609d6e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686767529, "uuid": "a9ce64d0-2095-487c-8746-668d65df2a23", "value": "6144:Snx4kGrqok1CaeBT5a26lCKO0SoaMCxbIkKimBHDNBD9t2SB4v8et:SekG+R8vT5b6JOzqCSLBHDvn2S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686767529, "uuid": "9d93073c-57f3-4487-a57d-6760a11f7f27", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686767529, "uuid": "f488e035-466f-4eae-ad88-f63c82210076", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686767529, "uuid": "aec2dd08-294a-470c-82d1-0969d5159761", "value": "SecuriteInfo.com.Win32.DropperX-gen.6553.3275", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343ba81a-0a9b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686737220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737220, "uuid": "967f5d31-6ad9-4138-80e2-25f439ddd7eb", "comment": "Malware payload (Quakbot)", "value": "d12badcaa576ce57a8767d64f89364fe", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737220, "uuid": "a1847f60-b77a-4437-ac61-5f4cfb51fce6", "comment": "Malware payload (Quakbot)", "value": "bd5efe72439aa5459fc8f34bf513d7a635b8758d3352c1571ddbb11807a24904", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737220, "uuid": "96fce136-c7c8-460f-b3ef-8b53b3dd6197", "comment": "Malware payload (Quakbot)", "value": "0808b513e64896db00f6da1b4e37db1b8e8b4f68", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737220, "uuid": "08e17760-85f0-4730-a081-37a40e0bd6c5", "comment": "Malware payload (Quakbot)", "value": "08727c0fa04712c2b8696c10471eb6026fbf4eb12761d1e073340bbe5ef5f63360e14d40c80edcc2d5d47d25c0e4b034", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737220, "uuid": "17b29bca-d67f-4238-9770-716650ef4a31", "value": "T1227433486A51E0F08237B33BCA564420FA671E5B2188C976B93C60595F3D85D7EFBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737220, "uuid": "dd1b0708-35cc-46df-ac3f-8cce6ebdee27", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbCG/kkFdIdoxNoO4XGUsjG7/:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686737220, "uuid": "6f5a1ca4-82fb-4256-869c-4b1e96f77f32", "value": 367585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686737220, "uuid": "965afbab-8782-41be-a71b-d1c75d9e68f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737220, "uuid": "d32c7321-501d-4522-ae80-b70aa589dd25", "value": "OszUTGmxIjsl.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "025de3f5-0a9e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1686738425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738425, "uuid": "cc89c3e1-a04a-42b2-b347-1649c2cfe4ec", "comment": "Malware payload (Rhadamanthys)", "value": "ab56a753362b82caa25d23fee17bcbe8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738425, "uuid": "daf3a134-e4f7-4f86-b648-60a794b74111", "comment": "Malware payload (Rhadamanthys)", "value": "bd60605304be239c72f53cc7b881a7c0aa77b668f3e732ae1ea032b24e052fc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738425, "uuid": "56241ca3-f40b-410c-b383-0e19d4a3660b", "comment": "Malware payload (Rhadamanthys)", "value": "5ca763ecf92b0a52bfa82b8c75c5f3ea280b2376", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738425, "uuid": "820f3fc5-dec4-49e7-8d48-4e4cb09a3e1f", "comment": "Malware payload (Rhadamanthys)", "value": "1495bc24e0204bbaef767cf1200ab4b7a11b85068e22ba4a917216b925a7d743c57116dfe0a675d80bc7d9156ebcc77b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738425, "uuid": "f495b775-1746-49e5-8c33-365b706815d9", "value": "T1BE94012272E1E470D16157309D7AC6942A2FB9120F38179B771C1A3E1FB3AF1EA76352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738425, "uuid": "65e48cd1-0cb4-4aaa-8ffd-f89ec7c60264", "value": "048976e84d2108e3492c4c483eff983e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738425, "uuid": "93b9a710-a377-428f-b8da-b1c92d07b4f5", "value": "6144:o4p+Sr+LyyQesANavol/54TQbje/TYSgeOvM/v6GjwFrGPS4iiFVGAPRfdfL3V:JRr+LioXR4MeNgen1Mr14iimA3L3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686738425, "uuid": "f364ff50-0359-43dd-ae2d-b8735ef16c4e", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686738425, "uuid": "30146941-6759-4fd3-8853-bfbe856b8fb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738425, "uuid": "8f27fc08-43ae-4886-967e-2eebc803954d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31838a5e-0a73-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686720036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720036, "uuid": "8ee94d79-209f-486b-acdf-3694b19d2c2e", "comment": "Malware payload", "value": "f08b457296d5722d72ecd84ad0d3dd50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720036, "uuid": "ae795ea8-48a3-495c-b3b6-12873fabeffe", "comment": "Malware payload", "value": "bd6961b640428b98d74a97b12ff8e7c90c582556a4cd58abf328a07ebae8879c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720036, "uuid": "fba1fcfa-a0c5-4ca9-b383-898d015a9145", "comment": "Malware payload", "value": "779f650b5825b351e9ad1018103821c7d4403f43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720036, "uuid": "f9650387-3a4f-4d35-9ede-32c83d6f86a3", "comment": "Malware payload", "value": "ad7e03696c653d5feb3a71f5e7c57977720093e3a2dbb28172434f5c0145c2a7643f3af8419a65c2bbf68d5937b9555b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720036, "uuid": "f5a5bea4-ca87-4364-bb5e-ca8d446c0848", "value": "T1F8353B26F251883BE1336E79DC6752D08829BF102D34AD4B2AE46E4C7F797C13A25367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720036, "uuid": "47f1fa9c-321f-4ed5-b364-048ac3013c23", "value": "5b021a33454cba853c2c6ed7c3aa9923", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720036, "uuid": "20bd7c79-3c19-4263-9e69-898debc3e245", "value": "12288:G0nB4CrsLRbQACTdgHC7RpawtLQsNZsWTlynvgqn3WzuqseNkLcgf9oJQZnlAoj4:L4msLGm2RpamksNZ1lQUNDa9oJQZnlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686720036, "uuid": "0970c15f-00f5-460b-b51e-048a9f3deef4", "value": 1152512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686720036, "uuid": "cf8963bf-f20e-4691-8d25-4c0a448b4a1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720036, "uuid": "c44169cd-7706-4703-9e43-f60638c21a19", "value": "BPMPlay.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb4dabb-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725885, "uuid": "0af1839b-0d6f-49ce-a905-21d0d2cfda4f", "comment": "Malware payload (Quakbot)", "value": "b030b5c6e8a7d255f520d4dce11cbd41", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725885, "uuid": "6913664b-66a0-4795-9a5d-e9986c011362", "comment": "Malware payload (Quakbot)", "value": "bde0d66fa6e4905f5ef251efa83fbb85ea4ecc10344d586450bc50b8b4a59fdf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725885, "uuid": "96538d70-1901-4ab6-a09f-c939277dd1e4", "comment": "Malware payload (Quakbot)", "value": "1fbab3a081c25ad46cae4883602f46600696ec46", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725885, "uuid": "14a92ea7-714e-4109-a8d4-4926aa5191d7", "comment": "Malware payload (Quakbot)", "value": "2c10c0aef92b29b6a42be0875e42f07df26905446bd1c3353b03d86de9053fa6848eea567a644dc3f2bbb51382166424", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725885, "uuid": "d97c30f2-8333-46a6-be4e-b42ce8f896ae", "value": "T166743288AA44E0F19137B337DE578410FA6B1F1B20C48936F93C11596F3D8697AB7E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725885, "uuid": "ae91b907-ceb8-4559-9b29-c53c1421966f", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbfdZKBhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725885, "uuid": "cae1112c-5e1b-468c-9af9-e5bd7c03a0ea", "value": 338999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725885, "uuid": "22881c6e-2240-4f49-ac01-fa04813dbac3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725885, "uuid": "654ea8fb-c463-4058-8835-d2592d3a4d85", "value": "i4jaTYUx7eKw.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4d313f4-0a96-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686735315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735315, "uuid": "2c4ec52f-706f-4476-9cac-e94d7ad15fc4", "comment": "Malware payload (Mirai)", "value": "bad2d9a01e71ca342cc2f1e4efd130b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735315, "uuid": "04d9218b-3711-4b6e-8c3e-9fe90ec453b4", "comment": "Malware payload (Mirai)", "value": "bde5fdd97276ee0581337f524e297f5fe87c6374ed1af127cbec0d91dc7a88fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735315, "uuid": "71114ef8-ec50-4e49-8502-0e2af7effd3f", "comment": "Malware payload (Mirai)", "value": "b6c24017663b3683ea1ed55a59e0c207a5d3d017", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735315, "uuid": "9b7cd800-14cb-482a-9373-8db16170c2dd", "comment": "Malware payload (Mirai)", "value": "4fb048516eb1eaf6ce6af971d3030ee2f786d56184bb00c57f7a2d2eeaff733b19e6247bc1e41fc84600a51f38e68a9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735315, "uuid": "23f2c326-5e1f-4c21-a55b-9c973d1ec502", "value": "T18C631A52B8809B66D5E056BAFE0E018D33531FF4E2DE72068D15BB3077ABD4A0EBB541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735315, "uuid": "c22633e5-e3df-4fd1-a7c2-947b15254ed0", "value": "1536:8Mn8fR3fCcuQNuIqtYTJjxOQrs5dsVw/W/YIBQkNKRr:oVdukMFuVw/W/h1KF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735315, "uuid": "7b4616d0-fb02-42e4-bbbc-740f6d803a03", "value": 66956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735315, "uuid": "9f828c61-7028-4be0-9c8f-967719dbd46b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735315, "uuid": "298e47d3-0c9e-4515-8105-ffb5a1babca1", "value": "bad2d9a01e71ca342cc2f1e4efd130b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5efeb39b-0af2-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686774658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774658, "uuid": "2211d9b4-f359-48c4-a4fa-528d424a78ce", "comment": "Malware payload", "value": "5c6274bdad7edbd26b8f49aba43e9a79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774658, "uuid": "f7416d3e-e5ea-4ff4-b359-2895fa4ba5fa", "comment": "Malware payload", "value": "bf038b7735ee3eb1b6953d09948d6744b8bddf52e8b699d5553b5f31533c66db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774658, "uuid": "a8a4a280-636d-49ce-bb3c-3bbe46ae357a", "comment": "Malware payload", "value": "da224f8d53b9225a345deac5439d8d94e06aacd8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774658, "uuid": "bb7f95f4-5701-4328-84e6-c8bab3e8e1c4", "comment": "Malware payload", "value": "5f29be6f36f6587f2ff590e489b38f230e7629ea88dba421c9e08dcf072321f560acb1f0d202a8124dac725c706a0191", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774658, "uuid": "1378eddb-8c42-421a-ad2d-0721c3f135ec", "value": "T16F633BDAF801DD7DF81BD77A4457090AB930B3D502831B3B639BB9A7BC721A81D12E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774658, "uuid": "a26fd323-f162-4dee-8d84-756b6e401f28", "value": "1536:vAgV/VExEg2kDY7Dm8VJyyE1sxQWbxdJ3rWNzE+VQly:vAQ/VEOgDE7DiyE1GQSx/B+VMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686774658, "uuid": "06cc3018-a167-4850-961d-9d324477f914", "value": 69636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686774658, "uuid": "0dfdc601-ed3e-4a9d-8a88-475d5a8d3408", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774658, "uuid": "8ce5ee95-9251-4c3e-b931-f0328e06069a", "value": "5c6274bdad7edbd26b8f49aba43e9a79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1634a1b5-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686750484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750484, "uuid": "86f0f555-5a84-4fde-9db8-55aff389e1a3", "comment": "Malware payload (Mirai)", "value": "772e934e1cb341ef73f05e8621ad9de7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750484, "uuid": "67211577-c77b-4833-8b2c-847d2095729d", "comment": "Malware payload (Mirai)", "value": "bf130faf9ce6f56a6a65a8f3ab5e05484f56a5cc189355aa8a683116206cb570", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750484, "uuid": "0ed7237f-2f9a-4774-abfb-a1c82cd6d658", "comment": "Malware payload (Mirai)", "value": "888d08b89a2a288d7b56bf246077424d7df07e9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750484, "uuid": "5bd40058-51c6-4058-a230-e5852a0c2cf3", "comment": "Malware payload (Mirai)", "value": "162e95857c78c38c722c0e3cadb98723946bd1e2ec3618b3cf2525aacbdb3e4aa4974e17ac0fa670cd8aa3b87966b53f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750484, "uuid": "4595e189-c03b-43f7-a460-0e2c4ec9e410", "value": "T11E639D3AE40A99A4C0424634B0E5DE351FA3A9C043272DB6AFE441B61803EBCF55DFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750484, "uuid": "88d04d6e-7dd2-4fa4-8928-226fa198c078", "value": "1536:YaGrdgbyFJxwtHYJ1rMTfxoI/NL/7vCpuh9C/P:Y3ebynxwpHvguh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750484, "uuid": "8ebe6f8f-584c-482d-b531-5a96323afd2e", "value": 66964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750484, "uuid": "47d00155-53ea-4a79-9ca0-0be722592b5e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750484, "uuid": "2d809b47-b627-49c8-bc1e-de6cfd070b41", "value": "772e934e1cb341ef73f05e8621ad9de7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3374413a-0a7b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686723475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723475, "uuid": "f61dc17d-62be-4e6c-b50f-548a506ca78f", "comment": "Malware payload (Mirai)", "value": "6dd1148700bde50f3bad19da47be18d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723475, "uuid": "05ea4bae-731e-4d5c-b606-42a4ac7ea574", "comment": "Malware payload (Mirai)", "value": "bf51e9e523056b78703c091800cbfb76d79a6477b2db392cd53ef97dfc25bf49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723475, "uuid": "873b62e1-147b-41c2-a4ce-d50c5237dda7", "comment": "Malware payload (Mirai)", "value": "4180b288d3b36cfa41c4652511df4857bb887669", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723475, "uuid": "66bc48da-df55-4d77-80fb-34d88f8df772", "comment": "Malware payload (Mirai)", "value": "165612a8f3fbc7e5a3cc661108c76a4288790191860ec5b76107649dd311d965b5fe68d19b675f8eadb37ba72137667a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723475, "uuid": "ec4d5d90-eae3-4e51-8b6c-52a3a3856043", "value": "T18A04971E6E228F7DF668873047F74A25A75C23D627E1D684E2ACD1105F2438E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723475, "uuid": "c6710e49-c6cf-443e-81da-5af4be07df33", "value": "3072:u/Wl6pWwVCgxANfiGcdB3/lijcJolaLPhTC2jRiwBS:u/W4Qqn/0j7laFTC2jIwBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686723475, "uuid": "1c9a3a67-4134-4f28-b3a9-00743ea3cff1", "value": 190056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686723475, "uuid": "8a3c6166-0869-4a87-8e6b-2b73be1e67b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723475, "uuid": "74e6ecd4-96d9-45ab-b779-76a64960103a", "value": "6dd1148700bde50f3bad19da47be18d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52fdb7e-0a74-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686720686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720686, "uuid": "232b74e2-0efb-47f4-902f-cc2b3d87307e", "comment": "Malware payload (Mirai)", "value": "c33fd73a17367277bd466ea60cf16489", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720686, "uuid": "70387698-6cbc-452a-a9b0-590b64bb0615", "comment": "Malware payload (Mirai)", "value": "c1e3b5507d0b7c025e0cefe8bc7cf9bf6621176de38886d8dd3d1a92d2de4aea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720686, "uuid": "e3b7d3bb-3154-4367-89b8-5d0e70c7777b", "comment": "Malware payload (Mirai)", "value": "b2597c4673d1546338aa6258c66271442b3284d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720686, "uuid": "12b53922-c7fa-46c8-8882-4b72e4f96147", "comment": "Malware payload (Mirai)", "value": "62bf28e1379a400a8ef9eb40ea0c5ffc6277d424024f8fa388e1fad6aca37062d27f8c6832c015108ef79489ce7faa46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720686, "uuid": "ea58dbe9-b667-4dfd-81e9-f0d2a267bed1", "value": "T12193E709BF610FF7E86FCC3709E91B05198C550A22A97B367A34D868F64B65F19E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720686, "uuid": "063ec3c0-256c-4e08-8d07-2d1f791b0834", "value": "1536:nSITUINkErQWGWfZnH/zoSAkaI91rFSEZa72PXo:nSITRNgWHtHUibSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686720686, "uuid": "acfe2432-738a-402d-9b1a-f9d1ef4c9ffc", "value": 97568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686720686, "uuid": "04fb1d4a-f002-498a-b5d3-3e56cbfb77c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720686, "uuid": "928c0d35-1b06-4482-81d1-c5708f81c27f", "value": "c33fd73a17367277bd466ea60cf16489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b62e9329-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686725842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725842, "uuid": "0b6983ff-3623-4cb1-a07d-fb17174245b8", "comment": "Malware payload", "value": "342b6364164705d91d8a625a94b22ac6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725842, "uuid": "fd8e3961-6746-4a0a-b2b5-b5d7bdbde6ee", "comment": "Malware payload", "value": "c22dc4173284f84493d9f11142a4f3e459c34fd1a413ca34a8c22e01b926463e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725842, "uuid": "52f8006c-63dd-4d0c-b8cc-460a32705f34", "comment": "Malware payload", "value": "608a0f8ec480194e66272e23ea74eaf7951ea1f1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725842, "uuid": "5d33a6bb-7d9e-4d34-93d1-c4bbdf26d7e6", "comment": "Malware payload", "value": "fdc7007a7ca922f94ee6eeec7ee739674e467cb9ca0b24705525fe86db1a90912de585b15f80a1200ddadd24c5c68628", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725842, "uuid": "01a6004c-3d06-4182-883d-52e7886c94a0", "value": "T1D46465496A45E0F08237F33BCA478410FA6B1F5B21848932B97C50596F3D8697EB7ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725842, "uuid": "95823758-bad5-4875-ad43-e1267c57ea56", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb/RF8hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725842, "uuid": "8506fc7d-d5dd-44dc-a44c-c8893ea9f290", "value": 324655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725842, "uuid": "1bbe7d6c-1e7a-4de9-9cd8-5afa0e12aa99", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725842, "uuid": "06df0a50-f05a-45ad-aaf4-43baeb04fa34", "value": "jEACfOmWSAdGEr.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e8abd1-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686750479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750479, "uuid": "25a64c7c-0dd0-449a-bf72-5bfeb1dcbb82", "comment": "Malware payload (Mirai)", "value": "530842d128b235bd96170f6197374c5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750479, "uuid": "20540431-0b27-46c9-a944-3d8a0c6d2553", "comment": "Malware payload (Mirai)", "value": "c2adc6daabb7562415e34be41da495ac53c9489db3f4f281e077aca219c0da8e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750479, "uuid": "29dbb6a4-a1cf-4dc4-89a0-0ce64b39ad35", "comment": "Malware payload (Mirai)", "value": "539f8c51caf5bec94718f4b8b196b96e2ff6c9ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750479, "uuid": "45144e8a-2f4f-44bb-beb0-02cfdaca187b", "comment": "Malware payload (Mirai)", "value": "a22fa9f4552af1c2ded7ec65bad559f23aeee54d720b0900175ccc147ebacd1b4c7006ce80e1757d911af48aa3cc3f87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750479, "uuid": "b55b7cd0-e47f-4b86-80b5-058e06fff469", "value": "T1EAB2E15172AE7C90DBB01031CCB885EEA217977062E470BE109463A52CD2F572B7BEDB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750479, "uuid": "e4d654b1-819e-4e02-b878-2c2cea0ac87c", "value": "768:YntPnXHiXVciUOf+QQmw/HKW5ltys3UozG+:YtfHiXVcJKlvw/HKWXdzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750479, "uuid": "9bd31cc4-2819-4095-9c30-f345b321f7cd", "value": 24608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750479, "uuid": "b57b028d-8ead-4e55-bd2c-5b832b223e7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750479, "uuid": "5cbd183a-e1d2-4971-9ace-2e37f236114d", "value": "530842d128b235bd96170f6197374c5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f06f33e2-0aeb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686771896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771896, "uuid": "8728f04f-1634-4bfe-9123-f69738dacda4", "comment": "Malware payload (Mirai)", "value": "3e390c2fd1c4be9e22ec7d6145a4fc57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771896, "uuid": "63ef8734-f19c-4964-b14b-92221a02b1b0", "comment": "Malware payload (Mirai)", "value": "c3a94a931a0ab8882931287340a4188cd9ec7ca049cb09c2e4c6555097565968", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771896, "uuid": "d4129088-c78b-4797-9fe9-f6ed22455d7c", "comment": "Malware payload (Mirai)", "value": "b9c88d34371b4d570a888f3442c0b2eb6f5d25ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771896, "uuid": "a696be4a-f165-4b42-9980-37287e64b825", "comment": "Malware payload (Mirai)", "value": "b0426d5340d7a58ec43512b1ee25e79a3b054e18c07184cd20f66edf8e39c660cd8cf4a5d0c6817313f7473d3fc8d721", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771896, "uuid": "881e5107-7620-42d2-b5cc-2655059a3402", "value": "T1D5A2D078B6B96C30C2B19571DDBC1C09B6179A3966F771310820CBB56ED320A37B89CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771896, "uuid": "f7f1eeb3-550c-4aa4-95e0-2cfcd284f1dd", "value": "384:Tfmu7YtXl3lZ4G6pIsCx5QQ3dqDYBMyLWNtV7d1/MwhymdGUop5hI:Tf17YJl1ZrcSdqsewWNzJ1Uws3Uozi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686771896, "uuid": "5040fb6d-4ae9-4a62-87cb-15d20cdd485a", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686771896, "uuid": "69d2e75b-9def-46fe-a761-04c80eef20b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771896, "uuid": "ca4c45e1-e2fe-4331-9428-5b9be73f04ba", "value": "3e390c2fd1c4be9e22ec7d6145a4fc57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e05b02eb-0a85-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728060, "uuid": "bc58cda0-7343-47cd-95f3-f90f33f592bd", "comment": "Malware payload", "value": "9f88ee892dbeff20bdb064c4b4561f18", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728060, "uuid": "75db1595-1c0c-4f50-b3d8-935960cabeeb", "comment": "Malware payload", "value": "c3f1110313742df53f6f93973f684be118068afd18a8eae12d3b4ab442de140f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728060, "uuid": "5cf01bc4-8fbf-4292-844a-66155855774e", "comment": "Malware payload", "value": "868992074ada3981009bdd0dfa9e78c92665f032", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728060, "uuid": "c0965dac-6297-48ce-a14d-c38e6dce8555", "comment": "Malware payload", "value": "100da482a751613e8366c6f7332f806763710fc9d3795abae82942659e085bf4c64a4f1b298da72ae1b0256aacb71d8b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728060, "uuid": "cae97554-f21c-4a76-a79c-952098ea4d35", "value": "T1C37477896645E4F04237B37BDA178450FAAB1F5B20848936BA7C50582F3D8687EB7FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728060, "uuid": "8f455b1c-6ee9-4a10-9fe6-2885d12c8169", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbFOXRTqB3JehS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728060, "uuid": "664d629d-cdf2-410b-8e45-71599a6d126c", "value": 353134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728060, "uuid": "fa8b23e8-59c5-4287-9b52-49ec52099be8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728060, "uuid": "5f632197-4b10-40b0-bb96-8dc29a8a369c", "value": "fTSTcKTAcqWr2J.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aebe2845-0a6d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686717669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717669, "uuid": "d64b1311-276f-4393-89a6-acb9fd16be4f", "comment": "Malware payload (RedLineStealer)", "value": "6776177bfd42449272d2828e61e54ff5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717669, "uuid": "3821c1a9-dfa9-4aad-ac8b-4963e54ce18c", "comment": "Malware payload (RedLineStealer)", "value": "c468bd5efd74928270e3ed0dd95ba7a089200ef30d22e52f2edd8b0544f9c020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717669, "uuid": "8bd912d9-429b-4d11-aefc-4a3cefa8204e", "comment": "Malware payload (RedLineStealer)", "value": "757a489016dc7a4da18dd3f67b4951bc84c012f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717669, "uuid": "212ece85-0cce-44c0-a4d0-e696fbbace72", "comment": "Malware payload (RedLineStealer)", "value": "7ca10ad55a02680cbeed2f6d2c471ff65fd89f415ba225e332914d8ea0bf64dd5fa86542d7f62f432e93c511a651a8b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717669, "uuid": "69c17e54-e363-49c3-a024-676cb11b9755", "value": "T1CA051226EBD44033D8FA2B701CF647930B3DBCA11D78836A2756AD9A5DB26C0643177E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717669, "uuid": "aae34bec-804b-4bb7-b8ba-ba912af11f59", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717669, "uuid": "fa21edaf-5bd6-4d17-9868-50c73dbc6de6", "value": "12288:WMrTy904Sj/07CtUSoFqzcrtSE3VTssXeB3e7StZluH5balQlslqXW8ZAAHche4k:pyeset7oFRrfFosqGShucyXwA8NtP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717669, "uuid": "76b66131-5217-4002-a7df-077e9bff5180", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717669, "uuid": "a10df2cc-c03f-49c5-a947-d21dad55b7c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717669, "uuid": "b81d8061-2a7e-4aa0-880d-57b29b894527", "value": "6776177bfd42449272d2828e61e54ff5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cf51a5d-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686750522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750522, "uuid": "a3640caf-d3ca-4f56-8f3a-7e14571536b8", "comment": "Malware payload (Mirai)", "value": "8142f9063651a07093621b09afc7d5af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750522, "uuid": "76d577ed-e0fb-47ab-955f-0da8cf98d54f", "comment": "Malware payload (Mirai)", "value": "c486cd1c86b089f5c3b97b699d6544f8c786d1565c722779f0e99fc80115ec75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750522, "uuid": "1b84983d-c52a-4dcd-bb94-b2d1a7b2937b", "comment": "Malware payload (Mirai)", "value": "60f3af8604c1e34794d158967000d4302283378f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750522, "uuid": "be99255d-ecf2-4c45-9eb2-5dab9cf45b52", "comment": "Malware payload (Mirai)", "value": "0e0251739c95a76c6da4a33539078e91b7134a70e60719ab43a08c8cab755911a12488c8de23e7f7ac49300ec864646a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750522, "uuid": "4cf71415-8c9f-4c0c-9320-594dee77586e", "value": "T156C2D06DE4F4B94ECF9DD43D624A0B6DABD4B1E2215C9B2C2B0598DE7E39568F881030", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750522, "uuid": "53bde00c-7b98-48ae-b24b-86d3fe106dc1", "value": "384:JU2KoRiYPxowLj6e7WTTgdBQiV3xyf2rtYdZ3a5CJdbQwRWGVCz0NvXi:ScNLD7KTggtZ3aMJd7WUi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750522, "uuid": "26ebb7c1-ed81-4e69-b147-cbac985bfc93", "value": 25756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750522, "uuid": "22d18ebc-9d5e-4cc8-8850-7c09c7974717", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750522, "uuid": "9f215f60-0e04-403c-967b-36b4f18d6998", "value": "8142f9063651a07093621b09afc7d5af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b8cbe7-0a96-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686735297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735297, "uuid": "1353a3ce-9020-41e5-a74a-ab39b7866076", "comment": "Malware payload (Mirai)", "value": "dc26d69f8061793bea290dc0df5df9a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735297, "uuid": "05c98655-2f16-485e-9873-b36d61c9869d", "comment": "Malware payload (Mirai)", "value": "c4be7e328fc4fed7c3499e9297621004b7f5ba8cd8911bb3a17f3d8e1f0f0e5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735297, "uuid": "8c8dd95d-48dd-4350-8184-e2da4ac34424", "comment": "Malware payload (Mirai)", "value": "6d68744b1d4bfe9160d676ba38c9ef889cdde408", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735297, "uuid": "1a3f0419-ebb7-4277-9538-83fabd6fd895", "comment": "Malware payload (Mirai)", "value": "38999c656c5ada6406a6c7b0551842314c744771987892818ae2e726bb3f5faef485473cec5fea1734e94ed9236875a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735297, "uuid": "bdb6cae0-72d9-4cb2-b8b2-079ee5d78b3e", "value": "T1BA632BC3F410DBBEF418D73B0C6749157271F2604E870A266BA77B5BE96A198092BFC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735297, "uuid": "49b0334d-4f62-4f7e-9c1f-585c52c0938c", "value": "1536:9C7eMetlZ8IqFfzQekacWVcW0JcWcBuVbgRAgLTcytLxGwLc9Iis/a:9iedNqtzQekacWVcW0JcWcBmbgRNXd8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735297, "uuid": "3813177d-ed7f-49c9-813d-5d2cb74bce58", "value": 72616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735297, "uuid": "084f9b7e-a28b-4a6f-a4fb-e78ecf9a307f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735297, "uuid": "3627b7ed-8195-4d85-8c77-73b2558b0efc", "value": "dc26d69f8061793bea290dc0df5df9a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e691b03-0a85-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686727842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686727842, "uuid": "4d01e7d0-1992-4661-add4-173fb447db10", "comment": "Malware payload (RedLineStealer)", "value": "a83040eb464197c5f388f8ee9a365868", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686727842, "uuid": "552b541b-1f9f-4e78-bab7-5f5e10472ed8", "comment": "Malware payload (RedLineStealer)", "value": "c58b36b1a42ff2c6e51f40c8dc81a69c1ae325bdcbe71a4c18699ec054d8eb5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686727842, "uuid": "485540c3-9cef-4ea7-89b2-8ca6c5fb0135", "comment": "Malware payload (RedLineStealer)", "value": "e52fcfe536543743c3103e1e91603f2f6b82d465", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686727842, "uuid": "46705896-4ccd-4f82-8f42-b6714142ebe2", "comment": "Malware payload (RedLineStealer)", "value": "8d05015d56dad28a907a73e8136b25cb6fa359c279aecb4e81a55de026a3bb885901d849449b834edf63796276e4c6d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686727842, "uuid": "7b72c30e-8098-4aac-a317-2d163af42389", "value": "T1F0D41212FBE45172E9B90FB024F603830F3BBCA1A875852B2796A85E1DB15C0B57177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686727842, "uuid": "745ebbdb-035e-415d-b445-6c965737bd06", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686727842, "uuid": "c89a45e7-90b6-4767-9933-bb0ca9810859", "value": "12288:lMrNy90CCBMdFxSuS+5dn+BvVrU4RCLCko7k34hpZOSHB2rq:UyWSdORkI4apTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686727842, "uuid": "0edd9ca7-0eaa-4f75-b550-9cd1cec1271f", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686727842, "uuid": "f16765b0-541a-431b-82d8-d0dbd643bde2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686727842, "uuid": "9ce56eb4-3349-4382-96ff-2088db685c38", "value": "a83040eb464197c5f388f8ee9a365868.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f7d1af-0abf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1686752734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752734, "uuid": "7a7ab5e5-0217-475e-83e5-016196345b15", "comment": "Malware payload (ArkeiStealer)", "value": "292df74602fe34e8176f62bca7f37e13", "object_relation": "md5", "Tag": [ { "name": "292df74602fe34e8176f62bca7f37e13", "colour": "#B4AC59", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752734, "uuid": "3efa9437-e009-44be-b20e-d04acc92864c", "comment": "Malware payload (ArkeiStealer)", "value": "c6c41e8fe419ed053fc979af4699a1b9c431797e246b1b9b536e3addec316de5", "object_relation": "sha256", "Tag": [ { "name": "292df74602fe34e8176f62bca7f37e13", "colour": "#B4AC59", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752734, "uuid": "32487e52-c589-4973-81fd-32bbf7509f6f", "comment": "Malware payload (ArkeiStealer)", "value": "0860ad29eaa5e973ec95c08c78460fce4ea8cb36", "object_relation": "sha1", "Tag": [ { "name": "292df74602fe34e8176f62bca7f37e13", "colour": "#B4AC59", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752734, "uuid": "66e5deac-c92a-4a2f-aa44-e32370aa5353", "comment": "Malware payload (ArkeiStealer)", "value": "5b557a52196e07db9561cf543f399dc027da153eed3a55266e1cfa3ba437d2b6f7a24db3a30385d46d86aa15864d0bd6", "object_relation": "sha3-384", "Tag": [ { "name": "292df74602fe34e8176f62bca7f37e13", "colour": "#B4AC59", "exportable": true, "hide_tag": false }, { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752734, "uuid": "acdb19f6-d0dc-4613-bdc8-7eb6774c6b54", "value": "T11C54E12332E1E870D56B1B314C7DC6E06E6EF4129F34A6CB6758C62F0E326E19976352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752734, "uuid": "1fc2ece1-c737-414e-8d52-918a6a65856e", "value": "048976e84d2108e3492c4c483eff983e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752734, "uuid": "327e7a81-41f9-40f7-b286-b32164079fb9", "value": "3072:7tFNAwmdUGabsgk+/m8RVm8hYIri43GjSOEtptdXdeIO48vTHVHBqwK3WfdEYLXo:7rCzd9aT3lRZhY7D+NprrcHVgTUKYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752734, "uuid": "10c7a532-4cd7-4985-b96c-78231a035a2c", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752734, "uuid": "3d8629e6-b9d1-45c1-9214-5ddee67f146a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752734, "uuid": "f248441e-cc77-4bd4-8da5-2bb96c6a78ec", "value": "292df74602fe34e8176f62bca7f37e13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c83592a-0a81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725987, "uuid": "aca07c9c-ff30-416f-9e38-5d8f17cd5a0d", "comment": "Malware payload (Quakbot)", "value": "d34cf04deb5894c623b409aa29ec3cc5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725987, "uuid": "f40c1191-7037-47f1-a4ee-74d15512221e", "comment": "Malware payload (Quakbot)", "value": "c74197b3621923b8654b61bec5ce475ecb8ceeb92361f4d2f440c97a0a8dc5a4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725987, "uuid": "b001ea8d-93da-4167-b146-c1cde2cb2982", "comment": "Malware payload (Quakbot)", "value": "59b16040e7aeab3b2da96115d9a235b693a1c217", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725987, "uuid": "b921b8d3-4115-429b-890e-a9e9386a63bb", "comment": "Malware payload (Quakbot)", "value": "c46d56b696157045bb782a248c46412336574b94b26abe015d038df32e6d144e70a7be27690fc86fd2be1ac6271794b3", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725987, "uuid": "a7026adb-1598-4c35-9f79-64c82315a870", "value": "T1AD7452896A45E0F19137B37BCE1B4410FAAB0E5F10848936B97C50586F3D8697EB7F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725987, "uuid": "ac6a6b46-b9d2-4258-a514-3baa7101f8e2", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb2DxnKq2hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725987, "uuid": "0bdb690b-b900-48aa-bc27-1dc24d065365", "value": 337491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725987, "uuid": "e34dfc98-5fd1-4a9f-baf1-5f2a4dda08a7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725987, "uuid": "9ec1ac4a-35e6-454e-8902-3feb90b18ef0", "value": "gJK5L2xr0RXBrV.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f377dab-0a73-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686720032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720032, "uuid": "75781cf3-1265-44f1-b5e9-9ff10ea3ccc9", "comment": "Malware payload (Amadey)", "value": "884470cd594cfdac3b0b4402edad493c", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720032, "uuid": "b8754e2b-2acd-40a7-9c92-4bc702cf710c", "comment": "Malware payload (Amadey)", "value": "c785dd4c2c71d7438ecc628c0544a3d89c5aa5a258d8cf7107e57d3b717920f5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720032, "uuid": "8b89356e-9ff3-42c8-b713-023bca6526dd", "comment": "Malware payload (Amadey)", "value": "1214972e377b7c9f44ffbd02e6861653cffd95d5", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720032, "uuid": "dd8c73fd-b8a7-4086-8480-5d68cc702cf2", "comment": "Malware payload (Amadey)", "value": "9bd199d862b6ad0807f27dcdb64aa31de0d3306283dbacd50101a5ac3293adea458e3f92a92b2648c3a79ded2bfd2d05", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720032, "uuid": "31936249-db0a-4d5d-9597-17e56841e1b0", "value": "T1F205121BE2E98032D9F5A7346CFA13830E327D70997897271756A8690DB3790B93172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720032, "uuid": "f9ac0905-55d9-4e36-904a-43372d29f213", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720032, "uuid": "f1ea1957-7389-4b17-b2a1-70001561fcf1", "value": "24576:ryqud4fUWwHv9dSkaOw2/S8cEc8Ccdrdd9wzn0:equd4sv9YkY29cEc8BpP9wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686720032, "uuid": "9cee1b32-2885-41ac-870c-458fa047fc9c", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686720032, "uuid": "d6bf8f38-6e86-4bc2-8a43-e2f84d074691", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720032, "uuid": "239c81b2-5526-43bb-8845-7977d7fd99e4", "value": "884470cd594cfdac3b0b4402edad493c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2bada66-0a55-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686707421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686707421, "uuid": "23ee190c-8b08-46f4-b652-59dad13d31ae", "comment": "Malware payload (Amadey)", "value": "b91b90dbbf237aed8a9480251e5d4d2b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686707421, "uuid": "61e73dce-1449-4b62-8740-59225563de78", "comment": "Malware payload (Amadey)", "value": "c7ed85fa8c7c137ab03cdb8f0fe4e4e57ffe9dd07211cea14220526e744fe3b9", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686707421, "uuid": "2e3fb08c-68b0-41c8-a44b-111a79514753", "comment": "Malware payload (Amadey)", "value": "ca9232236585612a2b43c7b99bba3bd1d042aba8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686707421, "uuid": "9f48ab2e-da17-4c7f-a3f0-90297ec72c84", "comment": "Malware payload (Amadey)", "value": "91b98ab1085caa16ea96f160f4d6749407bf6bc1d088b52261cfa8c2e6193a1880656053ea8336da0b4fbdb269a89d34", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686707421, "uuid": "04f7b8c1-284e-4e3b-8b1f-0ab36f13af89", "value": "T1F7D41253BAD90072E9F95B704EFB03C30A36BC915978436B2386DD491CB0AD4A5B177B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686707421, "uuid": "a5430372-1f19-491e-a545-ceeaf6c1a3d2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686707421, "uuid": "0b1a3baa-d57c-4423-b914-3caa890d3e38", "value": "12288:2Mryy90k2SxIOnlfCw7SMxHHzYpp40qMRDqJl3/1DoGzG:sytxIOeMxnQ+MRDqJR/zG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686707421, "uuid": "a7164aaf-43a5-44f4-ab7a-a3f9594c9db7", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686707421, "uuid": "df8a6d4c-e967-47bb-9059-e23882046fcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686707421, "uuid": "1defd92b-44f7-48d0-9370-660e30251b76", "value": "b91b90dbbf237aed8a9480251e5d4d2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67e7b26c-0a94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686734300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734300, "uuid": "f1feae11-8a93-4fb1-b1fe-b4f1eae9fea0", "comment": "Malware payload (AgentTesla)", "value": "aeeb06170ab936680c615adf702a751a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734300, "uuid": "d1d1806a-532f-46b5-8c95-80ac887763f0", "comment": "Malware payload (AgentTesla)", "value": "c8224735cb2ed3953be56afd3687bc2956178f7e6403d2a1b0720ae710c166b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734300, "uuid": "b1f097d1-4a17-48b1-a56b-12f8316e0c8e", "comment": "Malware payload (AgentTesla)", "value": "79c89b181a9545cb3fe4e14fede765f335403be6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734300, "uuid": "05359f8b-a73e-40ad-aa11-f869f068b077", "comment": "Malware payload (AgentTesla)", "value": "8c791f8edeaf55a7f28412af8436f9ad4be9166dd14ba8ab715e31eff67e0e2dfcd31c941b800b39611775c99ee80b1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734300, "uuid": "b3251e33-6bd2-4532-8005-87abaa164f97", "value": "T16EE42384C72F7A49B30C14FCFF9C148B9E16C15AD4E9A03D352AA75A0B8FDE56C17A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734300, "uuid": "803fd8bd-9ab9-4a7a-ad8f-6ab8ac493dd4", "value": "12288:Hbg4mtXNLOmncczLfyCrbcMLgplGetDWhyYRZ11SojdREvh0:7gDNzRzzyVlGSDWbVSojdivh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686734300, "uuid": "561851eb-0226-45cc-b717-7de33f49bb43", "value": 696904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686734300, "uuid": "7db0ee89-66e8-4e83-a217-23446e7169b0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734300, "uuid": "15272631-4a7a-4f23-8307-d4b9a369d11d", "value": "Shipping Documents.pdf.005.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01d25c1a-0a71-11ee-b3cf-42010a9c0076", "comment": "Malware payload (DarkCloud)", "timestamp": 1686719097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719097, "uuid": "16fd9110-6156-4a65-874a-a4498392f92f", "comment": "Malware payload (DarkCloud)", "value": "9073c53193c297a0e608ee8b4742739d", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719097, "uuid": "52dd156c-182a-4baf-82db-878a6a83779e", "comment": "Malware payload (DarkCloud)", "value": "c835a4ed16c8c96d262b659e9dcdce69f981f861663ce8b590de20511496a2fe", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719097, "uuid": "0404976a-98b8-4241-a0bf-9a80cadcadd3", "comment": "Malware payload (DarkCloud)", "value": "e131825bbb19c6195c8fe7568f45bf894e32efe9", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719097, "uuid": "28509163-7657-4359-a431-0346e8c8ebdd", "comment": "Malware payload (DarkCloud)", "value": "bf697d4237502820bc13d6b97d944253435048ea701f2b8d825b6c34e7907645ce7a09ab24b251b24dcdf6ac1f104c8f", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719097, "uuid": "a28e0087-d259-4487-9aec-fa509547c75a", "value": "T10A85861FBAFDD2AFE57FCBF188BA185A215A2E090BF1ED4326C5193195F2502712181F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719097, "uuid": "99d4524f-68ce-4e80-831e-6f05ef1410a7", "value": "e230488163a1186e04cd7a249cf306d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719097, "uuid": "6e59a22b-36e9-4d29-b556-c5d436df3760", "value": "49152:g3+V+Gbi7TyDrCLzSDbibzSjLCLTyjbi7TyDrcld8NV819cNFcF98t181dctFc3l:Q+Dbi7TyDrCLzSDbibzSjLCLTyjbi7TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686719097, "uuid": "3381ef3c-e271-42d6-a78a-b3ac9933cdeb", "value": 1713759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686719097, "uuid": "241f8a4a-a47f-4f82-a257-e1385d5fa424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719097, "uuid": "2c0bd443-3b2a-4362-ac09-fd612c3200e0", "value": "23261-1 \u0e40\u0e2d\u0e47\u0e19\u0e0b\u0e35\u0e2d\u0e32\u0e23\u0e4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656480da-0a93-11ee-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1686733867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733867, "uuid": "0d87c6f8-df33-4833-974b-7408ef6fdb36", "comment": "Malware payload (IcedID)", "value": "e758d39b1c568e13d6a429cbe8a247c0", "object_relation": "md5", "Tag": [ { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733867, "uuid": "6316b037-5d79-40ac-a9a1-c5592db4e758", "comment": "Malware payload (IcedID)", "value": "c84c84387f0b9e7bc575a008f36919448b4e6645e1f5d054e20b59be726ee814", "object_relation": "sha256", "Tag": [ { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733867, "uuid": "aedd1a1c-6111-4808-a650-5a1781d649a0", "comment": "Malware payload (IcedID)", "value": "4d8eab51c578fe86c132c9f7f52c1c2ed66f5488", "object_relation": "sha1", "Tag": [ { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733867, "uuid": "04b33d32-8e40-4087-a249-526887edd5eb", "comment": "Malware payload (IcedID)", "value": "1557d359870d56f25088c850456d9ecaba7f2f50e15e922272a2ea1a022f951ab917cbd45bdb83cf5f0c4c3849f8241b", "object_relation": "sha3-384", "Tag": [ { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733867, "uuid": "540c3834-2f89-4e49-aeff-ecc451db76af", "value": "T1CD05A7C223EBBD4A04275372336566F9D93ACA75D9C998CCF4457C58F0ECD02BA982C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733867, "uuid": "b33d251a-cd17-40f5-aed6-5b000644960c", "value": "24576:6GCflz14DrDAJqSovJ3ng1PMCvhXx77xJyC0+U4oWi/mmP4+e4pJkxkcWqUpw1AF:Yflp4DrDAJqSovJ3ng1PMCvhXx77xJy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686733867, "uuid": "8eaacf18-19d0-40ff-a765-9496741734d0", "value": 820011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686733867, "uuid": "d54850d7-90da-453e-8d48-2a44c04fcc25", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733867, "uuid": "c3907597-f5e0-45f1-9899-8791d9724a69", "value": "Docs_Request_06(94).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4076cc-0abf-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686752912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752912, "uuid": "f348aaef-05ea-4ce2-85af-275b8408e2fe", "comment": "Malware payload (Formbook)", "value": "f939f0754dbf01ab04a9ad14e219a9b2", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752912, "uuid": "769e1a24-35de-49fe-892e-7bd53bd7a1e0", "comment": "Malware payload (Formbook)", "value": "c8638e2a29455a9f17ae246aca7156fe7346e95a9abe66fd8832ab3ff6a58746", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752912, "uuid": "9f6ab96e-c6e5-4b81-acc6-8dfa761cbeed", "comment": "Malware payload (Formbook)", "value": "e3812c98288b7d8fa029aad9ba44df7872a2ca9b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752912, "uuid": "12946131-44cc-43b9-859a-786fab5b1eb4", "comment": "Malware payload (Formbook)", "value": "a19f7e2b0627d1f31152b291b16338681372361c1c689233bf38ca7882f8b73c74eececed7fe706f892739232e243f4c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752912, "uuid": "983819c6-c400-46d7-a1e7-fc6a1476dde0", "value": "T10B850221F5966C7DEE86C73895E3344A801DBC677D8ED8452341372A3673BF2EA23249", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752912, "uuid": "40e39970-d5f5-4c26-8f78-136a6ed4fc9a", "value": "49152:kuQ9zPjPyGiTupw1A+cJbm5Qs633AO05:kN52BTYZ+qbm5QBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752912, "uuid": "59f50688-ca18-43f9-806d-ca837cb9c96b", "value": 1740800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752912, "uuid": "94d6f99d-6c08-46b4-b93d-dfaf3b97a212", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752912, "uuid": "dc641205-36be-4186-b111-f1ba44f4769d", "value": "Offer_248452023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb49289e-0af9-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686777900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777900, "uuid": "0c12883d-0239-41cf-890b-9f67b48c78c8", "comment": "Malware payload", "value": "e1f52eb701940736239d68dbd6827e86", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777900, "uuid": "1d004b7a-75a0-4973-9fce-821556b8e50b", "comment": "Malware payload", "value": "c8bfc860f0c0d06e388afdec8658c5ab8006775406b0558b616196b1dee38c4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777900, "uuid": "afaa2f93-b1c9-432b-ac6b-21b40e34420a", "comment": "Malware payload", "value": "aab1b43af49bd0e11d7a241e4bf81ead644bdce6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777900, "uuid": "b3598adc-0322-4c3f-9d68-cfaedf1c6016", "comment": "Malware payload", "value": "a0b3f48b08901ab7c84ee4baac2b9ce652a0fb6d2c3da2de8c9b73b2510659de412d2118f067ee247ab704f6fc3fe3fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777900, "uuid": "2ff2481c-06c6-4f52-bff2-e587b6fb7c8b", "value": "T15C54E01232E0E472C56A77714C39D6D46A1EB912DF79A29F73680A3F1E722E0CE76305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777900, "uuid": "dd59f4b3-82f1-4eaf-a72a-c1f9f085fab4", "value": "3865ca37561d2aa29b9e83d3d87488fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777900, "uuid": "e7bf2ea3-8881-450c-bc57-1295f27b2fa0", "value": "6144:zoJNEeJ6SRdRoP8TshzdHJb3iqTeaLaA3SR7OoEAZx9Ih6mf:zwNEeTRojddx5yyawAlHA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686777900, "uuid": "e59c05d9-601b-4b05-8ea8-03eb909256df", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686777900, "uuid": "c2108c22-1ad1-49ea-9d3e-3aee56170cc9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777900, "uuid": "55ebd4dd-ef87-4a2b-aecc-ffbec1207da1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42e36e4f-0a6e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686717917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717917, "uuid": "daff1536-d3c6-49f3-97c0-56a4523a3bfd", "comment": "Malware payload (Mirai)", "value": "17fa0c267caf18e6beca6070df758537", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717917, "uuid": "c2894c25-0f06-4722-a1c4-ff724688d9bd", "comment": "Malware payload (Mirai)", "value": "c911ee9805dd181ea880cbe57af069672ba71115be9d908e991f2ad420d28dd3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717917, "uuid": "c38a41c5-3b8a-4655-8406-ee8e51fd7032", "comment": "Malware payload (Mirai)", "value": "529d20f77a9a706504b3c9bf96694c63c67731e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717917, "uuid": "e41a3df4-33d4-4cf9-b0b6-44b56f640eea", "comment": "Malware payload (Mirai)", "value": "11f18b980fc526f8148e122d933b0a5af966a47822c28c39d7ac7655760308bf1cf2202f4174e58acd3f9993f6125d6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717917, "uuid": "4a678feb-fd18-470a-a182-1a58c1440355", "value": "T18E330861B8936A1BC6D0237ABAAE558D332063E8D2CF3217CD601B147BCA51F0D67F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717917, "uuid": "cd3d60bd-d6b0-4da9-b7dd-0499e37159bc", "value": "1536:VvmyehDi86b9vUwmkaqXDBnw46Ioh+kWIs:VvmyehmYV46hhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717917, "uuid": "833a0603-3256-4153-b07d-8bbcaf10f6ea", "value": 54648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717917, "uuid": "a5316b06-12d0-4d24-8a05-7042442e8177", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717917, "uuid": "f09c7b14-4394-4397-b76f-a80d8b65389d", "value": "17fa0c267caf18e6beca6070df758537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818e716d-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686750664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750664, "uuid": "d1ce343f-d3ae-4003-8dcf-e048b1d29f0e", "comment": "Malware payload (Amadey)", "value": "6ca50bf910461fd129d42be9af772291", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750664, "uuid": "100fa87f-8fdf-4250-891d-8e3eba88601f", "comment": "Malware payload (Amadey)", "value": "c9573d921e1d9900df59d51dc2005098eeb17fc4334ea98a52f49e7b35d86a98", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750664, "uuid": "8bcc3611-3110-4e98-8bea-0eac25bbd3a5", "comment": "Malware payload (Amadey)", "value": "77c5c7fab63d73f387d9189de71323df24981421", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750664, "uuid": "0924f438-b3fc-4af9-ba98-a642412fcce7", "comment": "Malware payload (Amadey)", "value": "01b2aa28f697a98e19ece88046e6d3bf6c4fb69312b6a8c10ced0a53657a6b114f8dc9119125a8977a126ddd328fa8d8", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750664, "uuid": "8ebb1b9b-8037-4583-939b-873f5c9e6378", "value": "T18FF41213B7D98072C9B627B054F617932E367CB19DB8866B33C6845E1D3364898707AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750664, "uuid": "a4eb6ab9-5593-42c6-bd61-3ef377920735", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750664, "uuid": "c4d9a8ce-3834-4a3e-bccf-15391dd2fb55", "value": "12288:pMrhy90wMk59drHkcqkwiMxe+aGlmOzromulRX86FKt4l5tEewJO/U6GXN:0yEk5otk/ue+aGlmmrgXat4AJO/EXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750664, "uuid": "3235f3bf-b706-4111-9dcf-b4f592667b53", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750664, "uuid": "a0ae8841-d175-483f-9c1f-8dc1be3909b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750664, "uuid": "b27a9493-c4f2-467c-8da3-ba656b178143", "value": "6ca50bf910461fd129d42be9af772291.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89321769-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725766, "uuid": "a5790d9b-c5e1-450a-8458-95cb489ad207", "comment": "Malware payload (Quakbot)", "value": "7b331e70ff9dd34169e4f2a643310736", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725766, "uuid": "6dfe8b2e-f86a-43df-88c3-5939db619563", "comment": "Malware payload (Quakbot)", "value": "c9f9c016085e20f6f3cc4ce1a2be8de531b3784c2aed172fd0f3c28b13206034", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725766, "uuid": "3fb94ad8-20a3-453c-a5ce-7559cf7e41b6", "comment": "Malware payload (Quakbot)", "value": "6aaf580fe8b8b0fa0aa225dcabe985ee27ac2cfb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725766, "uuid": "a53862b7-7d39-429e-9208-cbef589ca192", "comment": "Malware payload (Quakbot)", "value": "d106f5e0851f90e07c171d356899e1d6f281c1613a601123573ec40bd5611fb13a4278f541b686137cd293fd309bed13", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725766, "uuid": "5a6a5535-f237-4a93-919c-e2a2c49f580f", "value": "T1DB6444896A41E0E09037F377DA579414FA671F6B21848933B97C505C2F3D829AEB7F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725766, "uuid": "5e153109-0742-49b1-a197-84cdf3347f87", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb+9sOzJih96c3iu3hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725766, "uuid": "156966ea-0893-4d24-b86c-ab6321eab22d", "value": 317969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725766, "uuid": "161666d2-ba93-4cf3-9eda-aaad81cb8566", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725766, "uuid": "43d0a44d-cfc0-4a0d-855d-6c70f52e2461", "value": "ksNQG9YYRS6bQ2.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "866dffd2-0a72-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686719749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719749, "uuid": "e7ad540d-4878-403c-9d29-edc04f5809ec", "comment": "Malware payload (RemcosRAT)", "value": "00315c2a7b00cae87e4db97557a184c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719749, "uuid": "8d74971c-e79e-421e-8979-af08bea8b798", "comment": "Malware payload (RemcosRAT)", "value": "ca19795538ded5ca26ae167d5417cc200d51ff7738e36695fbb05b305dbc15b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719749, "uuid": "832e2baf-d23e-4345-943f-acb2f230ac45", "comment": "Malware payload (RemcosRAT)", "value": "cb98858c7cd1ccdab8e185bc5982c6060d75f5bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719749, "uuid": "1fcf4eef-e0bc-436b-a739-e7953e45743a", "comment": "Malware payload (RemcosRAT)", "value": "09985a5eed560dca7cfd6ec2b7871ab0c9fafb6cfb41f329c1bec0246d85284acf198bd58772140746a27d0b3067da21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719749, "uuid": "6a7a2362-1094-40f8-8ef2-fe2ee1d385b0", "value": "T1E635F181723E2A63EABE8BF90250527087F62F5BA65DE3D55CC6B0DB52F0F404641E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719749, "uuid": "c7ed1fe7-d187-4f3e-8f1d-b26571123f51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719749, "uuid": "982cc465-68c2-46c4-84c1-5ecdd7cea9d7", "value": "24576:z+4qXdVwviFxwyu06IGXD/tuZGeW7NXpyRxTunF6XiYROic:y4qXsQxwx0XED1IfWyRuF8i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686719749, "uuid": "f259b9a6-deae-45c7-a275-5fd893b2b50b", "value": 1126400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686719749, "uuid": "c5580c2d-e383-4d96-9a2e-bc484369d8bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719749, "uuid": "fa46de51-1691-4655-b604-51fb2c71a849", "value": "00315c2a7b00cae87e4db97557a184c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b899ac6-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728723, "uuid": "c125ddde-b432-46fa-8d57-16889ba21748", "comment": "Malware payload (Quakbot)", "value": "d9ee26a91cc2fbd05be68044a102f89a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728723, "uuid": "255213aa-b87a-472b-bcc9-d9d67bd072be", "comment": "Malware payload (Quakbot)", "value": "cb3e1f933184aa926916c16ca694a0999fe40084d1e5c337e8701a14e1945398", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728723, "uuid": "442fd555-90e7-4eeb-a07d-cf8963bc075e", "comment": "Malware payload (Quakbot)", "value": "003aaa003f7db6c14c283d6eb7c3e73be374e02e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728723, "uuid": "e837a445-8df9-4c98-941f-81eaed85ebfd", "comment": "Malware payload (Quakbot)", "value": "f0f672c94cefadd2d284b9029afb722f6861dea1347346bded8db9e3e905b722859d937d44089b7b22da967c1cb6cc45", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728723, "uuid": "4c68ae44-894d-4ae0-a97e-8bb3911ff3d4", "value": "T1B16442896A55E0F19237F33BDA574410FA6B0F5B1184C972BA3C505D2F3D8286AB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728723, "uuid": "0e43c93f-1041-47c9-bc4e-95cd9191aa20", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbCpcb6i3BoIxChS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728723, "uuid": "cf62ea0a-4554-41c1-8c79-98d4146589d3", "value": 321473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728723, "uuid": "548ff8e2-e13f-440e-a0d1-b6212e825d6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728723, "uuid": "0c055e78-51aa-4e61-a250-f02971dca0ca", "value": "R6A0y0i9F6qERK.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b79e066b-0aa9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686743454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743454, "uuid": "6f0dfba8-8fd3-4e39-b599-b4178d7131f4", "comment": "Malware payload (Amadey)", "value": "79424ee3d77eb872d3f21c0b0b418a89", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743454, "uuid": "f13a29ed-79f3-4384-8f73-d92fa1914f55", "comment": "Malware payload (Amadey)", "value": "cc3ae4058cbe1d45ce6c9d8c4cde0a2bdabf60143efb4e534268bcb4d3c4d56c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743454, "uuid": "25faae77-9109-4c2a-aaf3-cbc696258ec4", "comment": "Malware payload (Amadey)", "value": "d91bfa1cf34c69c0f4e1c4350072aaea4ddc7a00", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743454, "uuid": "7dfa2efe-eb5b-4d02-85a1-9ec66290cf44", "comment": "Malware payload (Amadey)", "value": "944cd2d8101718b80ddaae7439192e304ada14925726176dd66f649588088c7333c2092671c1b5cc2ea488087b913b4b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743454, "uuid": "72b5df55-8b21-49a9-9562-639e6dbac88e", "value": "T131F41207B7E85436E8B0377064F202C32B32BD915E78536B2B95A85E1CB3A94657236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743454, "uuid": "98270d42-0383-4c4c-b2e0-e32a56fc8a99", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743454, "uuid": "12b56b26-ce73-4d59-b63f-982c1f0d5c05", "value": "12288:IMrmy90rgtUw07s8B/XjWpIEKbbx3cxc3EUf4kWkQk25mvRjIRPnw3swo0:uyAIyXjttbCxc3dWbX6ZGnwcwj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686743454, "uuid": "91959560-e8de-4206-b037-d90fdb20fa84", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686743454, "uuid": "57a1359c-9b54-4549-b016-bfd8f58007fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743454, "uuid": "afb6a071-1003-4cdc-94fb-ceb41fbbaeb0", "value": "79424ee3d77eb872d3f21c0b0b418a89.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2694704f-0afc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686778859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686778859, "uuid": "f67b54fe-d015-408e-9a31-77c2a985563c", "comment": "Malware payload", "value": "ca03265e173066d45ba92e4a4774ec45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686778859, "uuid": "6dabc147-9acf-4053-86d1-fdd42ab978df", "comment": "Malware payload", "value": "cc8fa35d6827a4227d73c39d758ccec4a55dde4688abe6cad0062e92e133a9da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686778859, "uuid": "50cc0ef4-24e4-4355-a95f-49df76a8fa87", "comment": "Malware payload", "value": "aca7af3daacdd7544e7adba7b6d895db0cceb844", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686778859, "uuid": "84a98fa1-6cbb-446f-b823-c3c164b2a6af", "comment": "Malware payload", "value": "a271c16ee6bd5394409f260f4609ecc802e675148ec38ca3791938f028363b1d0f2212fc2e8260aa5decbaa4ecc6d0b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686778859, "uuid": "922db0e0-109a-4971-87f1-fc35cccbaf3d", "value": "T1FE54F11672F0D872D56657308D7ACAE56A6FF8121F34569B33481A2F0EB22E1CB37346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686778859, "uuid": "0462a056-8ca5-4bcb-9809-084c0acac8e5", "value": "3865ca37561d2aa29b9e83d3d87488fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686778859, "uuid": "ff49903b-ec2a-4727-a155-5ff996c04faf", "value": "6144:fbK+ng1UBarypu3GdbxpyPOb+tVfeizILUKhPy:fVngOB6gu2jYWCGDZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686778859, "uuid": "d5560952-53df-4e33-9fb8-bb0bc12aeac9", "value": 289792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686778859, "uuid": "6ae615d9-f8a6-4a7e-bb0d-60ec1f5cb083", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686778859, "uuid": "43948309-93e3-4617-a1c4-bc87efd8313a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2433584-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728493, "uuid": "fe8120f6-b70c-447a-a10d-ffc2a08c7cdd", "comment": "Malware payload (Quakbot)", "value": "85b1eea64d1e3db9bb31b7f05eb37809", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728493, "uuid": "e3fbab87-3ae9-4f99-bd33-2fcc89868229", "comment": "Malware payload (Quakbot)", "value": "ccca70bc38f9c4f8832482f515ab6bb37f2d6fc7e459cb5114768bf05f378f96", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728493, "uuid": "90deeadf-b562-462c-9d42-765330fab08e", "comment": "Malware payload (Quakbot)", "value": "50addb112aeec08c2a523f90982df922f7f85261", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728493, "uuid": "5f8fe437-889d-4a38-9655-fab73760f57d", "comment": "Malware payload (Quakbot)", "value": "db35b15db06a5ebb8c34d7dd471ded8dab6fc60813746decd155471aa762e400a691cc48329c79404c9e0dde1cd1673a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728493, "uuid": "2be67087-c26a-4607-b6a7-05e2be7bfb03", "value": "T16B6464896A41E0F09137B337DE579014FAAB1F1B20848972B97C51586F3D85C7ABBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728493, "uuid": "33079fc0-3f40-48a7-8dfd-0fc7ad9dc164", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbv1Uap6Fa0nj/HAj0vhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728493, "uuid": "676e81ee-f2fe-4aa9-9c69-ae1f9765d87e", "value": 324223, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728493, "uuid": "db596e7c-a10d-4a19-b822-dd9fa4be7df0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728493, "uuid": "627102f2-51b4-493b-9076-5b9c368aef38", "value": "UyVdZNG1VBF0.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "389c2557-0a73-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686720048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720048, "uuid": "bbc398b9-3a34-43f4-9a2a-e889c00448c2", "comment": "Malware payload (AgentTesla)", "value": "ae6f85c26fa500b5c13cb8775c1a5b22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720048, "uuid": "0ade1a2d-19c0-4c85-90ba-451db3a9693d", "comment": "Malware payload (AgentTesla)", "value": "cd45acb8d6995389a4667133e25d150f6f62e5dac5bed0f6f043d40bb59488d4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720048, "uuid": "7078ab3e-d341-4d8a-a6a9-774dd0b8eaeb", "comment": "Malware payload (AgentTesla)", "value": "444e86364bfb2f77dbb23fe4ed52b2fdc4594599", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720048, "uuid": "da943c34-5b5a-409f-91fd-c4ef6ba6f0b2", "comment": "Malware payload (AgentTesla)", "value": "0caaf0c0131e242fa16c0b315631bf26d8df008617dedb124824559bd7b944f2d0f656e737f9420c6eb411dd6ff08b44", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720048, "uuid": "e61266fa-ec02-464d-a939-11577d07ea17", "value": "T1770551BD298036ABD7B5DD6241E2484BF23B772772135DA821E213C2872251F37ED94E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720048, "uuid": "6f7554e7-543a-43c9-9896-011faf1d937a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720048, "uuid": "af1000db-bf80-4796-b3fb-fc2056094b6c", "value": "6144:ROziM9rGXY5/59OGs7S7Tf5ELio/y5Osm2HcAh9kBEI8ii2n5MF2xf8VcOoHp:Ruvr35s7Ef6i6y5Eah9k/NnOoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686720048, "uuid": "09a6acee-f5af-4eda-ae91-5d2106221914", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686720048, "uuid": "903ff3f5-b4e1-4361-9226-166631fe406d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720048, "uuid": "2eb5a570-7a5c-4006-8a83-b093bae2366c", "value": "ae6f85c26fa500b5c13cb8775c1a5b22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49e1e89-0a96-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686735342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735342, "uuid": "66850d78-9567-4fea-9903-01bd306ba9bc", "comment": "Malware payload (Mirai)", "value": "55046d68cd63c26502b30cdf4b654ab1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735342, "uuid": "352ccdc9-7385-4da6-9cb5-0db0e3411228", "comment": "Malware payload (Mirai)", "value": "cd4efceb9b00353d482371fb4b1cbda37d40c90a6ba003b4e5175b473567a80e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735342, "uuid": "1796dea2-3fed-4efc-a27f-8abe7b02d6b4", "comment": "Malware payload (Mirai)", "value": "d53f7db17137f67c30b4c75fdbb1667a1b435702", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686735342, "uuid": "633e3c1e-ff1e-40d2-803f-c34d8c08c1f6", "comment": "Malware payload (Mirai)", "value": "33d8853c94730308b464c4e21dbe28d2405611c59f8c741a6ac9c27cc2f04f81f36e69927a02772d645e442cd66650b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735342, "uuid": "e303c043-5a53-424f-a132-b3de68cd0d4b", "value": "T1F9732956F9806B11D9D521BAFE0E014D339357BCE3EE72129D209B2537CAA6B0FB7502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735342, "uuid": "df095666-36a3-460f-b6eb-fe33456be1ae", "value": "1536:6+ngAY5vqg5boL5bm25BtA5XSA5E7dftccnA5CaeeSEY6jNillfiNKuBfEw8rY7J:TY5ig5kL5y25zA5iA5EFOCA5CaeeSEkS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686735342, "uuid": "005e1c83-5571-4f79-99d2-0d45d6c06d96", "value": 77212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686735342, "uuid": "3fcdd160-c70b-446c-afb6-c6bb41a898b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686735342, "uuid": "b2b4ff7a-d87c-4210-a63a-63629ef936da", "value": "55046d68cd63c26502b30cdf4b654ab1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "221c1603-0aec-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686771979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771979, "uuid": "6f755950-e7ab-45fb-946a-38bd708f5ebc", "comment": "Malware payload", "value": "956d79812c98bbb5f5ba609cba79d5ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771979, "uuid": "c522598b-0e09-48f5-809a-3dd20d45ee4d", "comment": "Malware payload", "value": "cda1ea0f3ee3f632981cad049258b5054acce691b98ceba725c14c6d9ff02077", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771979, "uuid": "ee48f981-6e19-49f3-921e-ff805d62a796", "comment": "Malware payload", "value": "4a062f2255a4514990ed20d382988bfc8a273e58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771979, "uuid": "3745a7ad-cc21-408a-8654-6f5d44551341", "comment": "Malware payload", "value": "f0ed25ffbf313dd1871764f2d0c57283cb7bf6336af1a86b3704bbfce4b9aa2f3f09fefecaa731c1a63fac998e8ee63b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771979, "uuid": "6807002c-57be-441b-bbe7-244cf5172ab0", "value": "T11B94127EC3E8A96DC3F68D743559CDC762E0EE97AC2655E28E808B780DD2CD5D11021E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771979, "uuid": "bf9646bf-41c1-4654-a066-f2dd1b2c2035", "value": "518b2345d494b1e80417ecf496968b80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771979, "uuid": "81656638-7297-444e-8d84-f2d0cdb0c290", "value": "6144:5aaOQpfmmD7GFvjzQDlfHVuo4j5sh9Mk3oiHwMeEdyB7IuqGNqVZnnB9paDpeVtt:5aaOWzqunIWroiHwffSuZNqVNnlIYVP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686771979, "uuid": "183cafca-21e5-4857-900e-cc73b6af741d", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686771979, "uuid": "f1c75327-b6bb-41fa-b16a-7c13b9192c73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771979, "uuid": "8e2e02cb-b76b-4666-80e1-ff6c9ec0c947", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6266e7c9-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728278, "uuid": "b998ed63-1ca2-4db8-87e2-48b9a76c6494", "comment": "Malware payload (Quakbot)", "value": "102c38ddb3bc1cae7fbf642676d7b94b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728278, "uuid": "df7290fa-481e-4653-ad43-80f98914fd5a", "comment": "Malware payload (Quakbot)", "value": "cea0787fe709eb7bd1f4572d915f64c70f3fb2d0467373885c3f452c7b7064f7", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728278, "uuid": "300b947a-3647-4dba-aeb0-844a04cf874d", "comment": "Malware payload (Quakbot)", "value": "894d9bf093eebe44c0ce219d22055ed7ab965453", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728278, "uuid": "167cabd2-368a-4aef-8fb7-d2bf7cdc6876", "comment": "Malware payload (Quakbot)", "value": "28b0af4c0bc6559934aa8d63e1563a64e4b51d62866056b9629c6514e8edb56f1308011b2c2e144996b1818083bec97a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728278, "uuid": "60114149-a5e3-4c60-90df-61d03b3a133f", "value": "T169843189AA55E0F18237B377CA174460F99B1E1B2084C972BA7C505D2F3D8297E77EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728278, "uuid": "67a1c269-bc70-4061-bd32-8124b757b6e0", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbse+N5odTxV/hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728278, "uuid": "fab12682-63b5-4d2b-8f70-8baee0293b89", "value": 374805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728278, "uuid": "328773e6-8735-4b2b-9307-69f1e10929dd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728278, "uuid": "8f89fefb-52a6-48df-92f9-d55bdc65fa4d", "value": "a4Shj8mMCjLAS9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af76a894-0ad9-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686764056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686764056, "uuid": "1f5857dd-6be2-4d40-b867-348afbfc1d75", "comment": "Malware payload (Formbook)", "value": "d140f0faa69e55f4a9b9856a0016aec3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686764056, "uuid": "40ef2f9f-7c33-4ddf-bc38-470afe2eed62", "comment": "Malware payload (Formbook)", "value": "ceda785eda517cb3617c767a40e724c114e61b24a571204277d5ee5c1bbfcab6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686764056, "uuid": "39c96bb8-bfd8-4ecf-890a-19b30c7e98f1", "comment": "Malware payload (Formbook)", "value": "9d86eb2cdb66665cdb3f46db8f26fd878ee0040f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686764056, "uuid": "9f623cbe-656d-4644-b85a-d42a44e4bb5d", "comment": "Malware payload (Formbook)", "value": "684d8f392c0d5171e88cb39313859c3cc9cfaa13ba206e08e608060b8893ebbf954c57e2b3b72b6a9dd01e3df848d42b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686764056, "uuid": "c799858d-f45a-44ce-940d-3816288d503f", "value": "T1D945E43D9CBD4237A674C6A6CF94B866F0A4D3B731121D39A8D35285861BD4B3AC313E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686764056, "uuid": "df3656b0-2797-4b1b-bf1a-c055280076a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686764056, "uuid": "547bf90f-5f9f-4bf1-895b-5bddb78afd8a", "value": "12288:w3gvzbj2nSvfR/ILoK7ZyQCIhSnJ04SKOAjDKefkduqqph/LR7lmYVhj:xvz2nSvJM7ZoIhASKfDKecAqqpRmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686764056, "uuid": "1fcf6b96-7365-4fb9-a73f-a1124ba251e2", "value": 1205760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686764056, "uuid": "23fbbc32-9ca5-4e6e-89b9-966ff14a65fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686764056, "uuid": "aa2acc4d-6d07-4163-a8f0-7b17eb0da652", "value": "SecuriteInfo.com.Heur.Variadic.A.410.1.30784.5786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d4532c-0af2-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686774650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774650, "uuid": "a93a54b5-7c7d-4faf-997c-70e9f5f637dc", "comment": "Malware payload (Mirai)", "value": "6a0c077a7725b5a26d3db0a13c09ab19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774650, "uuid": "a4184627-ffca-4bb4-8da0-42ca7d1fca6f", "comment": "Malware payload (Mirai)", "value": "cf7114000c6681b7841712824b8ec9ce3b16295e365732bbb9968cca792973b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774650, "uuid": "8a1c0a0c-11dd-49d0-8082-7a78dda9b900", "comment": "Malware payload (Mirai)", "value": "683e82ab0c3c3dd099091eadc305c78f02d4569e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774650, "uuid": "b4398238-5333-4940-a602-057981c79d30", "comment": "Malware payload (Mirai)", "value": "c8944ea941561c601649e18aa1c65cd9c05527d10f3a9ff0f4fe35063edad3dbfcffdccecc9b0d7300f3676f74dcf7ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774650, "uuid": "41c0f6e9-19c1-4cd5-bb0a-5a120cf3554c", "value": "T18C730756B8814B12C5D5127AFA2E128E332317FCE3DFB2129E206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774650, "uuid": "346c173e-56f8-4846-a7d2-d5d11a20ed25", "value": "1536:2ln25xPBXk1wnnkL7+KE007IURMqai90DIyiUNbsvHTGcV5GYIWQ:7xpXCMkM/PTaFNbsvHqcVERZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686774650, "uuid": "4d99c5b4-53c1-4f50-9305-ff01016d17d7", "value": 79160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686774650, "uuid": "2213099c-f1a4-4a32-8ef2-16b431d163fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774650, "uuid": "2e9b316e-2455-4524-9808-3447dea0139f", "value": "6a0c077a7725b5a26d3db0a13c09ab19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a2f94ad-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728372, "uuid": "fc588306-23f9-485e-902b-7419fabf1b65", "comment": "Malware payload (Quakbot)", "value": "3b4d15827663ca60cc4d5da20f1f0859", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728372, "uuid": "607b8f20-da98-4524-8907-ee43909ce23a", "comment": "Malware payload (Quakbot)", "value": "cf8bc1bbbf24b2b6024ac626ad92ac3a48f55307d7ac30029242f0c0cb1fa018", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728372, "uuid": "e62642df-b98e-4071-bc17-4d7fe08fe71e", "comment": "Malware payload (Quakbot)", "value": "dc501622741ad802ecd77400c6d7f1ffc3aefe1f", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728372, "uuid": "44e1449b-2495-4590-8d5d-58279dd427c1", "comment": "Malware payload (Quakbot)", "value": "444d98afccf35aac0beaae42424ab8821abaea4b98e01deb4cb6bcdb904d05556e9ccde7836afaf5c678d30491800380", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728372, "uuid": "ee1a1408-d405-4b41-bd00-d6f0c99e2b48", "value": "T13F7444856A45E0F19237B37BDA174050FB6B0E5B21849932B93C20586F3D85D7EFBE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728372, "uuid": "d9cbbce3-6069-42ba-97c9-e64b1fb47483", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbiKUE1XHo9TI2wWJyOm03UhW:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728372, "uuid": "bd7ed611-f913-41a4-b23f-bbcd717083f6", "value": 358888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728372, "uuid": "ea0aee7b-1331-4e31-b206-1e9a826facbc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728372, "uuid": "dbcdcf17-224f-41d2-b4d2-3b7fcee133db", "value": "XibV3kFdRqNzBI.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62a4b176-0a70-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686718830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718830, "uuid": "ec23fc0f-fbf7-49bd-a0d0-f0bb818c219d", "comment": "Malware payload (RedLineStealer)", "value": "81a5571b27d4a1da60507a8c66866cb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718830, "uuid": "5bc28242-5bf3-4fc8-b539-9095d473e8dc", "comment": "Malware payload (RedLineStealer)", "value": "cffcc7c49af3baf33816b69314f7b42d1504ac97835e4024836866a56dbacb82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718830, "uuid": "b9f87422-bbda-4482-bb49-4e42996848de", "comment": "Malware payload (RedLineStealer)", "value": "8e0a10b81c2baad4a28b5bd323118b92a6a1070a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718830, "uuid": "e9158bd1-8095-484e-b19e-67df886b4ff4", "comment": "Malware payload (RedLineStealer)", "value": "df606dbbd674b59d29f1a17b97cee1e2312421186ab122ea58fa578a5dfccaef0de0e26e0f9fa8b14a0dc30f7ad6e920", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718830, "uuid": "5350b0a7-8027-42f7-a276-b59604b26890", "value": "T146646DC0991CD231E2838472E87B4263960CE8767A54D7EF2F86A53CBA766D1CD54EC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718830, "uuid": "c69157c4-db55-4a33-a8cc-64f7b0cedda1", "value": "5b43169544844188711b217df61eb2d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718830, "uuid": "6b06d219-c634-41c0-83f8-fbd726b1bed8", "value": "6144:XlYALt9/jXSbAqY704pnH7hYx7oPG5RU0nCL:XZ9jXSbAqYTVYxPRU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686718830, "uuid": "92c18739-f3f9-4553-983f-bea538ab3fdb", "value": 326817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686718830, "uuid": "4b70089a-5e74-4f6f-9b0a-8d451c57f163", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718830, "uuid": "e4cb2d5c-39ca-403d-90cd-ecfc098eb5b6", "value": "81a5571b27d4a1da60507a8c66866cb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c2a3e1-0a91-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Neshta)", "timestamp": 1686733010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733010, "uuid": "a9640738-1c1a-4abd-a1b2-159a2c187bd6", "comment": "Malware payload (Neshta)", "value": "042938fb3342cf83d4336ed534f5aa92", "object_relation": "md5", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733010, "uuid": "981d40b6-32d2-49f2-89e3-93181169b34b", "comment": "Malware payload (Neshta)", "value": "d02f17228f28187d3a63ea2f68df1641e0136f5225fa49211a8ff8a5340a4744", "object_relation": "sha256", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733010, "uuid": "5073ee71-1fa8-41f3-b000-7766fc44e6d8", "comment": "Malware payload (Neshta)", "value": "38a465a7ff3eb4651f534e42bab25634666ef0ae", "object_relation": "sha1", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733010, "uuid": "da1ca848-4d5a-4ee4-ba32-77cec18ae5b7", "comment": "Malware payload (Neshta)", "value": "bc68f3de3b4625b67dd35e6f39fd573e792b4aa06935c792ffe9397fc18398dc08b97dc79c63aab9f77ae27e0eba2b0c", "object_relation": "sha3-384", "Tag": [ { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733010, "uuid": "e434b0eb-e6a5-4bde-8a1f-c63563e91dde", "value": "T1B1E4234D6AF03C5900AF6FF0D924375140EE8AE4D31DC1A7A88F0BB55876BC66A636E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733010, "uuid": "effcc100-b3a9-43fe-af59-0ebf3e563ca0", "value": "12288:t6REIGWDcLSikLt0FFFG70eeJ0AiLIPD9E9WBfMtwNvJK+s7lt+SzWYYG:7I4u/LuFkAjJ0pyzfMtwZ1SzfT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686733010, "uuid": "6a9247f9-89a0-4d78-9140-d87f8ddce637", "value": 667107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686733010, "uuid": "96d7f4a3-8b7c-4491-bf34-64dd4f3b8a32", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733010, "uuid": "ece7357c-1799-47f2-a253-2ef621a37efc", "value": "BANK FUNDED SLIP COPY.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308e20f9-0aa3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RustyStealer)", "timestamp": 1686740650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740650, "uuid": "153ea55a-5b70-4e14-813d-a59a3260e3d1", "comment": "Malware payload (RustyStealer)", "value": "cebcd84277e131975ebd903072edf22a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740650, "uuid": "91251347-8b74-4e87-a850-a44e72b22266", "comment": "Malware payload (RustyStealer)", "value": "d062bdb2a4de2e52231136a079dac4761a9011244f410c5ca180dd6d7d87eac3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740650, "uuid": "ba741b6b-ead9-46f1-8b2c-1cb81efafb60", "comment": "Malware payload (RustyStealer)", "value": "99fc63ce062b172053fd1ed0b77e5eb95cdef80f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740650, "uuid": "b0e05dea-c863-4fc0-b1d2-f01fea80ed5f", "comment": "Malware payload (RustyStealer)", "value": "bd9a24c56a08c2be6fedb9380c8eb32430a7e21f83661bd6d9f81b1b9cfa635bd4e95f5c04679ba7e62f3c05a9e6c921", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740650, "uuid": "775a2c0d-fade-4966-a9e0-e930c0602bc2", "value": "T17F66C61AA76D60D9C07FC078D2839F22BD213499073977F7899196692F20EF8AD3D364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740650, "uuid": "1da27284-029f-4fab-b3c8-fa1d0268f0f3", "value": "7ae1295b569753b39507c7d5f8e24e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740650, "uuid": "7f07721f-e537-417e-9e74-4d8bf67b5a41", "value": "49152:TV1fANUh22FjrW8Nxn0rlxWgCiTazFfWsmkwq1+OOOeSOctTCiNL/7oaCMGI6pau:cVgjuPLsVFh8Dn71kjUYV+l8sgA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686740650, "uuid": "5c24e272-3c51-402d-a837-2b35156bf31c", "value": 6939928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686740650, "uuid": "6bd138f1-bc75-4969-916b-3dffac35187c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740650, "uuid": "5d579f0e-a707-4392-b1f6-2728df6d66bc", "value": "d062bdb2a4de2e52231136a079dac4761a9011244f410c5ca180dd6d7d87eac3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9304014-0a85-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728075, "uuid": "1df0ecf6-d29e-4364-8f78-bb41eab5b2af", "comment": "Malware payload (Quakbot)", "value": "13c0c4dd397c3009ca11cc21b52e8854", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728075, "uuid": "0da3bd7b-9065-4d20-8323-14e282dfc794", "comment": "Malware payload (Quakbot)", "value": "d072ce279b63835641a7bff67341e69ec7878a73f9b5e4223969fdff81a0cb51", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728075, "uuid": "74a4893c-9871-4f41-84b3-b20866f0623c", "comment": "Malware payload (Quakbot)", "value": "5c543e8c0848e9c0041d78916b4805ea61e588db", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728075, "uuid": "063f9cc6-3443-48b7-9908-67a5fcf6fbc5", "comment": "Malware payload (Quakbot)", "value": "06ec4144b7a13b18a536d70a26a8da87e1e792de1da414fcf719b38fba90e3e698057b8e70fe5d5f0730b50104efe16d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728075, "uuid": "55a5254a-5acd-49cf-bb02-a6535fe04695", "value": "T17C7431856A44E0F19537B337DA574020FA6B1F1B20849936B97C60582F3D86D7EBBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728075, "uuid": "ab0e9ed4-d272-4905-92f0-017542ddac3a", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb2+69gj36kRNC5vOJhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728075, "uuid": "7c813f38-0d0d-4995-ab66-5266d32a200d", "value": 345713, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728075, "uuid": "967fe21b-7ee2-4623-9e96-07359215764e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728075, "uuid": "b19f19f1-3f0e-49df-8220-8d6580fb5cf5", "value": "fIvLxb10p6eX6W.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b200c6a-0a8c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686730843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686730843, "uuid": "95eb8476-efe4-4e2f-81fd-cf83bf053866", "comment": "Malware payload (RedLineStealer)", "value": "6280f27e6e704e8c0c37b36c461d6df2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686730843, "uuid": "5d2c0ac8-941e-4756-96ac-228f3a3abe18", "comment": "Malware payload (RedLineStealer)", "value": "d08d1d327dd5038d9add88ad817f073b024a206d0204c84a213e8fd9a7ee3aa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686730843, "uuid": "4ead9fde-bdb8-45d3-93ee-40a6e1e5ec6e", "comment": "Malware payload (RedLineStealer)", "value": "426fba6f8c233733d2b1b69aa35899c773893d64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686730843, "uuid": "4bc280e3-c44e-4eb5-b7f6-5451a14735ea", "comment": "Malware payload (RedLineStealer)", "value": "efcaf226f006e39b2b9972e294f223e931556a58577caaa3e4dcbfc1b4f614e464e2748715211a8b04cc26b027a0cff8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686730843, "uuid": "0d34239f-8c6c-4820-95ac-e30db5d0f5df", "value": "T154646DC0A91CD221E2838472E87B4263560CE8767A54C7EF2F89E57CBA766D1CD54EC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686730843, "uuid": "9fa21935-53e5-4462-8347-e8073ebf0ce1", "value": "5b43169544844188711b217df61eb2d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686730843, "uuid": "299bca65-07cf-4209-bbd7-b697853896b2", "value": "6144:25pQl+kuwDHFTqY704pnH7hYx7oPG5RU0nCi:24wXwDHpqYTVYxPRU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686730843, "uuid": "b0c9e303-2914-449a-bc0e-8dc685fe190e", "value": 325807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686730843, "uuid": "0df8e845-298c-4a7c-a6f6-bea09d2e1da6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686730843, "uuid": "102156c5-2182-4d17-9ea7-dd14069fc034", "value": "6280f27e6e704e8c0c37b36c461d6df2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169d499e-0a8a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686729869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686729869, "uuid": "f3844441-a524-4042-9c39-16195ce31b75", "comment": "Malware payload (AgentTesla)", "value": "6e4e9358322821e9c69fa70a7f1eebb9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686729869, "uuid": "0e06dc53-5dbf-470c-a154-18609a2bb984", "comment": "Malware payload (AgentTesla)", "value": "d1152b70f5918e5fcb1e0648d485d7ed5b06a2394bf182ff0a1049cabb04d065", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686729869, "uuid": "12db041c-a9cc-47e0-80f9-4de14fb9eb3c", "comment": "Malware payload (AgentTesla)", "value": "7f835b755ba442c3644686f822c16b9ac0ddd4aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686729869, "uuid": "d2921f57-4173-421b-b587-38be02be591f", "comment": "Malware payload (AgentTesla)", "value": "a6d6f8da7fda08d71645768e88eedb7526cf2d4e88c08a39661d4c92750d0702b5f0900756079e370bea885dc1be1966", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686729869, "uuid": "efbaddbd-2cee-464c-ba4b-55f5333e76a4", "value": "T17255A23E18BE123795B4C6A6CFE5886BF040EDB731226D39A4D77396433694229C713E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686729869, "uuid": "ad0c2251-5f46-456b-aa43-59e0f7120ec0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686729869, "uuid": "1b12c8eb-492b-41c0-bbb5-c304e9507184", "value": "12288:MqrExSjcPI40hXvNrJdLjN9/dF2KVLb1MfUZ:MVxSjrPhfdJNN91RpbefUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686729869, "uuid": "3c820993-70a3-4324-9c61-c38b49c5c383", "value": 1306624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686729869, "uuid": "8f1320c3-b187-4990-ad5f-e0a53a946217", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686729869, "uuid": "0408c4d3-24c1-4776-b4af-97a8c8a86557", "value": "PO2302841R2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bd04f35-0aa3-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RustyStealer)", "timestamp": 1686740642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740642, "uuid": "0adaa58e-3b0b-49df-acfe-a39d7ea4bb3e", "comment": "Malware payload (RustyStealer)", "value": "28dd76e16258464999267aab23351207", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740642, "uuid": "02a7bfc7-ae79-4e9a-a7b8-2e93fe74fde5", "comment": "Malware payload (RustyStealer)", "value": "d12b2c125a0093b2c51366fe2fbae47ac4c94932b03e2d8914a4f6e0f921d609", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740642, "uuid": "846bb1c4-1a55-4c18-925b-f35a5aa035cf", "comment": "Malware payload (RustyStealer)", "value": "d07db32a982eff440a13181e068cafcd741b556e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740642, "uuid": "e6a65bc7-af67-4bbe-8b5d-52a3fd46aea2", "comment": "Malware payload (RustyStealer)", "value": "a729dff1f368b9c4605f9340f3afe1b106e575a1686e065ab2f8da631adb04fc47ced87c6c8bfe0a1e159ab8e3baed5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740642, "uuid": "5cb7b9ea-ec19-4d48-86ea-79b842fd6a6c", "value": "T10A66C726672D60D9C07FC079E2838B62B9207C99573D77F74A90A6652E30EF86D3D318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740642, "uuid": "a277d24f-a2ae-4a4a-95b0-920e86cfb9b6", "value": "7ae1295b569753b39507c7d5f8e24e29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740642, "uuid": "ecd74ce0-420b-4883-9f03-b48df0811b1e", "value": "49152:+V1fANUh22FjrW8Nxn0rlxWgCiTazFfWsmkwq1+OOOeSOctTCiNL/7oaCMGI6pag:NVgjuPLsVFh8Dn7ykWUYV+l8sgA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686740642, "uuid": "af5c8a19-fa67-4213-8b7a-fd1b0563bc06", "value": 7020176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686740642, "uuid": "72baeeee-429c-4bbb-a056-1b859fb35659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740642, "uuid": "2b1f08fa-265c-4792-b1f9-0a6e0431543a", "value": "d12b2c125a0093b2c51366fe2fbae47ac4c94932b03e2d8914a4f6e0f921d609.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be03954-0a68-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AsyncRAT)", "timestamp": 1686715463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686715463, "uuid": "f33bd6e9-83e0-41e0-9009-428ffb6f832d", "comment": "Malware payload (AsyncRAT)", "value": "3dc64f540a2a9278e15cadf61d71369f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686715463, "uuid": "538f5e13-43ee-43a4-b6cf-863affcd942e", "comment": "Malware payload (AsyncRAT)", "value": "d12b75beda6b6b046c088d0ebe654632510deb36a600381c3391ce0cc108f8e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686715463, "uuid": "f058336d-45e7-4452-b1da-b1b36dcaaa22", "comment": "Malware payload (AsyncRAT)", "value": "c206509d0d0c99933cdfd76b90156c5c00363ea1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686715463, "uuid": "18b5a01b-7bb4-4b4d-b09d-dec2cdcd66f8", "comment": "Malware payload (AsyncRAT)", "value": "18033da9c1a12d209baf723097dba37097dadfda09cd534e14a1e1f88a300aae7de30a3f26effaed184cb6655305db9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686715463, "uuid": "f924ceb7-5a5f-4786-8d27-6ada9790d014", "value": "T1D5656D4BFF95AC05C8E806348C97724E63A0E84574FBA76F2C4DBB349E672834DE5621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686715463, "uuid": "5432aa69-813a-4650-9f48-b3eb25388641", "value": "6f543444487328d5966207cb412374d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686715463, "uuid": "23d7e256-0174-4874-a4b0-584fd6c16f5f", "value": "12288:wG+i1cTob5rpXuEq++p6xG5ssxODepysgSk9DyL1HUyIP9IylT8rhke6nuRs9U5U:wrkcG+p6U5U8ae6n+5s3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686715463, "uuid": "f571dbf0-5d13-4e2e-b349-3f34d3dfb49f", "value": 1545250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686715463, "uuid": "81564b99-2421-4485-abe6-857c8eae517a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686715463, "uuid": "e21c34aa-574f-4ad6-86a7-61caf62a38f1", "value": "3dc64f540a2a9278e15cadf61d71369f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cccf823a-0a95-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686734899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734899, "uuid": "044fe1a0-5122-430d-9997-7269389ce2fa", "comment": "Malware payload", "value": "675c65fe0a6c760dfc52d5e1bb2e545f", "object_relation": "md5", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734899, "uuid": "f124d9fb-2415-459a-b7c3-bde83fa8db44", "comment": "Malware payload", "value": "d1ae960fe1f1c51e0578cebdae1c5a6b87116014464a8db50ead5d197109b5b2", "object_relation": "sha256", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734899, "uuid": "d3119081-cea4-4c42-bda4-9183830c9a1a", "comment": "Malware payload", "value": "dd73750a05ee42aa36a05554b70e0492f316a6dc", "object_relation": "sha1", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734899, "uuid": "8a317a32-79ca-4fc4-a4f7-fe36cf118673", "comment": "Malware payload", "value": "c42ee9ccda65f26bb6dc9009095e6eb1eb478cae597907f81e7e7237fc3384cc5fac07ad5c075d09826cd730ff0be17a", "object_relation": "sha3-384", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "embedded", "colour": "#9129E0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734899, "uuid": "f9662a3e-544a-4ef7-959b-83d32700eed4", "value": "T1CDD3F114EE47867DC82D4B7C885849421BA5F3C87427E3CE2987359CEB27B425722B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734899, "uuid": "226ac58a-02de-4e1e-99c1-e5d3338909cd", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734899, "uuid": "f9a0b194-37bf-4675-92f9-8660e35312fb", "value": "3072:WuVOt8CzxigI999wGXQwfpPVTn6qLiJXLcUuO5KDHUHmh3+BY:9UxNInnT6XNLRBiU3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686734899, "uuid": "e3c1f60c-e945-4b04-94db-9ecad930bf1d", "value": 142848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686734899, "uuid": "f9ea2696-32a0-4dad-845e-c614667f0f79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734899, "uuid": "af497ae9-7231-464c-bf7f-26671f3e5014", "value": "sc0pe_carved_deobfuscated.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f140839b-0ac3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686754717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686754717, "uuid": "ef995cfa-c790-4c9f-b9f3-3bc4463512cd", "comment": "Malware payload", "value": "6b81580d98bbb401cb03001097c78247", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686754717, "uuid": "3c7d8977-d1b9-49a6-bbd9-fe9e031cb350", "comment": "Malware payload", "value": "d1ec1074825d3ab0ed836d501fdb29d92bcd04856c855635dae5658b4bd8e9ca", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686754717, "uuid": "d4319497-1a22-436f-a4a5-ce68b7f890ed", "comment": "Malware payload", "value": "f47c9dfa98b10dbb6c1df965283eab820161ab1b", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686754717, "uuid": "bb9ec6ae-5acf-40f3-8ea3-094986b8c5d6", "comment": "Malware payload", "value": "63f69b51492be8a9fc568748428f0f08ddac99aeae8160a45a5888e707681b4756cba511f6ba6c4d3fd168b084830a16", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686754717, "uuid": "55b3b334-34e5-49d0-8c71-9faef2f65758", "value": "T1FBB633EC4BB077DD49288F2E2DD3A556F2D3887B10C989076C1A9327EDA787C9E64443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686754717, "uuid": "1a4ae873-9ea7-41cd-a7a0-54ad309a9c77", "value": "196608:jckTATdbDH6lGd/E+ykGv4qETBK+57BH2bd8zhPsKJuc1KTZfoCCm:dTAT5Dal/xV4qETYEPsac5ZCm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686754717, "uuid": "7c478a33-7e4e-4fc0-b979-d2ace096071d", "value": 11308159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686754717, "uuid": "51f943f4-2420-4e09-a00a-6a10b2a2a016", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686754717, "uuid": "acf43e45-d680-4e0b-8ac8-63d495ac96b2", "value": "6b81580d98bbb401cb03001097c78247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c7608b6-0a67-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686714927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686714927, "uuid": "d1a88f78-7ec1-45f3-8709-f9a432081142", "comment": "Malware payload (RedLineStealer)", "value": "3a1e08e1d86173e7fea3acdae31b75bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686714927, "uuid": "8c64c1b4-a767-4638-9843-f044275a3ae6", "comment": "Malware payload (RedLineStealer)", "value": "d1f02c87243715c31c2483ba90d7ce9d8cb5135ac3b0212d142f804c950fa39d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686714927, "uuid": "ce014c73-3347-473e-b5de-bf3489b567e7", "comment": "Malware payload (RedLineStealer)", "value": "03a0fe18463dbaa348563171b51af6edf0186e0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686714927, "uuid": "89952eeb-60c7-4a35-bf98-5767c87b7438", "comment": "Malware payload (RedLineStealer)", "value": "3d0110f05662a07af0d32cd3d3c3621d136621c0f464b94af95d19154fcee3c3b5023d429c7a504c6697260aabee5b68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686714927, "uuid": "9000c9a3-bb24-4ff6-8ca8-d65af1b34e2b", "value": "T166646DC0A91CD231E2838472E87B4263560CE8767A54C7EF2F86A57CBA766D1CD54EC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686714927, "uuid": "e3ee9e4d-30f1-4926-8591-ee6da57342e0", "value": "5b43169544844188711b217df61eb2d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686714927, "uuid": "54015ede-ea54-4d65-a973-039fcbd30764", "value": "6144:Ayy7gACBnDV1qY704pnH7hYx7oPG5RU0nC7:aMjBnDvqYTVYxPRU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686714927, "uuid": "465b9b77-55d8-4950-9ff0-8722ac94e9ad", "value": 326309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686714927, "uuid": "e4bdd7ca-ac19-4211-b02e-640103784c21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686714927, "uuid": "ecb0626c-7812-498a-a4d8-ea5957e14462", "value": "3a1e08e1d86173e7fea3acdae31b75bf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "020e0e0e-0a81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725969, "uuid": "af978da1-0cc8-4069-ad68-1ab0ecf6f012", "comment": "Malware payload (Quakbot)", "value": "4b4b3cfb895798ec5e2b66a8bbbc1afa", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725969, "uuid": "3f197288-388b-4c9a-b6b6-850cb892fb39", "comment": "Malware payload (Quakbot)", "value": "d22f5c4537dee136e2c98cecbcc863ecac58821b8af9de42b98123b8e578451d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725969, "uuid": "8be7b7ae-5fac-4f02-9ef9-1b4144604ad4", "comment": "Malware payload (Quakbot)", "value": "4b12391d6011b3f222c16e6a5ec864187d8759bd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725969, "uuid": "f7ee34bf-4f00-4cc1-bfc1-c3302cd1b1e4", "comment": "Malware payload (Quakbot)", "value": "93123cd0d5b4c939bcde64778ddbf0beb9c111bffbce78b902047e78bc78709c667e635b145d084b8409685054af93e2", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725969, "uuid": "a4855770-6cd9-45d8-898b-c4fd254e8e70", "value": "T19B7442856A55E0F15337B37BCA178020FAAB0E5B2084C972B93C51592F3D86D7AB7EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725969, "uuid": "b71f7338-242f-4cbb-94f6-8b25449b3e75", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbkw4kefcCx1hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725969, "uuid": "b0e67983-5a34-4e47-9980-a919de4cf202", "value": 363207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725969, "uuid": "1d87e83a-075b-42d4-9f38-3e7fadf02c3f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725969, "uuid": "170e34aa-d6c0-44f8-8adb-0224fcbae102", "value": "glNkUO81BxIZO.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9caaf96a-0a5f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686711626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686711626, "uuid": "595b44f1-09dc-4160-9f3e-f6bdb0e08bc8", "comment": "Malware payload (Amadey)", "value": "1f01340a4938021fc1fc672ea925e7a0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686711626, "uuid": "64fa43e0-84df-4f92-9662-384e5d3acaf6", "comment": "Malware payload (Amadey)", "value": "d2449cc89ac83328aeafc33a6c83f6a79165d08db887bae12c80a7bc5ea50e8e", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686711626, "uuid": "d4fbbcdb-1d05-4b54-bec6-8d2763585e94", "comment": "Malware payload (Amadey)", "value": "18911f8d2278a1dc374d971bb9b7cfe267bfe635", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686711626, "uuid": "953a27c0-07d3-4e8e-9569-28031683be2d", "comment": "Malware payload (Amadey)", "value": "bdfe3735355c8775f2e0080156e7fd8cc59f0a6507f8739a9ac60870dd5e65aa21f4124ed18a81fcb46a405078e28c54", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686711626, "uuid": "2e1e5629-d234-49a0-af2b-1d2c11d608ad", "value": "T197051263AEE08032DAF91B700CF306D70F367C9698A883AB234455492D737E9857677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686711626, "uuid": "ce1d0041-8240-4d74-9b74-101d8255228b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686711626, "uuid": "31bfc2f9-e4d5-47ee-95e5-6a4cd84212c9", "value": "24576:8ynfDP/hqAqpj7+75rX+2QiCpdC8JLa2ba:rfD5qAOP+VkpppPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686711626, "uuid": "4e0d9846-2039-4936-9475-585e347603c0", "value": 796160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686711626, "uuid": "e6075b45-b570-4df0-a958-73ee8fd868b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686711626, "uuid": "d065e300-82c1-40f0-8ebd-d654e9594f70", "value": "1f01340a4938021fc1fc672ea925e7a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea7b3b7-0aca-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686757451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757451, "uuid": "7e105a4c-7923-455a-8600-5bfe7c09b5d1", "comment": "Malware payload (Mirai)", "value": "d645af50ecc9d552ec531773a272daf5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757451, "uuid": "f6effe05-8c10-4d9a-801a-194236d92578", "comment": "Malware payload (Mirai)", "value": "d27aa7a0a3e39e632d5d7e526260aed1724bafc3156f9cb909b7bdd03015a67e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757451, "uuid": "7286d4ae-4486-4bdc-a12d-25369a797e4c", "comment": "Malware payload (Mirai)", "value": "347d1da765f232c5409a0c35a8d327b7172c4519", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757451, "uuid": "755a7901-6c7d-49bd-9565-b56d2bd1157e", "comment": "Malware payload (Mirai)", "value": "7236690fc5078b577d61856bc1c8aae368c56ef048081fe03e29eb70b49233d41fe7ea9eec4fd3a85074ef03bc547b47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686757451, "uuid": "da64f35b-e8c8-4ea6-b903-53a6aa0defd6", "value": "T1BBD2E06DCFB50C0FEC0BE47FABAA4C54A17099112E8E8F5BA4E1DF9BC8420551E10B17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686757451, "uuid": "9cdd598a-58dc-43c6-9ddd-4d84b54ae8cc", "value": "384:MUJjEp647LjlybsfTyBw/8OA19+J4GdkTSRzaN1kAnWIrirNs6kISZkOklk+BK/B:wgb8yBw/83cSf2sN1kAnF2Rplk4Kou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686757451, "uuid": "30740600-84bf-4e43-b8cf-cdbd74ab36cd", "value": 28788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686757451, "uuid": "4d461183-c844-40e5-b564-b87714e231ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686757451, "uuid": "e7362c5d-4457-4d82-811c-a76302918f80", "value": "SecuriteInfo.com.Trojan.Linux.Mirai.WAS.27648.1253", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ff01580-0aca-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686757453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757453, "uuid": "d1d81768-fa1c-4466-812b-75f7d7a19643", "comment": "Malware payload (Mirai)", "value": "3f5b072c0ed5735049bce90f1a5d4aa3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757453, "uuid": "3aea5a67-bb3e-465c-a93d-8e6dbd34f711", "comment": "Malware payload (Mirai)", "value": "d2b3a0f81eaff9a3e2d93fcdf19672802d34000d0af2bbaeb40699a835c32b58", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757453, "uuid": "a7b99fc4-c342-488e-9db2-ef0c87c64620", "comment": "Malware payload (Mirai)", "value": "0cba50468e08ec4a3111ee9d13e3b7c487cb6d17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757453, "uuid": "54867710-f0b8-4d55-9eb2-4b68295448a0", "comment": "Malware payload (Mirai)", "value": "2bcf1a51283b98dbbe536d6717d15233fc083403428766cc50e2ea1fd1aaafbc2c81c27a2cf9451af406b87cd9bcacee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686757453, "uuid": "06cfaba0-6f13-4d19-9e32-27f412f1f8d5", "value": "T169E2D09FC2A574C1C6AE9C7CA4ED17B5DEA160C273EE564D13904CD8A03E34B39C896C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686757453, "uuid": "a4c24d5d-30cf-4471-9d1a-27378af887ea", "value": "768:I2/xIdKHx0HE13HND3PETSXZAs9+38ED5UWm:I2/O4R0q3N/ETMr9+sEl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686757453, "uuid": "b4883a33-bb45-4773-a49a-48e51d9ef96d", "value": 31352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686757453, "uuid": "d0fd27c9-520f-4b4c-ae27-77ec78a0f8d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686757453, "uuid": "0a78dfa8-7a6c-4912-8351-34e12879cd21", "value": "SecuriteInfo.com.Trojan.Linux.Generic.298061.17576.16198", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9f8cfd-0a94-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686734283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734283, "uuid": "c70e6867-a0b1-4d5f-b1d5-c4b53744eae8", "comment": "Malware payload (Formbook)", "value": "c4dda327f0195a7aa33a249f3c1088c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734283, "uuid": "85c4e9d3-880d-477e-9172-ba2129fa2276", "comment": "Malware payload (Formbook)", "value": "d2b52bb53b70d2c91072c917fec7a81ab9de2384eafd1abe8c66e85f5b3e85ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734283, "uuid": "c449077b-8fcf-4c87-8037-df14f65cdec7", "comment": "Malware payload (Formbook)", "value": "0e05197126826f024bb5dcdbcfac4333b71e7bd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734283, "uuid": "aa9988be-8cff-4497-85a7-ee37514e3dcd", "comment": "Malware payload (Formbook)", "value": "b7a072b654bdc8111931af071b6d9aee93f3e98eb6d7e769c0def3962c9c89cc1d8991218ca672e081d7668c28923e91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734283, "uuid": "237e124d-41d2-4650-9994-c284ec87da35", "value": "T125F4120DB69A4CB3CABD0AF8D04212B0C7F69156614AF7C52C9FB4F995E2F9C0C56983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734283, "uuid": "79f0ce85-e1f4-4152-a67e-39ea441dea19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734283, "uuid": "59d03bea-2de5-4e44-bc3a-fb0f7e7ef51d", "value": "12288:+S8dPpfZrtXyoxD47MDh1uq/ImveARH4UoQpEw7M+afPJg1yEXqXdV:4RpfZrNyG47g13zuU2Vfa1y4qXdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686734283, "uuid": "93355b57-b371-4aa9-8283-c95f79a1aedf", "value": 783872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686734283, "uuid": "6c5c4e2b-1e0f-44d5-b001-664c54e9aa43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734283, "uuid": "2de28459-e8c0-43e8-a0ed-db9808b8edd8", "value": "RFQ # 1045981 - MAA_D Plant Project r01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15302d06-0a85-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686727719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686727719, "uuid": "e1574d89-ed40-4fa4-a1c5-b3f518d9b032", "comment": "Malware payload (Formbook)", "value": "20de5124d4fd2061b8781d5a9c864678", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686727719, "uuid": "e48535f7-6c32-4b2a-a46d-d9b106739e5f", "comment": "Malware payload (Formbook)", "value": "d31d1deb82419ed17f21e9abde1c0614893f7beb9b2e7c1379a54caa5de0e0c8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686727719, "uuid": "454e32d1-96f9-4d1b-b775-ce23e9243017", "comment": "Malware payload (Formbook)", "value": "dfe03e467b383398fb9307173c724bc5ea0bb33b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686727719, "uuid": "e696163c-8c6c-42df-be87-ff5f4d95559b", "comment": "Malware payload (Formbook)", "value": "d7d20ce5b1f60c252bc15285375bdaccb76b6d06058ecbccf4d2ea4c1c93705b3b79a9f69567b6dce7757b4041e15e33", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686727719, "uuid": "ac5019d4-ffd9-47d2-a0d3-0442db525c39", "value": "T11EF42373019C3D1424AF9DAEBB24104BA700110B5E97674AF0C59FCD7A7CEA7AF249A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686727719, "uuid": "ca791fe2-862d-43ac-806e-3bef6af8a403", "value": "12288:LNGU99wuEnhhBuYYBnYBjiupvP+1CXKGtQ1iM4S/RH68vnzb9T2mGecX68X0J:LNPIDcBn9udTKGuD4S/RHdvzBTA9Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686727719, "uuid": "df3e2f70-2df7-4406-9bbf-25be9a2cc9d9", "value": 749172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686727719, "uuid": "37e486ea-637d-43bc-8e14-4c4ecbe87d4f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686727719, "uuid": "29c890c8-2942-4a25-8511-5dbab1c10be6", "value": "Enclosed (SOA).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d311837-0ac1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686753690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686753690, "uuid": "89739336-f73c-4929-9b3d-4beaeb05e9b2", "comment": "Malware payload (Amadey)", "value": "3d89aa8bd8e4aa13a1b9df79e8b31871", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686753690, "uuid": "2730d849-e783-415e-84f6-88952dee9862", "comment": "Malware payload (Amadey)", "value": "d31d9023153dcde6558323fbfdc50b6e9e669046300f1db0fec0dcaede214bb8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686753690, "uuid": "4da3a012-3462-402c-b1c9-40d9a9eda27b", "comment": "Malware payload (Amadey)", "value": "7011d0d2468a4a4d77fc0aa8c2a57e6bd536f093", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686753690, "uuid": "64de8a55-9742-49ed-839c-42e480714e10", "comment": "Malware payload (Amadey)", "value": "4f3367560fb7e2bc46eb3339b0133eee1f1e0b1e7e8aadeeed4f11c25e419b6a2d1e579d336cc78fdd07deee05e7776f", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686753690, "uuid": "8c73fbdf-eabb-4276-80f2-32b7fb7fed4e", "value": "T140D412A3A6DD0433DDB02B7058F213831A32BDA15AB8836B2395DC5F19B36849C7477B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686753690, "uuid": "6201d7bf-d84e-487b-ba3a-37c9f7ef7c2d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686753690, "uuid": "8ee119f0-49aa-46b1-a989-a2cc7c97ca88", "value": "12288:mMrEy90ZSO5bzm8eeH75+o4UkbYmkjIZ2RcUa0ku/rY:WysjuJo+okbH+xa03rY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686753690, "uuid": "98c4cced-c5b2-4980-a83a-1ba2ea4d44a6", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686753690, "uuid": "7f330286-c4d5-42c6-baf6-5a5816260dcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686753690, "uuid": "055ad6fc-01a3-4c5e-adc8-46518539dfbf", "value": "3d89aa8bd8e4aa13a1b9df79e8b31871.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656a1b25-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728283, "uuid": "a8208a15-ff34-4729-b106-e1e34e183e63", "comment": "Malware payload (Quakbot)", "value": "4602a513b4c0acbc45b4289be0244b2c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728283, "uuid": "13c0d808-4f09-4c0c-b1d6-3a1234501dfc", "comment": "Malware payload (Quakbot)", "value": "d3285c0043046241c65646df426a6895a0bd139cb071739971291db15a1e797e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728283, "uuid": "6faaa212-9ed9-4c96-b501-cbafd7a59a4d", "comment": "Malware payload (Quakbot)", "value": "2ceb97f8cbcd7128e838f735c10faf1974df97bc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728283, "uuid": "1871cc17-e6c7-4136-82c3-4cfaf2cd4956", "comment": "Malware payload (Quakbot)", "value": "7880cd5ab0d4e5d74b88ebcd79e2f41e2fde043f3bf259fd9e168c587bd83bbb1012b8ed97178fc605c8ecf7430832d4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728283, "uuid": "244ae75a-0f8e-4ced-8016-a1e1cfe632b3", "value": "T12E543289AA45F0F08137F37BCA5B9414F96B1F1B11848973B97C505C1F3E429AAB7E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728283, "uuid": "3979f023-a403-4700-a4f5-e58d8aa5d326", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbRgzc1hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728283, "uuid": "abb9a9ce-2470-4477-84f9-88441745d570", "value": 303732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728283, "uuid": "3b7a91e3-c110-4f46-87c6-62ab5806264a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728283, "uuid": "d401b6d7-a920-4c81-a52a-25998cb84056", "value": "ZzzXW4z9tSvd.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf516f8-0b0b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686785283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785283, "uuid": "a0c702d0-df6e-4e7f-8aa3-d421bf11ea22", "comment": "Malware payload", "value": "fa13868b0106777dfc197f28a0f601d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785283, "uuid": "5b32b478-1608-4133-85d2-62cc677eaa75", "comment": "Malware payload", "value": "d3b321e579b681f27358a5f6d07bd2f3fa39b10a33ad78f5cc53f22cf34c3e1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785283, "uuid": "1281d547-747c-4175-82b0-4e65d5feae64", "comment": "Malware payload", "value": "100781ab57a886deec3eb1edbe72f35b36f7203b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785283, "uuid": "03035e10-46bc-405b-9621-a842d84b7fd4", "comment": "Malware payload", "value": "441f73b124c8961b7e65cd27e07accefb09197920a62c9ba15867ad9685156defe76d443f11a8b3380c9e83659eb5c6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785283, "uuid": "8f99347b-7a5f-427c-911d-69a827f66646", "value": "T142D5022324A3B22AC1C2527A6F08C075D7E4CC14663AC92D66F1FE7B7B3D393059765A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785283, "uuid": "4ae23e63-52dd-4767-945c-0e1c36facf38", "value": "80417b621299e3e1de617305557a3c68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785283, "uuid": "a5c7f8b4-6ea5-48ff-8c5c-56ccb359bd58", "value": "49152:X6dPJkttttt1ttttt1tPqVFQttt7vum0GSXVI/TxybcPUHuRk0gfJ1JEvggBgUET:qdPJ8qVFYvumOFI/dWHvfJnegirOjJuY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686785283, "uuid": "92a3c0a4-5896-4e55-94d5-869f2103b891", "value": 2914410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686785283, "uuid": "780de35f-04f1-433a-8523-48e02875a34e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785283, "uuid": "39700541-e40d-404d-a0b5-1ba093714754", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0168a2-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728269, "uuid": "2edb4fd6-3ee9-4d27-86a3-6c0b4f3d3a7b", "comment": "Malware payload", "value": "c92e4f0d23a3ea9d1fe36d8562776fc2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728269, "uuid": "e7d36678-1d50-4257-bea9-6d2b60d8b4cd", "comment": "Malware payload", "value": "d3f7132a2ad6670bacbf9660f313c6c914fe09fc762a859e302bd75dc4a62bc3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728269, "uuid": "f65d9625-2928-4b5b-9701-51612e5bd6f4", "comment": "Malware payload", "value": "114d4db92400c28d3e9282bda0aade908fc39849", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728269, "uuid": "5facb0d7-519f-41a3-ada5-7c0a2efe06de", "comment": "Malware payload", "value": "b88fb3ca829e19f9008a36800445f55be0b68e5558cb3cc00f0fac55d5d6b3edc4d20f5b674daaa94f358376d9d411eb", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728269, "uuid": "889af5b1-3cbc-46e8-a3cd-2b79544da3d5", "value": "T1527443496A45E0E09437B337DA578010FBAB1F1B20848936B97C505D2F7D86D7EBBE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728269, "uuid": "701900f5-e314-4567-8c2b-221b3627bc3e", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb2hpql02/ahhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728269, "uuid": "ddd21254-7980-444c-ba44-bfa9db281c95", "value": 337766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728269, "uuid": "933eb037-5ed0-4688-b15a-92053fe079f7", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728269, "uuid": "7b8b784d-14db-4ea9-80cb-2cd4e0d4d6e0", "value": "a4YQ6UxZhsp5tr.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81006fe2-0a63-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686713297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686713297, "uuid": "4a3a8210-5b25-4193-b21d-829c7064ce74", "comment": "Malware payload (Loki)", "value": "c0bbbfe5e764f8067bac91a3cf45489a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686713297, "uuid": "6cec92c5-5f0f-43f0-b829-e80a4ea4c6dd", "comment": "Malware payload (Loki)", "value": "d4b09cfb630c5d4e123f5ea5076685911243496f62f489cf7a30479542096f35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686713297, "uuid": "c9bdd760-b9bb-48a3-befa-9961f45cf340", "comment": "Malware payload (Loki)", "value": "b66ef4d5d79b6f16ff354506348143aa25a711a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686713297, "uuid": "8dfe5a62-f6df-4b8b-a3f3-b71d67dfd673", "comment": "Malware payload (Loki)", "value": "7d1710db2656d6727db3dd9363c59cfb1aeacbdc6d7a562e3aa76a5afd28eeac404200e9ac23fae58262df4ff439b4a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686713297, "uuid": "2c0d6b83-99dc-4d7b-8486-ec03c2a33301", "value": "T1DBF4D081723E2A63EABE8BF50151227097F62E5F655DE7E84CC670EB52F0F404A41E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686713297, "uuid": "fdff7045-97ad-4f3d-94d9-22ff9b71ee8a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686713297, "uuid": "017ddce3-e21d-4cd3-9acd-d563f644e1d2", "value": "12288:7lKnuAEXqXdVu4gzzGqjVm0z95jRDmWqGekYS5vwBQvdLxlm:QR4qXdVzgzF9ZRYkYS2BQvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686713297, "uuid": "d3e64199-6554-4fa2-9f46-6092f3f5ca77", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686713297, "uuid": "f3dcc690-d59e-4e29-8361-ac073d406ac5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686713297, "uuid": "12d98bc8-29a7-4bc4-963d-170c32d53b5c", "value": "SecuriteInfo.com.Win32.PWSX-gen.32200.19599", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cee7443-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728376, "uuid": "063f647b-dc20-4212-a9f7-9be031273271", "comment": "Malware payload (Quakbot)", "value": "26f60b5a1986ac5eaeeb6b7a20e19043", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728376, "uuid": "2d6abf61-61c7-4864-b89b-448d0c2a00d2", "comment": "Malware payload (Quakbot)", "value": "d4fd807d3e0143d21c92c708cf9d6b19e0b421a31f9679f12fe34e0a7354633a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728376, "uuid": "31d51e61-6ca4-4959-99ca-da58b14e47c2", "comment": "Malware payload (Quakbot)", "value": "b6e13af16002bce83e42c9c163d1eb7e0643b4e1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728376, "uuid": "73c83ef2-af67-4747-abb4-80400024218c", "comment": "Malware payload (Quakbot)", "value": "20d840e86bcbe0fbae35da009655b45643169da8fd4bd795e6ed7600b463a166705bab687b2c72ccdbedeaa689b9b7d7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728376, "uuid": "568ec1ea-2812-4e61-9f8a-3d345b7ec320", "value": "T1195461896A41E0F09237F33BCA179414FA7B0E5F1184D963B97C50592F3D429AAB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728376, "uuid": "c98a3788-035d-4edb-bba9-d8eaaee69c07", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb9/KzLhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728376, "uuid": "f7d35445-59a8-4c3f-aa64-9fc6d6e31521", "value": 303051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728376, "uuid": "44458788-803e-44b1-a104-c3f108d318fb", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728376, "uuid": "4a115eb5-38d4-491a-ab3b-49810284ddb0", "value": "XoFVsk1JDhquTv.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d324ae-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728413, "uuid": "0f9b0320-b355-4398-988f-8136735f48df", "comment": "Malware payload (Quakbot)", "value": "ffdd959d455d516f841102d5f0ef474d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728413, "uuid": "e281a69b-64f6-4f02-97a7-0fa57295db60", "comment": "Malware payload (Quakbot)", "value": "d5799679892f2d41682602153ef3a6cb8606cc55b642e23e1d0074acdebf324f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728413, "uuid": "103af580-ee37-4d00-bdcb-872d6593c82b", "comment": "Malware payload (Quakbot)", "value": "55b4e35a2ebee7d84ec0c5085c72e9f8a04ad7a7", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728413, "uuid": "615df3bf-851a-421b-9820-c073c9b81128", "comment": "Malware payload (Quakbot)", "value": "f005e1f045d4e1e38e2b728094370912e95bf44a5195de498b49611abcd926f7fd1240ec5a2352719b5a6a34628e1a56", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728413, "uuid": "44f82d85-61b9-4b60-bf21-a251441da618", "value": "T14E7455856645E0F18237B33BDE175010FAAB1E5B20C48972B93C51586F3D8697EBBEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728413, "uuid": "8b4691e2-13a1-4782-8403-8cba9410ce60", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb93d8IZA7OhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728413, "uuid": "23772e44-d5f3-495c-b26a-ae948c4d6eac", "value": 348019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728413, "uuid": "11b93bfe-6fd5-4579-8d9b-4c75411b022a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728413, "uuid": "2527b076-c43e-4536-9c72-ef0b569f39e0", "value": "W2I4jd9Ysv5XC9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9307df-0a90-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686732647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732647, "uuid": "2b50a244-dafb-44ec-993d-a44fd7fd20c9", "comment": "Malware payload (Amadey)", "value": "82dde56895651274c9d7b4e8cf330c63", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732647, "uuid": "b44c56f1-9bd7-4efe-b114-04006f0fd2bb", "comment": "Malware payload (Amadey)", "value": "d57fca240eec9c47a1fd8e7cd9321e21fa8d373b6d35c12571b5bf4665e8d9df", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732647, "uuid": "bf141fa9-ce14-4ef3-8e63-d77e85369d9d", "comment": "Malware payload (Amadey)", "value": "5eac1aae9da8eb589b15cc5001126c938bef097a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732647, "uuid": "c307718b-058c-4f1d-aac5-f28a5c79990e", "comment": "Malware payload (Amadey)", "value": "81d71c57cf9da98b4ca00607ae210b17ca75b5ff5d7d9253046a73d8ace3b283f6fc3019dae5997f6bdccdd61f0b30df", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732647, "uuid": "346a21b6-34f6-4374-a083-a6b28e7f0945", "value": "T14FF42302E2E8813BDCB62BB008F612D30B397CDAAD7493562759DD5A0E725C4B57273B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732647, "uuid": "2d35ab43-50b7-4119-9c97-30639e6cb786", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732647, "uuid": "b9b991af-5f1c-4d92-868f-d8ab6a20c028", "value": "12288:RMrxy904Y+mS8i8eywGQWMJ1VsNHoDCu0DORXpUib+58FW74WgMXUl:syll8i7HWMJ8NHru0NiC8o74rl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686732647, "uuid": "fd1dd6a7-923b-461c-ae05-a26b91dd5282", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686732647, "uuid": "7ec64256-38f8-42cc-9520-e15af208c43f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732647, "uuid": "44bb7783-cb16-445f-9e79-0718d9ef816a", "value": "82dde56895651274c9d7b4e8cf330c63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7336af7e-0a8e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686731742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731742, "uuid": "5cc7e610-6938-4a69-bf28-75105e0687f5", "comment": "Malware payload (RedLineStealer)", "value": "3121e7efe32c203433e71035d9e82bb3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731742, "uuid": "d4aa1448-bb57-4251-8f97-425ef9656610", "comment": "Malware payload (RedLineStealer)", "value": "d5a73bf70142fca50a74f6a295e2a09dd2396692ebb03e0733f33a9485d7a3c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731742, "uuid": "ce035672-ae2d-45cf-a673-9c579ea312b9", "comment": "Malware payload (RedLineStealer)", "value": "0a4993d9b3441e304e8f8f44877614ba27e6ce99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731742, "uuid": "e76a1a71-71f5-4e60-a17d-0272260891e2", "comment": "Malware payload (RedLineStealer)", "value": "c932e5d32d4a287e9b452f8fea779e818812ae68d4847791823bf718955c913502fd5ab07457d677bf8f8934f4e287e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731742, "uuid": "a92eef1d-9395-4ab4-b1e8-3376d83b77bb", "value": "T107F42253A6E89472CCF17BB018FA12D70A36BD52497883662B564C1E4CB3AC99D3472F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731742, "uuid": "f9a3519b-a386-4376-97e0-1f7f6004ef04", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731742, "uuid": "32ef707f-d77e-46da-a2ff-bc0ceb841b5f", "value": "24576:Xy6k1t1FMHyjwYsQVzJsLKBnxzln6pQy3d:iJt7MmVdHBnxp6pZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686731742, "uuid": "e7e6e85f-732b-45bb-b889-fe55c288f400", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686731742, "uuid": "e7eb8027-29ef-44ba-8a65-48dda3cce39c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731742, "uuid": "5e8db45c-e4fb-4b54-986e-9fa0719d1335", "value": "3121e7efe32c203433e71035d9e82bb3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b12ebd4-0abf-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686752855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752855, "uuid": "3ddcb783-2c52-4706-812d-7a08765212b3", "comment": "Malware payload", "value": "c1e33b70997fd6e8112dc14a0f2b056e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752855, "uuid": "2efb8613-3b48-4441-a699-f170b1716bce", "comment": "Malware payload", "value": "d5a99c1554182e7057212eee6d9fd443c16483fcdb973ae6dbc28af067eb13c0", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752855, "uuid": "71846a83-ccff-4435-9855-27d3232e8c28", "comment": "Malware payload", "value": "a1666e38dab18082037b4e1f0e31c44f81a40339", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752855, "uuid": "b859a953-51b9-4b49-ba25-413d74bc4c6e", "comment": "Malware payload", "value": "754bbdb09882d1c23b253a20fb0607b99a93e3ea1884d958b7db74983c9350569688a3e3e0a0202ca5cea60fb6b071b0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752855, "uuid": "285a6e85-2d69-439f-b24d-031a63e25f0e", "value": "T140047091BA27ECA7E920067076B5F22311466F23BC148E5526D3F21E53F3B907C79D8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752855, "uuid": "0577244b-82ca-42ed-862d-ed26fe680596", "value": "3072:ukZ+RwPONXoRjDhIcp0fDlaGGx+cL26nApSXN2+lGWg25LXJnkstObyt+ufZE4YY:rZ+RwPONXoRjDhIcp0fDlavx+W26nA4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752855, "uuid": "72244537-a130-462b-b88d-98dccf157ce6", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752855, "uuid": "677aa2be-6e1b-412a-9f11-f00f509a51f2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752855, "uuid": "d73c5c29-1162-402f-af0f-3452e2a3d39b", "value": "INVOICE.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45cfe6f5-0a83-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686726942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726942, "uuid": "0d3952ce-6273-442e-af8c-24a5ecfadd2a", "comment": "Malware payload (Amadey)", "value": "0c1086d43eb4fae7e87126cc1f18b62d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726942, "uuid": "a3696b41-d981-4aa1-a682-933167743116", "comment": "Malware payload (Amadey)", "value": "d5b4bed39cba6b77d04777204e379cd097596e0cbb99da9d1f1f59804ec2f909", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726942, "uuid": "ff00c6bb-4b05-4213-bb78-61223ebaa967", "comment": "Malware payload (Amadey)", "value": "a63853f484649468e5100a23f162355aa39f2c08", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726942, "uuid": "7f53dcf7-172d-4b92-98b3-7735add06c8b", "comment": "Malware payload (Amadey)", "value": "3bbad258b7bd74efb607be7f5f26e843850fb20fb11cd98e00aec5005288f5903633aab224d0a6ae5a329077e79fc070", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726942, "uuid": "9c194e7c-4fbf-4142-9d5a-1927aac5a47f", "value": "T1C3D41243ABF44123DDF927B018F603931B367CA11874666B2B97AC5A0CB27C8A53577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726942, "uuid": "bedb6b5a-3d7c-4ec9-a994-3e09b728064a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726942, "uuid": "613583f7-a175-47fa-a9ca-fb3c8fbc5841", "value": "12288:+MrPy907eo5OVN2zUIXgNF1C0Y312az42HjZ82G5w9Px8B6+IkL:pyIp4IXgv1RYsaz5H2ex8Avk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686726942, "uuid": "98c80761-20da-46da-9cb9-5193df47f4f0", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686726942, "uuid": "98c69df3-5584-4c4b-8cc2-2a412ee8e560", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726942, "uuid": "8c8332a3-2fe2-44fd-ac60-beb4c8744582", "value": "0c1086d43eb4fae7e87126cc1f18b62d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01821ce4-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728116, "uuid": "4c968a19-deff-41eb-b8de-7537fb036cd5", "comment": "Malware payload (Quakbot)", "value": "c3da67a3294b8f2194156bf1cd682277", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728116, "uuid": "51aa1958-17ef-4d96-a1b6-66105c813dca", "comment": "Malware payload (Quakbot)", "value": "d663d679bcae514fe5d4491ad3b4e9a365452cc2b786b59a66c8ff9f72d7b239", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728116, "uuid": "9b0645b1-a6c4-497f-ab3e-ea0fe8b99ff0", "comment": "Malware payload (Quakbot)", "value": "d9f3453f35628425296154995f7474cd361e9eaa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728116, "uuid": "c2bdde92-ae98-4b92-b13b-4756dd746958", "comment": "Malware payload (Quakbot)", "value": "2bdb1a6e877ec98ef3f63011da1c152b6e2da9e5243b068d13901133adcb0902f6f4b25fe6d570c1c0a16c122c7a1d32", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728116, "uuid": "85ccdd9c-17ff-48b8-aee9-09e080070801", "value": "T19C6454496A44E0F49137F337CA5B8410FAB71F1B11848972B97C50582F3E85DBABBE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728116, "uuid": "e837f0ae-2034-4f0b-a2d3-0812c23416ee", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbLYtF3kPpchS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728116, "uuid": "d89f1ae6-1f1b-43b1-9123-9a1a20cc5474", "value": 307278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728116, "uuid": "1289ceda-3513-4edf-b8f5-8706857a2669", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728116, "uuid": "c2c07f87-376b-48ea-b04b-34c25f7ff1d9", "value": "eJqlMA8QDkdu5g.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e313c0d5-0a81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RemcosRAT)", "timestamp": 1686726347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726347, "uuid": "e571aa61-6ebc-4c6e-ac38-56fd2cbd81b8", "comment": "Malware payload (RemcosRAT)", "value": "871fcfc6331a00d95efd8f316c6a6678", "object_relation": "md5", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726347, "uuid": "2754cb09-5036-4480-a34a-8b8f33ab74b0", "comment": "Malware payload (RemcosRAT)", "value": "d7cd222fe17908136bd47d0f60d4f01dd5c9f1affdab9e7ed9b8bedaee26b636", "object_relation": "sha256", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726347, "uuid": "e769290a-9721-45c7-a65a-795eb188ae93", "comment": "Malware payload (RemcosRAT)", "value": "9a4ab96a7dc7690e9592041305857c5ab44a7860", "object_relation": "sha1", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726347, "uuid": "ded0e6b4-d01f-4401-b4a5-22656689b6bb", "comment": "Malware payload (RemcosRAT)", "value": "1837bef95e0ec864429968ccff428cec06d33dbe48f5067793d3aa2478c46bb53bf8dbfe9a807a9edb615dc576d1a512", "object_relation": "sha3-384", "Tag": [ { "name": "r01", "colour": "#68AAA3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726347, "uuid": "c1cf9432-febf-4bbc-a5a2-e4768cb67f03", "value": "T17D25333ABC9BD2AB465358F2B86D4354009625D84BFB62F8C2578CFBF041B150E9EF90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726347, "uuid": "f9258e7b-43c5-4cca-8250-c232f501c6de", "value": "24576:hXycMDFaX1kIuuvjdi+fy/GTZYwf0BAn3oB9u5JsvFou8Tx:hXycMDFaX1kIuojYn/UZYwfN3oBg5Jss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686726347, "uuid": "801e9858-2503-4d18-9fd0-4a35b770487c", "value": 1037815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686726347, "uuid": "02d9cdd2-d0e7-488b-9d58-424cdd9e0863", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726347, "uuid": "28d66365-ff58-44ce-ad53-b50695b16a3d", "value": "Camscanner_2023_0029020.r01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178d8892-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728153, "uuid": "39f023c6-4c1d-4c55-bb2d-042b252723ea", "comment": "Malware payload", "value": "94e26873efca42c7c252ad0514398795", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728153, "uuid": "be56aae6-a713-4343-8c0a-ef8a17c5f410", "comment": "Malware payload", "value": "d7f93c007acdb729ac24d4761820b3ced62648e526e6371d353be39c663d6649", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728153, "uuid": "1cc084e1-92d0-4e62-929a-c6af35719abc", "comment": "Malware payload", "value": "e76007a0267a0c3c7f4b9fdd4f59efc18095a34b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728153, "uuid": "883d9375-cdd9-4a0e-916f-a48b10c25813", "comment": "Malware payload", "value": "c876b89de798c93dc09a039b4542cb2b1e4d01546eea2803b69a12fe75a42fa925750c0d1e9936af6989355cc63bfa33", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728153, "uuid": "4972d43c-98d7-4839-b41e-c87b17fe6e21", "value": "T139744244A644E0F09237B33BCE568410FAAB0E5B1084DA36B97C556C6F3D8597EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728153, "uuid": "47ffea34-de89-459a-98f5-2e53bfde0264", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb2zembqUzz3puAXQqhxSSgZx:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728153, "uuid": "616f02c0-8b6e-4088-adda-c1aaa782ffc8", "value": 352116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728153, "uuid": "b028f957-8b55-49dc-9f81-4449e3f54eb6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728153, "uuid": "28d72bec-514b-426c-af30-837a7150458c", "value": "dCVnKJl4WLdNs.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9e2938-0a6d-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686717751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717751, "uuid": "81d936a5-364e-48e6-9d94-3ac455f0c19b", "comment": "Malware payload", "value": "5a260500cb0d00d4d057383b2048dfbe", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717751, "uuid": "8eced88d-119c-4ef6-a0b2-2f0e1de11d0c", "comment": "Malware payload", "value": "d810841e64f4673fa268e3c9c88aa7e073f1a144ca2aca3724ae22a17d03096f", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717751, "uuid": "0acc3a46-442a-492d-beff-46eef48990c1", "comment": "Malware payload", "value": "b8b99b73017ecc449b6745dfb158d9d56c71532a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717751, "uuid": "a0cd5c63-2d06-450e-952c-d884532095cc", "comment": "Malware payload", "value": "a3444a8034b5ddbc5cf9a493503c2128cb85a0177153e83da8206ed6c890afe2d936bbeb9f565af332d4501a37a2802b", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717751, "uuid": "a226b743-7593-4e85-8c1b-4671d941ff5e", "value": "T1B7047291BA27ECA7F921427076B5F21211476F237A14CE552AD3B20E43F3B907C79E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717751, "uuid": "0b4439f1-e063-4677-bf9d-78e88402b3e4", "value": "3072:ExkZ+RwPONXoRjDhIcp0fDlaGGx+cL26nASXN22oRDUzTkFtYqzLUQMxYlgQ6bH+:RZ+RwPONXoRjDhIcp0fDlavx+W26nASS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717751, "uuid": "36e09c5d-716b-4e17-a938-840bbde7495a", "value": 174080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717751, "uuid": "f6382c3d-bd9a-4142-ab2e-fd6c811521ab", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717751, "uuid": "0ea415ad-c87f-4066-b00d-ba27c6da355e", "value": "TT Copy 001.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b82c1d2-0a50-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686705101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705101, "uuid": "24ad2a20-7d8d-4834-9bec-fc9fba291ef6", "comment": "Malware payload (CoinMiner)", "value": "bc5462da689944a5426fa4d933dc5fdf", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705101, "uuid": "79ced7fe-c046-438e-9cbb-90232766cea9", "comment": "Malware payload (CoinMiner)", "value": "d8276830ad97867bf13dc04ae0190e2c3dbcb14c08b5fe30e609ef817b110ca3", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705101, "uuid": "ca1f5022-28a3-4967-8261-40d6bf00c126", "comment": "Malware payload (CoinMiner)", "value": "8a6ab3b4ed020b4d3b60d4aa4251d2f51f5d6308", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686705101, "uuid": "23e129d0-008d-4abb-ac08-f79dedf2b7ce", "comment": "Malware payload (CoinMiner)", "value": "ad70126e887b2c27f932bc49d71fd1017b74dcdbf0c4313e68d1f125fe5fedaf645b46e2fb75c12c6531e4bb86c3bcee", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705101, "uuid": "8311c760-98d6-45f2-8af5-e58aeedf667d", "value": "T1A754B02D7BECCF43C2C84378D45680B365F5E512B983EFDB112A7EE93942791A90225B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705101, "uuid": "c0d2b3cd-ddb0-4e53-9882-4d17e2ad7998", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705101, "uuid": "856c08ac-ab59-4024-ba68-e25b2a37e32c", "value": "6144:NMH4eWseynVKsxUthS/nOS2J0zx9F4/Gksi+4CeeTf8X8FQ1M:NMH4sn81Par0019F4/GkudRTf8SQ1M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686705101, "uuid": "e615fa15-31a7-4150-b163-6de76fae0778", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686705101, "uuid": "ee92e994-3917-409f-a973-c70223c5f3c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686705101, "uuid": "3e3d5eda-1143-4a40-997a-47acc02a99cb", "value": "ClientCrack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6da5c723-0a75-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686720996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720996, "uuid": "9beb9d70-3d6a-4433-9d81-eec97c281c2e", "comment": "Malware payload (Gafgyt)", "value": "17056331478338a5cc1b2aea496dced6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720996, "uuid": "58acc1af-50c3-49d4-9a2b-52ca93c7f597", "comment": "Malware payload (Gafgyt)", "value": "d8b936518775e07906c224436f413ac58cf6832aa6464fd29f954a11766f60b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720996, "uuid": "854074cb-76a3-4e65-8459-ee065c7a6256", "comment": "Malware payload (Gafgyt)", "value": "8662d484ebc366d8b57fd502d0cebb89c21f8728", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720996, "uuid": "7f09651b-f549-43fc-9e96-d2ee209400e9", "comment": "Malware payload (Gafgyt)", "value": "b8303600309140bfe6cc54340e0c0d99842480b4cca0c8a7403442e7c02a315b82051bcdcf397888904c1b25183f582a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720996, "uuid": "eced747f-587e-4a3e-9ea2-8f57e4408003", "value": "T13F33025AD2A64A4CC89E613E36DEE50AAC50914F9D4ABCF374DCB433FC80F58630959B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720996, "uuid": "102ead4f-0a7a-450f-8dcf-a8326632abfb", "value": "1536:+kkmJcu1x2cUZSQfuKIor8j50qnouy8NqXmD:+kkmWncUZSpl10youtgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686720996, "uuid": "04b62e20-49ca-4018-8cd9-ebadd4c6adde", "value": 53348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686720996, "uuid": "4970dcf2-1a70-4706-b6b6-59aa5e2ff611", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720996, "uuid": "a877b26a-cb72-4512-8b81-9d9fee47690a", "value": "17056331478338a5cc1b2aea496dced6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80453112-0a73-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Zyklon)", "timestamp": 1686720168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720168, "uuid": "abb95ed6-2723-4ae9-9b86-8efa69155b25", "comment": "Malware payload (Zyklon)", "value": "69b55498f8568671d14a91a952c82b49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720168, "uuid": "cb914e78-b886-4b5c-915c-c1cc20a40a5e", "comment": "Malware payload (Zyklon)", "value": "d9531bbba6d9a9f439aaa28f140dc821729d3b73f943de923f0348c41acaf9f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720168, "uuid": "edec0513-1d4c-4fbb-adec-1a88ba47fe77", "comment": "Malware payload (Zyklon)", "value": "04f587ccf94ac79522404d222248ab1a81a370fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720168, "uuid": "b1be235b-5dc2-4a4c-b359-74634cec23ca", "comment": "Malware payload (Zyklon)", "value": "da080c58edda722df8fb13f552044951c1be270aafcb168e23cbacad03a30d863549aa648f6e573b9e0a109a4fa10909", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Zyklon", "colour": "#67ECE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720168, "uuid": "a2f53b86-65c7-4702-8cdd-0ae6d824c3f0", "value": "T191A53A5A7D0E0865DC8900F3C9E229785A52AD4A6F04956B26D333DBE3FE3C2C9CD15E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720168, "uuid": "3f7e26ee-a532-4587-8e6c-5d69ad027ec3", "value": "49152:jA76joDVTLJs/V6v+L0uSwiPSCmDS+5uSl6Q:jRoRXG/V6v+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686720168, "uuid": "639a6af0-3076-4642-9f1e-2df7e50477c3", "value": 2183848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686720168, "uuid": "8ae97dca-32dc-44fb-b2b4-92b4765bd689", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720168, "uuid": "06b1faa1-7a6f-4fad-9a94-16c1765298cd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2e695fe-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686728440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728440, "uuid": "41b79629-57ba-42f0-bb7e-207d4105ee6d", "comment": "Malware payload (Amadey)", "value": "fdc8c540b51900466fb7a68cff02d1ad", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728440, "uuid": "a6e68ef3-f66c-4a8b-a9fc-2aaff52a2c41", "comment": "Malware payload (Amadey)", "value": "d9aa69161f9b781e377776b06693794d1c74fb9c5d0e126f37556275b1821802", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728440, "uuid": "1f96e919-f2f6-4de0-9d27-95e90544b8f1", "comment": "Malware payload (Amadey)", "value": "07cfb1d89506e392ea4ebaf903d88800b5305a5a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728440, "uuid": "824f9f2f-99de-4b15-93a0-33c51fb9fb4f", "comment": "Malware payload (Amadey)", "value": "f6c8df6c205dea054a551797ac4bd85223d9980a02a8f0afb8f105328ba6d028dc0846a5ec4b25273dd535e7759bdab6", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728440, "uuid": "18a3969f-1bdc-46da-af02-4fd18bf43c40", "value": "T185052385AADE60B3D9F5277064FB029317317C614E78836B3384899A0C726D5B9327BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728440, "uuid": "abe54a8f-c51e-4033-a9cb-2122d3d2c7f4", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728440, "uuid": "4dc86aa5-38d3-4e7f-9417-638eb8311e83", "value": "24576:wyzs1WL2sZiIvuc/67yD7KZwvUTZ/ToyflB:3I1W64rWCD7KZGIJP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728440, "uuid": "420f1f80-5ad1-40bb-af39-0f7637e61315", "value": 869376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728440, "uuid": "2741b23a-33f8-4cb2-84f6-a843ac1a0f5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728440, "uuid": "46da2191-604a-47bf-9e20-927f3ee1b7b2", "value": "fdc8c540b51900466fb7a68cff02d1ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9208b89-0a6a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686716425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686716425, "uuid": "186289b2-d4da-42f5-91dd-ed5859857494", "comment": "Malware payload (Amadey)", "value": "bcdba8fa8b13fd1422f372bd29832ad3", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686716425, "uuid": "9e7a0494-22ae-41ab-8af2-19a9626db8a5", "comment": "Malware payload (Amadey)", "value": "d9c83d105c4551487b1c30a9ed8a274be46d759a6f43d1846b7e31bd3edcc013", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686716425, "uuid": "981b28e5-18cf-47d9-ba9e-5df1cc462c71", "comment": "Malware payload (Amadey)", "value": "0de6455c337e8e54b4b673431b67fae2e5d6e5a1", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686716425, "uuid": "9a798cfb-2726-47b7-95d0-df933d564ff6", "comment": "Malware payload (Amadey)", "value": "282408377a0060c8209e8eda9933e4e85ddffd5fde47f438848295fbddf163709f103d5535cb76b7003126ccf689d85a", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686716425, "uuid": "4dbd8eeb-50bc-471c-a663-99e73f2624c3", "value": "T152D41212BAD88072E8B53BB45CFA02934B3A7CA65974476F33849C5E0D736D4A43272F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686716425, "uuid": "c068ea34-14b6-4ad4-a594-73e3802762e3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686716425, "uuid": "f2a53272-312a-46a0-baa2-90e1355da0be", "value": "12288:zMrdy90fMM+paKDlXemGsXc0zupsPuKSU5KFDDOp6vsi:ayw+HlXemXjtPuDq+si", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686716425, "uuid": "f27873e1-9958-4f13-ad9a-4ae350f454b7", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686716425, "uuid": "159924c2-f671-4ab1-b01d-fbc24beaaeb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686716425, "uuid": "9ca09778-62a4-4453-a81c-f7eb44109a15", "value": "bcdba8fa8b13fd1422f372bd29832ad3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64dee1d-0a81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686726352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726352, "uuid": "c10941ca-d386-42b2-89d5-33c5ca92097c", "comment": "Malware payload (AgentTesla)", "value": "fdc6598bd27d4707cdc94286ffb6ffc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726352, "uuid": "9c7e15a6-e82d-4edc-ba17-175f0c6f45ff", "comment": "Malware payload (AgentTesla)", "value": "da9c5f609ebbcf19aef3d6992d451ccbe4fa77858660f6861146d1a486e1d98e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726352, "uuid": "524b8aa5-db81-4a0a-8bc5-64b16cbbf509", "comment": "Malware payload (AgentTesla)", "value": "ffc0d6d1df15adf481bb601bd3971873167b9cc5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726352, "uuid": "464db881-52e5-4583-b3f6-fdc0be83a961", "comment": "Malware payload (AgentTesla)", "value": "29665c7b0379b771f79909e75542724f1485c5e9058209d4614e2e3eb41be4df2ff1600b9a5c2da8ca3c2bb46bfc61d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726352, "uuid": "963152fe-cd94-4cdf-a68d-0610d22a0690", "value": "T14F24122972D8E0ABE47302710D3B6363AEBDDB2751B8A69B07145F183D75282C50E7E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726352, "uuid": "6ab50776-db78-4289-85bd-17b7b4a6aa57", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726352, "uuid": "7e94a01e-25ee-42d2-825f-a706ab1faa1b", "value": "6144:vYa6txz2Mad5XR9sNa57Zeb9cyU84Yas0eKY6r6b:vYnxJadz9VQb9erA6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686726352, "uuid": "71ec957d-3e44-40eb-8940-7a8a2488fd46", "value": 228192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686726352, "uuid": "8d9f5091-7092-42be-8819-504cb1857a86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726352, "uuid": "61a136e5-076a-4b67-af16-80e0c9eccf5a", "value": "INQUIRY 03746 SRC Project.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2690284-0a7a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686723232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723232, "uuid": "44fcb2d8-915b-4136-b08b-b690a7a4c746", "comment": "Malware payload (AveMariaRAT)", "value": "1ccda27f8340cbacf3a8161940f4c25b", "object_relation": "md5", "Tag": [ { "name": "aufierionformaticascom", "colour": "#F12079", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723232, "uuid": "0f4e19a9-cfa6-4bd6-bb15-17fe346d5163", "comment": "Malware payload (AveMariaRAT)", "value": "daa39e3c04e21ab3c217d0ef65ff7e5b26d0458d4a41a8626bf1b74412990ce8", "object_relation": "sha256", "Tag": [ { "name": "aufierionformaticascom", "colour": "#F12079", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723232, "uuid": "0e01b8f8-44b6-48fd-b9a3-4b9a4710437d", "comment": "Malware payload (AveMariaRAT)", "value": "b672216fa2a279df28ee04ed2c314c10034524b5", "object_relation": "sha1", "Tag": [ { "name": "aufierionformaticascom", "colour": "#F12079", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723232, "uuid": "70aa4f76-c6ed-4fa5-b4a6-a1e6e6367c6a", "comment": "Malware payload (AveMariaRAT)", "value": "6dbf04e289e3d24c2aaafce8a4553d56bfff434a6a61579799d33737be5473ec9f69290a1f3495b422af5e646d7e0fcb", "object_relation": "sha3-384", "Tag": [ { "name": "aufierionformaticascom", "colour": "#F12079", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723232, "uuid": "dc2dc679-9760-4dde-8ee9-3f75835f949e", "value": "T105C423209E9F39B810AB2D570987A3B13D3B31F6BD2E5C2D0CD1995A94BB046C7416EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723232, "uuid": "35894c7a-7c72-46c7-af9a-3980435a2f37", "value": "12288:MvdrJ5wPQl9bSpJ4VOFdzQtc/TBZHQJHaWD9itoFU786nvKaRSw9z3sqXW:MVrLwPMCJ4oFTBZ2H3MtvJvKaRSCIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686723232, "uuid": "cb67fcc2-79d9-46b8-90e8-a5a6e8660c9d", "value": 582134, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686723232, "uuid": "336b2118-1e01-4ade-9cc3-d4c450523cfe", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723232, "uuid": "f466e133-1991-47d4-9a9a-23aa59a6077e", "value": "Quote Order_Parts & Drawings.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f54ec2c-0aca-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686757452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757452, "uuid": "cf2abc72-b1d4-4010-b6fd-c19f25873e53", "comment": "Malware payload", "value": "6543fbd1d2a8dc9c243e455cf952e7d6", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757452, "uuid": "ea9fd4e2-a4ba-424b-a818-15fb31a4d5da", "comment": "Malware payload", "value": "db0fb830756b10b2e01ae24061226eb03a9a44302dc321f196dee8ea8c01d5c8", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757452, "uuid": "2dff42d2-e046-4e5c-91c9-034f2519a68b", "comment": "Malware payload", "value": "4c26c0a7916140b98fe78d601fc4b16eea074367", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686757452, "uuid": "23de250c-98ca-407a-9fd0-c07a0675a1bc", "comment": "Malware payload", "value": "373b48fe63ac6753ec0b6ed1d88d9885ba138335e06c4728583a2f38cb86a5f8f4b8016854adaf721569673e9efe20b9", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686757452, "uuid": "87bf5b2f-6104-4b4a-9830-2c2e2da7174d", "value": "T1D715E01369BB4AB9EB6A513614807E761EC9AF63CBB16046F5DC3D0EFF30874458B806", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686757452, "uuid": "ffa117a0-c03c-4787-885b-2ddb3d24590c", "value": "12288:MOV7u0RkbZceimA8bCWBbvSIdE222LaAY222s4BOE+9I5uYU1tnhBEwnz+3YG7A0:FnneimA8bCQbKIGLnhXz+IGccP5yaq/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686757452, "uuid": "023f9658-e554-49ff-9121-cdefab1c7bbf", "value": 945498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686757452, "uuid": "7d014908-a39b-413f-a1a1-bc1051328ede", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686757452, "uuid": "c213a247-ec41-4d6c-b715-09e367ae40b5", "value": "SecuriteInfo.com.Heur.8411.1964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f62c94ec-0a6c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (LaplasClipper)", "timestamp": 1686717359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717359, "uuid": "33efcea6-5acc-4b4a-a84c-78823416a2a0", "comment": "Malware payload (LaplasClipper)", "value": "507a16cb87079ba90a8efe3a6baaa026", "object_relation": "md5", "Tag": [ { "name": "507a16cb87079ba90a8efe3a6baaa026", "colour": "#A24431", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717359, "uuid": "8dc666ae-7707-4ea9-8b5f-3da25dbdc224", "comment": "Malware payload (LaplasClipper)", "value": "db78b5b857378304d5d72a826a2f1e261a71791eda971bf952cbd8182bbc62bd", "object_relation": "sha256", "Tag": [ { "name": "507a16cb87079ba90a8efe3a6baaa026", "colour": "#A24431", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717359, "uuid": "29644ce6-d14f-4bce-89f2-6f52ae467869", "comment": "Malware payload (LaplasClipper)", "value": "b526a0a56488488f45d4277a9be5f3105806e0ad", "object_relation": "sha1", "Tag": [ { "name": "507a16cb87079ba90a8efe3a6baaa026", "colour": "#A24431", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686717359, "uuid": "82c50449-951f-4464-922f-68d6e6a82bcb", "comment": "Malware payload (LaplasClipper)", "value": "e6cf538a3ce67a699593759aa33c3d66380e834ea535e6c29e115856beaaf402bfcea4b9bc7696bc68f5114486b0465e", "object_relation": "sha3-384", "Tag": [ { "name": "507a16cb87079ba90a8efe3a6baaa026", "colour": "#A24431", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LaplasClipper", "colour": "#5DA8D7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717359, "uuid": "56af741a-7f8b-4ecf-9d11-ce420e425a4d", "value": "T1FE158C36BBDDC42BD93D4E70381476BED947BB163930196BC4B0A26D6D782900F3866E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717359, "uuid": "92f62022-ff6e-4983-929d-8a312ee04081", "value": "993ca8452e8d3121b5b276bfb418497e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717359, "uuid": "f91fdd5f-db96-48d2-bd5c-a96a61f46ca1", "value": "6144:XmGoVjJhX8kQ/50Xi8wHi0I1GHXP3Or/c+rkGKZ:XXwX8kQBD8wHivGH/3Orc+rvKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686717359, "uuid": "cb72ba57-fb3b-4586-b853-97171fa3d0a2", "value": 962048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686717359, "uuid": "add393ae-267f-401c-a343-dce48c2eb105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686717359, "uuid": "1ee10ddb-3d6b-4746-ab3a-f301915baa17", "value": "507a16cb87079ba90a8efe3a6baaa026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a9e1dc-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728478, "uuid": "1e91d6bb-06af-4243-8e8b-39b5c8bcf9ce", "comment": "Malware payload (Quakbot)", "value": "c783ba8e3668ed8f7c4182032b0c3129", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728478, "uuid": "472cb3e1-8987-4940-b662-3d734299c95c", "comment": "Malware payload (Quakbot)", "value": "dc380c6947c5f8de2586ab7baf30b36b6a9426932323cb2096af2c5f4e2c344d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728478, "uuid": "39fd49dd-6eee-4498-85fd-e99773578602", "comment": "Malware payload (Quakbot)", "value": "c8d7131076a28994e55af790c55deedf9ef9f846", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728478, "uuid": "05941093-9f9c-45de-a18a-51f038c817c5", "comment": "Malware payload (Quakbot)", "value": "7a0cde6455b3f19f5b505bff968f6a1cc5b335a967d33918b3da41283f835fd7a4ec47341a1e7f700175a7aebf8b00cf", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728478, "uuid": "8a72a0af-506d-4c23-b56f-380c72326ada", "value": "T1446443896A41E0F19137F33BDA579410FAAB1F5B2184C932B93C50581F3D8697AB7F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728478, "uuid": "943b993e-e132-4af6-b398-ee0e9359c277", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb7gEGFBjhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728478, "uuid": "1988aa6f-fce9-4277-93f0-4aeb3e93cf11", "value": 329529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728478, "uuid": "9d7b2119-b275-4f7a-9921-f52021672606", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728478, "uuid": "1590da4e-bc2a-4300-8a4d-006237dce160", "value": "V5znx9WhhuXNI.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487a7805-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728664, "uuid": "d6d7aff1-0e06-4d2c-9ba2-ce92653ef3a5", "comment": "Malware payload (Quakbot)", "value": "082207eff8e34152051d328a5b097ab5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728664, "uuid": "ba2a9231-87ab-4625-8c4e-7f518f98e136", "comment": "Malware payload (Quakbot)", "value": "dc8367f97ad972c482a84daaed1ca3a15161fc344da1fb4b7e4e9eb26d7dfebd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728664, "uuid": "e197f380-5390-4597-95eb-ff98a5123c2b", "comment": "Malware payload (Quakbot)", "value": "c874cab807e99620df5eaed3c274c2ff92ab326e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728664, "uuid": "f04ffa78-1e1a-415c-805c-a477da04f7b7", "comment": "Malware payload (Quakbot)", "value": "38f872d9417b039f4305da2b11c73ff84c5cb8df8ea0e594d12fccada0b0644f0aebaac404ef4035ee09d15d3e09b02e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728664, "uuid": "624748a4-2ba9-46db-84c3-fe91cfa440e7", "value": "T14C6443496A45E4F19237F33BCA574410FAAB1F1B11848972B97C50582F3D829BEB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728664, "uuid": "e622ef16-ace4-4d62-963c-9c50f207b0a8", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbQ5x8OaBWXqs9jObgoVhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728664, "uuid": "3d1e11aa-88ce-4061-be7d-db5df5c6893c", "value": 325670, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728664, "uuid": "9729e2d5-716d-430d-b921-dddff4009d92", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728664, "uuid": "6f26133e-d827-4ad3-84f5-341dcf7ad9d6", "value": "SPb8UrQBOpqa.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1ef00cf-0a8e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686731848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731848, "uuid": "62da5a22-c651-432a-9956-c40a87d597f4", "comment": "Malware payload (Gafgyt)", "value": "a57a49b06b86d1596f9fe14a53587084", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731848, "uuid": "a827b8a9-0e1d-422f-aaa7-3eda30f90fa5", "comment": "Malware payload (Gafgyt)", "value": "dca947e9793cfdd6f42e03e8a854570e014ae37e7c4e6ab81b37f1e065e51b01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731848, "uuid": "274e5953-b986-40b4-92f7-fa1d83b16b6d", "comment": "Malware payload (Gafgyt)", "value": "08ad03fe0e31beb5bed9670a58070f39adf5edef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731848, "uuid": "60d6eca2-ba34-4d77-b604-96d9f26b9923", "comment": "Malware payload (Gafgyt)", "value": "1bc31d2575c4de559ec8cc35344420af00576c95c31f2fc7fb504890818b07cd43fc98d740f7c58c9a8d13123369f9db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731848, "uuid": "f36a7dd4-cd98-4f51-bf58-2d096b9402f9", "value": "T12A930892B900DFB6F40ED77A04D34724B670FBA24E532672731779A6AE322D43826F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731848, "uuid": "a3592674-7d14-47d9-8d77-88c2d8e7d68f", "value": "1536:4wZTvNTV8V9eEG8ktQmzn5h8Jn9/QT60ydwgJT2fDhXTmQ9VqXjewf2Le:BjT49m8KT8RQT60ydwI+RmQ9VqXywf26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686731848, "uuid": "744dc657-37da-4ff8-8a6a-46728ba4c47d", "value": 91087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686731848, "uuid": "d1004f97-0c5a-4164-adec-5c7463b768a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731848, "uuid": "53477a43-0a10-449f-85ba-6d18f5055dc6", "value": "a57a49b06b86d1596f9fe14a53587084", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab763133-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728830, "uuid": "c2ab2c1d-882e-4e6d-9985-6dcdfa9fc700", "comment": "Malware payload (Quakbot)", "value": "dddc54a4c6ede95f1fd39df35e398d3f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728830, "uuid": "84552635-3f3a-416a-a158-016007bb92fb", "comment": "Malware payload (Quakbot)", "value": "dcbb1de18c706dca894ce39fa5c0e6ec4956955cd2e0e48dd2787d8e46747b3e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728830, "uuid": "013ca8ed-f138-4bba-9a31-0766a3a63633", "comment": "Malware payload (Quakbot)", "value": "5a04966c43a9f3cbb112eeb11b34e96897d82839", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728830, "uuid": "3ce07a31-9e8f-4368-9208-c9d0934c388f", "comment": "Malware payload (Quakbot)", "value": "1c357d346da256466c1055e3cbcdf45398b9e32956b0eee562e4418724d89ee0c59bf0a118964738aa4104be4c9f46a9", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728830, "uuid": "72f56ced-179a-484e-bfd8-6fb0fccc8740", "value": "T18E6443896A55E0F59137B33BCA178410F96B1F5F10848D72BA7C50592F3D828BAB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728830, "uuid": "89384551-38e8-4006-bb3c-61ec3c579907", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb89HxEVjBCJBhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728830, "uuid": "769f51e3-3e5e-4b77-84a5-449048203467", "value": 336020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728830, "uuid": "c4abd45a-217d-4b8e-a067-d944ca1f3e29", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728830, "uuid": "95aea625-9850-4d14-8e89-a846045fa9f0", "value": "OQA65CIp7zjk.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f6ca909-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686750661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750661, "uuid": "46ac14dd-8471-4d11-90b5-dc1babbc562b", "comment": "Malware payload (Amadey)", "value": "609330a4be747c7ddf46d3e7b683d7c9", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750661, "uuid": "ae945518-0ae6-4eeb-aaa3-b0e53f443066", "comment": "Malware payload (Amadey)", "value": "dd14ba056c5b591a8cd099b0d019ba3e28f966266a554380f20b2ca5e334e36d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750661, "uuid": "e292583e-1700-44fe-ab76-3b6cad9fe3fd", "comment": "Malware payload (Amadey)", "value": "abae649c27e257aefa955a97d9a2e7571cf74d84", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750661, "uuid": "a98489fb-80cd-4032-8867-fc0e53e03744", "comment": "Malware payload (Amadey)", "value": "ec4468a71d209b25491cc78907dcc03d719db24c24ecd19cdaf72bb2d6c5594404b2fcdf7dc0dda106c0f95c70aa178b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750661, "uuid": "2eb5d9f6-f728-42fb-9cbc-a059b8f798b0", "value": "T14FF423A3ABF99572DCB427B058F616931F31BD71993443AB3784586E0CB3684A43237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750661, "uuid": "5179809c-3496-4e5e-aeda-a42239c75224", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750661, "uuid": "52e2e1d0-29f4-446a-a3d9-4230ed6ff8f5", "value": "12288:QMr7y900m2qN8Oc9PQ7tYQS1iOPOEqH6bpitxQNkIUxyVYCKj5CuY:7y7m78Oc9PrZBO7gYq2Iw5Cf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750661, "uuid": "e617d15f-9c2c-4394-8f0f-ff5498d1b874", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750661, "uuid": "67df34de-91fa-48f1-b510-328a8d05efec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750661, "uuid": "55d9ffd8-b6d5-4c64-8432-48b21060aa0a", "value": "609330a4be747c7ddf46d3e7b683d7c9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af32d6a4-0a8e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686731843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731843, "uuid": "5c7bf106-7fc1-46b6-86c1-a5b9a729377c", "comment": "Malware payload (Gafgyt)", "value": "3249549058370cfc280ea6f8e7499578", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731843, "uuid": "bf6b5a00-eecb-476f-8614-8cff50c3292c", "comment": "Malware payload (Gafgyt)", "value": "dd16a1114ba659fa2e51d327a55912e3f2c61aa1dee7e188e072c809a8f0b423", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731843, "uuid": "9625c8a7-cf2b-4ac1-9584-26b8210e50af", "comment": "Malware payload (Gafgyt)", "value": "99ea13347a43165e675fec4b0b9641c4b2e29c4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731843, "uuid": "c8ff0db0-985a-43bc-a7ed-a5aa4162bf64", "comment": "Malware payload (Gafgyt)", "value": "d5f7bf1481e14d8cf29adf4af683acaeee6eb12de58fcb80acffdd6fea09d8acddde21c9ed87da72fd5f96bcd9231dcf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731843, "uuid": "46e45495-4822-433a-a73b-8487e373dbbd", "value": "T136B32801D5508B67C2D2277AB79F825D33332BA8979B33125A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731843, "uuid": "31015024-5db9-41ac-9155-9d7f7627d7c1", "value": "3072:b6an17WtsWhdgYJz0D6mbPbmTQOWsXAOn:Wan17WPJz0D6ibmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686731843, "uuid": "0eaa9890-eb0e-4e47-888d-d257f489d157", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686731843, "uuid": "4ecf773a-4d25-4c74-9645-7dc242b0aed5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731843, "uuid": "e57f5c38-ce6e-40f7-bca5-690c5fbb0172", "value": "3249549058370cfc280ea6f8e7499578", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc190b91-0a8f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686732348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732348, "uuid": "0a5b74eb-19d8-49ef-8385-8a7cccb6a655", "comment": "Malware payload (RedLineStealer)", "value": "b9a8a78f488bbd3d9c0609c82b75df7a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732348, "uuid": "be0e429a-2a26-440d-895b-7fc817b5f240", "comment": "Malware payload (RedLineStealer)", "value": "dd6354563545cca4e74c33b7b2bfa0b94116d0f100eaa48df07a6a82621b48ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732348, "uuid": "e1efbd1c-fe2f-4c30-8146-22c3f270a1ad", "comment": "Malware payload (RedLineStealer)", "value": "9b2eeb3851a495b8c51db121e138e78fb236ea2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732348, "uuid": "cd4df104-c5f7-44bf-9a3f-7382e156ee45", "comment": "Malware payload (RedLineStealer)", "value": "b8b4ab40842077f9e4a3663cb382a19aaaa677ea83e972eb3fe4bf0918ad198a8d34e102d126a40cdfb08559de1d1232", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732348, "uuid": "831a6002-43cb-43bb-85ea-7d325ab6b444", "value": "T187D41212E6E88173DAF6637088F643D71B367CA15A34936B378B2D1A0C726D4B835727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732348, "uuid": "ff8f914b-82fb-4777-9cfe-c4b5a0121ecd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732348, "uuid": "da10bb87-7d33-47d3-b624-cbd13c2fd87b", "value": "12288:sMrQy90D56dkx0ns0RsamujLR6Kxll1kDMoyjR6SH0fi/zEV31o:syCMda70WsjtHl8leASXou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686732348, "uuid": "45bb18de-75d7-4c00-acd5-d11cb3728137", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686732348, "uuid": "ff0cbe86-65f2-48ee-a497-4b3e7b5b4f06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732348, "uuid": "9dc9e2e6-58c0-4424-96e6-ddb34cecd9c9", "value": "b9a8a78f488bbd3d9c0609c82b75df7a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b887efc-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728294, "uuid": "b35df76f-b451-455a-b9f6-7e76fe7d4d3a", "comment": "Malware payload (Quakbot)", "value": "a78bb35fa8536ca4969938e4a93e748e", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728294, "uuid": "134a3c5e-c7a7-43d7-8a69-491aa72eb80b", "comment": "Malware payload (Quakbot)", "value": "dd8a49f0c0149eb9593e6443f58eda0a193be8e92a13e6fc25ea1e2691cf68ac", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728294, "uuid": "3062efcd-83ca-47f8-b165-1e1ff5211528", "comment": "Malware payload (Quakbot)", "value": "8c87017da106030c38593d3aad6069a126df5f02", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728294, "uuid": "5d27dc0f-980a-4472-aecd-7099885314b9", "comment": "Malware payload (Quakbot)", "value": "bb0588920e7d0adcec01fa3aaa0b201406e13430dc36f144871574a5ee576ebce7c7b8320d2124a169b66b8a793254b0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728294, "uuid": "3ba0212c-f390-4373-8b0e-09a11bbec85f", "value": "T1A07495456A55E0F14137B33BDE178010FAAB1E5B2084C972BA7C11596F3D86C7EBBE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728294, "uuid": "10ec201f-baac-4e6d-888a-81f9b72e3b64", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbMAyP/czqwhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728294, "uuid": "2eef0a22-1893-408c-b0ae-58118d3e1fbb", "value": 355882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728294, "uuid": "fa74a50b-1775-4e67-9ee4-de72fd1799c0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728294, "uuid": "7ab1b690-9958-47f9-aff9-eda6f35def0d", "value": "ZduxYNbpVAGgjC.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "538d0da0-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728253, "uuid": "9fa1e5fa-817d-47f5-8f84-7a9ec1abf0fd", "comment": "Malware payload", "value": "ce68a0b79cc633e19ab6213360c73836", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728253, "uuid": "ef547a46-4948-4d08-b0d8-fdc31910327f", "comment": "Malware payload", "value": "ddbdf8827c8645e4d3c86f2a770adccaac5370409f0db46031078e56af9d71eb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728253, "uuid": "b2486daa-3a1d-4930-a578-297be0c52778", "comment": "Malware payload", "value": "2e487abe38a583a81006510e00d70d25b583e459", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728253, "uuid": "c7db406c-1ca1-4fcf-8824-83b1fb73f27a", "comment": "Malware payload", "value": "8709b612226e5fd0b52183ba999e268644e4f3af1ea7d614c31ad75a0b517fb1697ccd0b1b5c09eaab42f3c9af913749", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728253, "uuid": "e62da1fa-76eb-450a-a507-120d0acd8b16", "value": "T1EA6432896A55E0F09237F33BCA578450F96B1F5B20848972B97C505C2F3D8297AB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728253, "uuid": "3bd2570e-dfd8-4c9d-96ed-09c03b3e6621", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbZUK0kqzhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728253, "uuid": "72eec286-4fce-463c-8d21-eeb1dd07fd19", "value": 313788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728253, "uuid": "3672aefd-ad90-4318-864a-4db0b3a25fa1", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728253, "uuid": "21785d29-7669-4780-94a8-5985dfc17e22", "value": "aAyf1WfaEuuOls.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d40fd0c-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725773, "uuid": "c04e5029-334c-4048-922b-48eb8c110d1c", "comment": "Malware payload (Quakbot)", "value": "42e7bb26adaba50f3138564686cb60f5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725773, "uuid": "d7c22882-b520-462c-ab8c-c10c2e38c926", "comment": "Malware payload (Quakbot)", "value": "de52e6f6ef19648e46fbdbacda4af3a18b3834abd6ef7923798fc2dac9fa0443", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725773, "uuid": "25b40cbf-f325-468f-b008-2e9db4e4db6c", "comment": "Malware payload (Quakbot)", "value": "e37026254ee84c0157954ae74375f7b80f3c2205", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725773, "uuid": "814009c5-7d3b-4304-a29f-9a0b6809b81e", "comment": "Malware payload (Quakbot)", "value": "dc880a7e1b189901fe807ed875ccef4fe5f9a28c3905b3059b6d76e5d358c1fec349328d3e062a31e9028bf378a07e1a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725773, "uuid": "33bfb3cb-f82c-433b-89f0-e817d0be8f22", "value": "T127744388AA41E0F19237B37BDA178410FA671F5B21849972B97C505C2F3D8297AB7FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725773, "uuid": "ddf92f60-5456-4a5d-9593-b3a2200c042d", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRblLTfQ+hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725773, "uuid": "abd10b1a-88c8-4259-98cf-7257d57093d7", "value": 353192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725773, "uuid": "5fcfc1e6-e340-4b9e-9189-b76f61d029ff", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725773, "uuid": "67009ee9-6fa6-4781-a43e-b579e9e3c12b", "value": "kBjwjZmxD0rV5B.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed07ada3-0a57-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686708325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708325, "uuid": "dc5edb37-c54c-4bf7-bea2-2545a4eb3a3c", "comment": "Malware payload (RedLineStealer)", "value": "fc4451aa4b09bf99bcf7804b9a00109c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708325, "uuid": "30c4cbc8-1cad-4d9c-bdf9-b0913c0555e4", "comment": "Malware payload (RedLineStealer)", "value": "de9eacbf9662d69c9ac2c2a6152f023d57801bc272f83bdaece3caaf36210be2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708325, "uuid": "5c3e137f-fb7e-4647-94f0-cff2f15be68d", "comment": "Malware payload (RedLineStealer)", "value": "8ebce6d900e89a8f38b30a8138813c308955dd16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686708325, "uuid": "6d1379a2-f961-40b3-b68a-0a584ac4496d", "comment": "Malware payload (RedLineStealer)", "value": "351674d3ef63388c3db295bb6882c53118abe398ccd4155f5485e8b5b1667e2eb3a055a7613d1ec1f122d5679c8b2e33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708325, "uuid": "02197c37-f291-463c-b464-63ee82ae04ec", "value": "T10C645CC0991CD231E2838472E87B4263960CE8767A54D7EF2F89A53CBA766D1CD54EC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708325, "uuid": "6ed77888-d96e-4e2c-b65f-1a14290e56f0", "value": "5b43169544844188711b217df61eb2d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708325, "uuid": "a4b61ed0-7109-4506-80d9-23f59407debc", "value": "6144:g4wdriFXjI3MW8qY704pnH7hYx7oPG5RU0nCi:WQTI3MRqYTVYxPRU0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686708325, "uuid": "6ba54028-3203-4a62-8f38-8190a18142ba", "value": 325799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686708325, "uuid": "16f160ba-58fe-4a55-8677-082265550d58", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686708325, "uuid": "0cf5e70f-505a-43ff-96dc-ee64fe4ce30c", "value": "fc4451aa4b09bf99bcf7804b9a00109c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932cc757-0aaa-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686743822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743822, "uuid": "4947d075-9c7d-4c65-a12c-b972f5356cf0", "comment": "Malware payload (Quakbot)", "value": "017d4bf10455d3a57c3b017c2411db16", "object_relation": "md5", "Tag": [ { "name": "1686735623", "colour": "#C7EBF4", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743822, "uuid": "ac985ed8-c3e0-4950-8a68-d627cfc17a59", "comment": "Malware payload (Quakbot)", "value": "dfe99e49909839abaa99142b09b1e8eaf4d5ceb9e5880e75b045fc2c805c4f7e", "object_relation": "sha256", "Tag": [ { "name": "1686735623", "colour": "#C7EBF4", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743822, "uuid": "39d900ba-40f1-4be8-8d21-9ea8fff862f3", "comment": "Malware payload (Quakbot)", "value": "99d08dd33da775549d6debc61c9055965f0e22fb", "object_relation": "sha1", "Tag": [ { "name": "1686735623", "colour": "#C7EBF4", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686743822, "uuid": "8372b14a-78aa-4665-b476-ef119399a7ac", "comment": "Malware payload (Quakbot)", "value": "de40cb09229ea012d1335ca87e2c5310f788de21b64c90d2903abed8a8871ba26febc8baaec1c84e3a73540c2e6cc684", "object_relation": "sha3-384", "Tag": [ { "name": "1686735623", "colour": "#C7EBF4", "exportable": true, "hide_tag": false }, { "name": "BB32", "colour": "#949961", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743822, "uuid": "95148047-9afd-4ad3-b990-5a0bdfc80ca9", "value": "T1FFA2A0271F250AC4D65ED9FB5A6EECB749CB3A1394563E07BAF4D0A3C6446C0C92584C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743822, "uuid": "8dbc649f-8d32-4326-869d-1fb5f7cff6c7", "value": "384:WfIIlFdUXwhFCQjpj3fIIlFdUXwhFCQjpjofIIlFdUXwhFCQjpjX:nI/PnCQjlwI/PnCQjl1I/PnCQjlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686743822, "uuid": "58da6bad-b7ae-40e5-b3a3-18309c16e70d", "value": 22708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686743822, "uuid": "2406ccff-1629-4492-b3db-6f7920be0252", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686743822, "uuid": "e4e1ae55-ddcc-43c2-9649-26ca84a23cdc", "value": "docu_DF631_Jun_14.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a5b7ec-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728764, "uuid": "1f22a4c0-a370-4247-99f3-85eacd348b09", "comment": "Malware payload (Quakbot)", "value": "af4bde3f99dc49c3d0c63c5c434a0d5c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728764, "uuid": "f6977858-04c2-4377-b7c4-166c3a5325b8", "comment": "Malware payload (Quakbot)", "value": "e008b0438d7c2b48ff5c96bfe63b2ac51ae9eb0133be04fe97c1982fd27d9bcd", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728764, "uuid": "bbbc3942-cbdc-43e5-9a24-b63e2ef2a2a0", "comment": "Malware payload (Quakbot)", "value": "d013688715221d0de989444d65f0fb08d4f9860c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728764, "uuid": "c730aef1-a3ce-41b0-906a-2530c23762f1", "comment": "Malware payload (Quakbot)", "value": "04381be9ff5c627705df7da5801b102af321297e757a5f562e5099d9b8948516f700ee22076a394135fec862bf11e39b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728764, "uuid": "18921cdb-cb2e-405a-8aec-e7ef732f01f9", "value": "T1FE746389AA55E0F15237B377CA164450F9AB0E1B2088C972BD7C50592F3D8297EB7FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728764, "uuid": "99828a4d-8643-4447-b4b5-68d32b5465bf", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbhiYRzp0Y5QbbzGawapAxQhy:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728764, "uuid": "574fe6e4-04e5-40fd-b280-6dbb2bcac7bc", "value": 360373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728764, "uuid": "f985cd2a-05d4-4b17-b3cb-bcd5232d24cc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728764, "uuid": "d8942f5c-5fc7-4207-8cd2-715538a32ac5", "value": "QNK9HOCXH9ZvHr.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "487a8a93-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728235, "uuid": "6d46b1bc-b4de-4cc5-a3fb-a617c115d8ac", "comment": "Malware payload (Quakbot)", "value": "1b88950b67da9111b7af4e9dcf0ec422", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728235, "uuid": "346d8238-47b2-4a7b-b38a-2b41e42b792d", "comment": "Malware payload (Quakbot)", "value": "e00b5fa036bb07b42f390c7b3eb5414cc5621d482cc388c023c2e064451b61bf", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728235, "uuid": "687bf08d-d148-4e7a-8eb0-7bd13ac38535", "comment": "Malware payload (Quakbot)", "value": "35058a3bc2d78c8dddfa5b4472727fa1c6172d93", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728235, "uuid": "142414ee-d9aa-4215-885d-edb51171b6cd", "comment": "Malware payload (Quakbot)", "value": "1f125b3f59bb75fcc438e403dfb26e3cd714cc61f5fc0755596946b602ca17a630aa38fab174aac4447baa3c618eb183", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728235, "uuid": "44d447d4-023f-401e-be57-95052a867f11", "value": "T193744189AA41E0F08137F377DA178460FAAB1E1B11849972B93C515C6F3D81D7EB7E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728235, "uuid": "031aa79d-f8c7-4924-acb9-4f9270fc8fd5", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbFQuUPXJgzS+aqitjumEI6oc:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728235, "uuid": "9bf4bd17-61db-485c-b82d-a310a33ad723", "value": 349048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728235, "uuid": "9e170bad-5603-4fff-8cbd-4631ec34c1e9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728235, "uuid": "1869b763-f2d2-4996-ad98-82bac907118b", "value": "auJeZJ1pj73l.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1196298d-0a8a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686729861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686729861, "uuid": "563bc180-0709-4886-bf64-a82259963989", "comment": "Malware payload (AgentTesla)", "value": "ac9892aeed1bca2495672d9e14366307", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686729861, "uuid": "65867095-9ee6-41f2-8dd8-b52f5d36c460", "comment": "Malware payload (AgentTesla)", "value": "e0d66ed08b0e06fe834efc4d953c9407380d5202edc634427f859bd0026cae40", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686729861, "uuid": "0e88ec93-3088-4a30-8a40-a07a91e8f068", "comment": "Malware payload (AgentTesla)", "value": "383b9d4667218049b0ac8d7ff2c6ae4bd5adbcda", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686729861, "uuid": "17cc0ec4-50fd-409c-9510-dea4c7a96a1f", "comment": "Malware payload (AgentTesla)", "value": "126c27dd2e2fe1e7935799f92f5aa8615fc7040bbab3a2ca7be6eab2f8d8faa8360afdc4ae470e0e550fc26ae1adfbf2", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686729861, "uuid": "4d058e3a-0b80-453c-8b68-f55b0d91a807", "value": "T18AD42316310D9C8428D6F6E5DBD564F24407211F99BED12132FEA33A6C66C78E12F2FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686729861, "uuid": "0f6b46a6-91ff-4b90-8eb8-5e9d6cab71df", "value": "12288:aEgmkppXsElhaEj8PI4nhIlNgidLeNc5dFUKieb1MyDVGZOJiWum:cmOp8EbaEjLyhqqisNc7DnbeyDQon3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686729861, "uuid": "4ffe4595-11f2-45e5-9491-cb26563a760f", "value": 639584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686729861, "uuid": "9a61b11e-b6bb-4a8e-8d34-007c65087a47", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686729861, "uuid": "bb1d4b49-e2e1-4fba-bc06-db1182ab8ddd", "value": "PO2302841R2.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286deea7-0aa1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686739777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686739777, "uuid": "dba694d6-090f-4577-bac7-c607b36e4f4d", "comment": "Malware payload (AgentTesla)", "value": "d26a255fae6242428ca0af216a31aa89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686739777, "uuid": "9a737c47-7142-4b81-894d-3b547c86529e", "comment": "Malware payload (AgentTesla)", "value": "e0da04e7d3428e2add35de8c95b1fac697a1180d9f8b73c08f779dd20ae1ec78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686739777, "uuid": "8824f5f2-d9d3-405a-ba04-35d91f65bc85", "comment": "Malware payload (AgentTesla)", "value": "39a772187c8f21b64e04802fca9601c0750d40dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686739777, "uuid": "af31496d-9c47-4c9a-9776-b40ef493502e", "comment": "Malware payload (AgentTesla)", "value": "e4729842ed74c58c6aa31e3dcbf7a44c25242df71f9e9ed55043996973f6c2a8f514a417c1e15f921d69b8ede61aa089", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686739777, "uuid": "2d598307-f2e7-4ed8-abcb-55765adb5574", "value": "T14405DF41723E2963EABDCBF50151527097F62F5EA25DE6E80CC2B0DB52F4F844A41E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686739777, "uuid": "660d7d15-04aa-499e-8f5c-27876d736d70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686739777, "uuid": "68cf8d68-20d0-4973-8534-8fe70c2ee50f", "value": "12288:2lKnuWEXqXdVLVWhbUdMwq7cIQQ+jKHlnecK0fIiJLQfnIN:DT4qXdVBWhAdrqoHQQKHpPKyLQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686739777, "uuid": "8a61ee73-9fbb-4460-85ac-5c3898176d52", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686739777, "uuid": "a6251467-b7f9-4472-b5a2-645ce2033cb2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686739777, "uuid": "a4093afe-9929-484c-a6cb-bc5390d2d9db", "value": "open-order#456789.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba45437f-0a8e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686731862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731862, "uuid": "d4b40fe8-c31a-4cfd-9aff-01e1f703e5cc", "comment": "Malware payload (Gafgyt)", "value": "acbdb346160963c27dba9c6eff91e971", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731862, "uuid": "9c077e6f-b65c-4f24-8aff-50247df5312c", "comment": "Malware payload (Gafgyt)", "value": "e1ac40f3dc07073d64ca6bc53ec9e18605a942a658fa671c84d5dd82c573e51d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731862, "uuid": "98a15755-a0f9-43c0-86c6-2cb66582131e", "comment": "Malware payload (Gafgyt)", "value": "cf014256c09212b9e763bae4f8cd1192cceb2de4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731862, "uuid": "d2ad7d9a-5a0d-4913-90f5-7afab54cd634", "comment": "Malware payload (Gafgyt)", "value": "de572785349e2e7e42a72f66695ad9261724bf4e448d5028ecca87a9989ac3f3121f129a4f35373e23036235859a0475", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731862, "uuid": "795c44b6-ca27-4cb5-b408-67dea24b96b3", "value": "T1E8B3952A7E22FFFEE168863107F35F7087D521A226919385F26CE6181E7128D1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731862, "uuid": "52d3d8b9-d638-4345-a35b-531e11df9c90", "value": "3072:R/4tNF9U4vvNKw6J73x8UmkiSFxfKxbXe:BUNFK+N8T8UmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686731862, "uuid": "25566c9e-4d15-4027-a479-b4a04b9a6c31", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686731862, "uuid": "e71f107e-bd68-418c-a627-68f8719b5054", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731862, "uuid": "5e5b1d6d-184a-4b23-97a4-913037005105", "value": "acbdb346160963c27dba9c6eff91e971", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7caf04d-0a8e-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686731831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731831, "uuid": "90f9b10e-a1a6-4eb6-9c60-f05158a98294", "comment": "Malware payload (Gafgyt)", "value": "ec5ae05be8ae18cbb2e7599f6261e50b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731831, "uuid": "5bd63c21-f424-4cff-81d3-4369c3bd4705", "comment": "Malware payload (Gafgyt)", "value": "e234bcefac9a3873d513f7e1d3df18e26eed3508f943e339e95d8ddde4408d50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731831, "uuid": "e51154f4-f8eb-417a-b67e-84bb81b78f00", "comment": "Malware payload (Gafgyt)", "value": "ee8c8363a630b45746394d027c2471e8700a8e05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731831, "uuid": "c8319a1f-fa36-4b92-b228-5bb7410900a3", "comment": "Malware payload (Gafgyt)", "value": "a4ac1a3e93768f1600afb6234ce46f9f916525c9c804f7ac79048d93af547a9457f431f73b0f4df584d5597004ffea59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731831, "uuid": "b8cefe53-0f93-454f-999a-351aabc8be26", "value": "T1E1E32A09EA408B57C1E2277AF7CB424933339B64A7DB33095928ABF43FC279D5E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731831, "uuid": "674318d3-c395-45a4-8b11-bbed8d912543", "value": "3072:fuNaNpF4uVN++dkhnx2QennF4M/9OD4bNWkE1kmpwfvRQfZn:mNaNpF4+NChn4QennCM/9ekmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686731831, "uuid": "24c35911-c458-4743-a568-3fd98b9ab650", "value": 150385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686731831, "uuid": "c1bee5e7-1ea0-484c-932b-42803d53a960", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731831, "uuid": "065e4e2c-1098-4d1d-80f9-91b0e287e03d", "value": "ec5ae05be8ae18cbb2e7599f6261e50b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c3306d3-0a7a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1686723221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723221, "uuid": "6bf20067-8e46-4922-bd63-1dadaa64bf5e", "comment": "Malware payload (AveMariaRAT)", "value": "70474dd7fc644e8f77ed8c477c2dbc09", "object_relation": "md5", "Tag": [ { "name": "aufierionformaticascom", "colour": "#F12079", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723221, "uuid": "3832f53e-999f-473d-ace8-c1d0dbf6643c", "comment": "Malware payload (AveMariaRAT)", "value": "e240162d4a5ba771571c4462edf54ca87b8faf4a004b6997ab46435d251c62f3", "object_relation": "sha256", "Tag": [ { "name": "aufierionformaticascom", "colour": "#F12079", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723221, "uuid": "a44ca784-5953-42c8-b82f-62edb54cd3fe", "comment": "Malware payload (AveMariaRAT)", "value": "486eb55e4c60cf6c86de05b2133c8a0ee34e054c", "object_relation": "sha1", "Tag": [ { "name": "aufierionformaticascom", "colour": "#F12079", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723221, "uuid": "fc606a46-7da1-4192-9fbf-0293f9eb7ad0", "comment": "Malware payload (AveMariaRAT)", "value": "b4757a61403475968fc9f7b5c869c9afd00921c723aadec4bb8a30a1b5e0b086a15a993b19a0e2326a8fad13e1013db6", "object_relation": "sha3-384", "Tag": [ { "name": "aufierionformaticascom", "colour": "#F12079", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723221, "uuid": "937b7424-7566-4d6f-9138-1b554c8e9ea5", "value": "T180F433B5C93E7486C6F182DC750A22C62BBBA74135219E4DEBD20DEF0C709B38657A71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723221, "uuid": "6a8bdb83-674b-4eba-9e40-58906b5b9bcf", "value": "12288:wuLC4WwbZaxM4KK9cWJtZ3IOA/5TZ7RwdspTaQ9lsJzR5Cqr810z/6lo4G2QAPw:w74DZaM2DtZI/517Hp9l8z71rHzS/G2u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686723221, "uuid": "8b468236-3169-4805-a0cd-d09fb92613cb", "value": 743132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686723221, "uuid": "739665ce-bb36-4af9-8cd1-8893fd2cdf43", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723221, "uuid": "b62879dc-b709-4fd7-9017-44ee794d7635", "value": "Quote_JUN75698-LD8972390.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9859b170-0af1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686774325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774325, "uuid": "be9a0064-6d52-4a63-9c6a-94497c1aeffd", "comment": "Malware payload (Mirai)", "value": "ea19464308edc225ca1a50e451c05cc9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774325, "uuid": "0d0e6a8b-f326-4eee-8d85-88bfb69ef308", "comment": "Malware payload (Mirai)", "value": "e24a8cdb9968399c5fdb60ea7389fe99664b47c30e699e4cea021bc075185459", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774325, "uuid": "b38022ba-5f2c-4a3f-9ab6-c0a3954f2e31", "comment": "Malware payload (Mirai)", "value": "189fb377112f5e49be2ee7e602935bb033f1f54a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686774325, "uuid": "5c0b324e-318b-4f49-bb86-641fc6ebe404", "comment": "Malware payload (Mirai)", "value": "0b5dfff49e928ddf1a3be537c63cb714d8ee9f588cf1ed23e9ed9768bf0a97dcaa3ab13f69876ae0dd7a80ea77ec903f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774325, "uuid": "21ab4b72-97f4-41ec-8a1b-48dec77ac502", "value": "T1ED03F751BC829A77C2E1137AB6AE4A8D336163E8C2CF7217DD214B607AD651F0D23F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774325, "uuid": "d6278ff5-cca8-41de-b40a-eed6b6af9ff9", "value": "768:AgA/wMCbXsG5f0OJnlUlcOlF5AdwAAb9XDWd2v+bAq77TEXoT9/NMwWW:AfWb8G5fblUlfbgeaUv+fEiHWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686774325, "uuid": "6ca2f16a-2d32-45e1-84f0-8bc79db011eb", "value": 40752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686774325, "uuid": "71897d5f-bb17-4b2c-879a-a7ecefc8761d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686774325, "uuid": "42809a5c-4610-4676-aa64-84aa23b7571f", "value": "ea19464308edc225ca1a50e451c05cc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44b8332-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728845, "uuid": "7762afd0-14c3-435a-8487-0b8c7d33a84d", "comment": "Malware payload (Quakbot)", "value": "9bd69655a96ac8645f355983f1e1b455", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728845, "uuid": "a566e4e0-51c2-40d1-b48f-14a662a52cfd", "comment": "Malware payload (Quakbot)", "value": "e24dae59a010130abde32f4eaff31e39090feeea4c7c45ae39cf343fccb72881", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728845, "uuid": "fc05b229-5d01-48a3-b56b-81e95004cec2", "comment": "Malware payload (Quakbot)", "value": "a8219d01b0089b3fab3009ac7ae18f004e77589b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728845, "uuid": "3503bb4a-ad33-4bf5-8a11-fa9d24d97cfd", "comment": "Malware payload (Quakbot)", "value": "6dcdabf4445180a89dd60c0c448a710f58f220e78e90dd14b4ab7c3fb0cdd357ca00082a8aa5c4df3fe54881c6a0a864", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728845, "uuid": "85523e69-288b-4a3f-9c46-f3f47584de57", "value": "T1BC743149AA45F0F09237B33BCE178010FA6B1E5B2184C962B97C515C6F3D4697AB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728845, "uuid": "9c3e746b-291c-4298-a1b1-fa7fde6c7e8d", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbEt0g+EFHUfku42FPjhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728845, "uuid": "b64d5fc2-e199-4da7-94dd-d762a7892cfc", "value": 338906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728845, "uuid": "93ab8ffb-3921-4884-aab4-780011f16645", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728845, "uuid": "3ad3c9ed-4856-4ba5-ae4d-baa16b3653a7", "value": "NmBmdfdsrDm7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69af6dc-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728527, "uuid": "3c18b672-0971-467f-a5db-a149df4c4771", "comment": "Malware payload (Quakbot)", "value": "8d9d590d215e3756a66943ae013a39ab", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728527, "uuid": "bc6c39a6-7d69-47b7-82f9-dcd13265a1a3", "comment": "Malware payload (Quakbot)", "value": "e2d52c6111c68535f7c2841b3698a29cd59ed137e71a39abfc9c95ed25a4e255", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728527, "uuid": "e6d70760-9765-48a5-9530-df433226f91c", "comment": "Malware payload (Quakbot)", "value": "ead0e22bdd2c22d9334dc71ab892e01a57e73108", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728527, "uuid": "65e6f431-4cf6-48b4-8f77-76face8d798e", "comment": "Malware payload (Quakbot)", "value": "b75542d09411649454d151ad5e1413e2e3408fc35aee074f28aacd376ea76485df282576b17056f29ba1b9ecfe4bef40", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728527, "uuid": "83e89bd9-ab80-4ac4-9835-db63c5c2d88b", "value": "T1E17453846A45E4F04137B377DA178460FB6B1E1B21848932BD7C50582F3D86DBEBBE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728527, "uuid": "a8d99940-8fce-4640-8cc3-880d330cd153", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbb9E9uG/w1BO5WChS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728527, "uuid": "7d3c9ac7-bcc1-47dc-9677-c35e9ab5768b", "value": 350698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728527, "uuid": "81816422-8395-4f9a-a103-0d5271dcae68", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728527, "uuid": "4a1d592a-a49d-4816-835f-bdc3ea341776", "value": "UQ0eWYPMBpuz.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12632227-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728144, "uuid": "a3faea49-ad24-4bd7-9175-2e364eeede5d", "comment": "Malware payload (Quakbot)", "value": "09f5bbbead93bf3ff846e775bfa47ff1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728144, "uuid": "ea4b39f9-8e1c-4d3c-bf00-1a48d1b2d69d", "comment": "Malware payload (Quakbot)", "value": "e30c2be9295185b257fc75b5050ecf6f90c6e4df293b4bc0abeb3f2955f0afea", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728144, "uuid": "f3176420-f647-4640-943e-74545edf5059", "comment": "Malware payload (Quakbot)", "value": "23c914c69781d0f2cdacbf4770c87fc03d3c5540", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728144, "uuid": "84412440-9f26-4dd9-a84b-668b064dc3e2", "comment": "Malware payload (Quakbot)", "value": "371d9ced756120bc65b140495e962bf436798385a825130fa89fbe5d39a0c1ec173f717b6ea62d9b61563b05a34e9bda", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728144, "uuid": "2e55ffdf-7595-4684-a344-646b7ba80593", "value": "T14A7441896655E0F15237F37BCE164420F9AB0E4B1088C976BA3C50596F3D8297EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728144, "uuid": "fb3a6cbd-40d1-4c70-971d-f8f2578fb154", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRby+GyiKbhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728144, "uuid": "7495a711-e49d-4772-9cc8-94a2e9303350", "value": 363430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728144, "uuid": "c9989771-3bd1-4feb-bd57-fc87cd5de8c4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728144, "uuid": "07265be4-0346-4c88-acff-fefaf4c65591", "value": "d2NckNLiL6A3DM.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb3f28c-0acd-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686759010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686759010, "uuid": "f7cd33e2-390f-4db0-909a-55ceda78f8c6", "comment": "Malware payload", "value": "088cf13022fc4384b143e6ace59e7349", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686759010, "uuid": "32a36322-1044-440e-9dbe-16cecad0a810", "comment": "Malware payload", "value": "e358e2e2502a61f984e447c645172a46150a21f87689425b4ccdc8dc96386221", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686759010, "uuid": "3c126ced-80b9-45e4-8d6a-dc8396fa690e", "comment": "Malware payload", "value": "d5a7d5c91ae66f86f92dd8522e50637297f17f5c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686759010, "uuid": "a2ba5e4e-96ae-4b92-8e2a-81dbeb4bf7e2", "comment": "Malware payload", "value": "8ec2f44ba4e2204dfb12c2e55ef9a0436bec1ea59300a8a046cd5ac9c60dc8fcc2600c35a2fc362800d55b4b2f75df73", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686759010, "uuid": "2d9a1aa1-4e89-4c70-81e6-702ee2698874", "value": "T1856461596A45F0B18133B33BDA1B8850F97B0F2B1194C967B83C546C7F3D419AAB6EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686759010, "uuid": "b5e383cb-f5b1-43fc-ae27-8891df118fbd", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbgr5+GhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686759010, "uuid": "9713e95f-c616-4de7-b720-8b2391bfbe23", "value": 314516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686759010, "uuid": "c4087311-de46-46d6-9eae-ebe3399684ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686759010, "uuid": "4b5b79bf-4584-462a-a5a7-a1c1b73d1b67", "value": "HY7nYLbzQIGX.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcd8a425-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728484, "uuid": "e03488bb-e108-43f6-9911-05cea335e633", "comment": "Malware payload (Quakbot)", "value": "f9807c72ccd670f2146838b208e127a0", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728484, "uuid": "af5dc488-b41d-4d23-abd5-1349e448571b", "comment": "Malware payload (Quakbot)", "value": "e43fce049074b91782ec0c826b7ce89402dfed3053e23b15d8472264b63ebbc8", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728484, "uuid": "dc33c20e-1fae-4987-a3f1-c7add7d24e45", "comment": "Malware payload (Quakbot)", "value": "992f7a83fe2c2fe108668bea066dae52102a1a02", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728484, "uuid": "2832d5b2-6b9e-4f4c-967b-3a1385c88598", "comment": "Malware payload (Quakbot)", "value": "f3af179afb9404608e02d16859d0d77218aeedcf36d93e2d1ac3ddb16d2e033dfe552e10d8184d18b29deb8903d69303", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728484, "uuid": "832f12c0-51e5-4eab-a93e-10c0bb9cf766", "value": "T1E47433856A55E0F09137B33BDA578410FA6B1E1B21848972BA3C506C2F3D85D7EB7EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728484, "uuid": "298b6860-3cb8-4196-8a4c-e3145e6c6d08", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbKe4b3gNj4mdDhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728484, "uuid": "8ea889c6-a1cb-428e-9f9b-846bbe099ea9", "value": 342006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728484, "uuid": "0a8a2426-0f17-4305-afee-a284b0429754", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728484, "uuid": "9e76be4c-dd3f-4edb-854f-bee47b4db5a1", "value": "UnROZ8OzWeXQ8.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb12c02b-0a71-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686719515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719515, "uuid": "4fbb1903-5847-44d8-92a6-175192fa6757", "comment": "Malware payload (RedLineStealer)", "value": "ecff072c21a7f0fdd06fce11527374ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719515, "uuid": "bef60d59-80a5-4f68-89a5-dfa82458ec05", "comment": "Malware payload (RedLineStealer)", "value": "e4d026295f494f4451cdca57fbeb0bf815b0db6f5b559354128676aac0f5daa3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719515, "uuid": "cdc5bafb-a623-4ccc-b82b-c7de383e2284", "comment": "Malware payload (RedLineStealer)", "value": "5dbf33c4b88858106d91d20bbdc3c41351b014eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686719515, "uuid": "992bcc28-1347-4e2b-ad93-4b82f6b25cc3", "comment": "Malware payload (RedLineStealer)", "value": "e956713261a3047ba78a4d419e9d9b7ba95679b41fbcab4d502931cd2c249c5f0c92ed88d95b58894a72a29122061e48", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719515, "uuid": "dc170d6c-5999-4088-9032-564d97ac07a5", "value": "T1E354E112F2E0D475D8B72A318CF5C6A416AFF4124F785A9BA358173F0AB01E199F631E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719515, "uuid": "63044a25-ba95-4487-b1c3-bb9af58b9744", "value": "f678da7882c86102a2a8a7a8ee56bca1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719515, "uuid": "4860ad53-c2db-4326-b740-7c2b8847105a", "value": "6144:w877YnKTA2k1cVeYYHFHbKKtzUwSZGTg4lvK:wU7YL1c0YYF7KGtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686719515, "uuid": "f4682f5c-56f3-40bd-bb55-2c78e6388b27", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686719515, "uuid": "25422ac2-e995-4048-b2ce-08556fbee7e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686719515, "uuid": "65bcbc7e-f6da-43cf-841c-52218f61d0ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9baeb29-0ae1-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686767563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686767563, "uuid": "ee57d451-923f-4819-ad54-6920679516bb", "comment": "Malware payload", "value": "0199ebd5dba25ce44ecca85711feb797", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686767563, "uuid": "678c35f9-5805-4d6d-9b6e-86cc4c29090e", "comment": "Malware payload", "value": "e4d8c967b7d18bf50068527cec39ec2f3788b1ca0dc5720f7d3f3cf3836cbb15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686767563, "uuid": "f1658bdb-5661-4058-8064-edff585b0730", "comment": "Malware payload", "value": "2ae1eb74dd407c73cb4f21a76262650ff4fd1ced", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686767563, "uuid": "c52bbaf9-08ee-42c7-bb5f-abf69836db3b", "comment": "Malware payload", "value": "997a42fa41ad6db2578bb3ca88803785807f3fca5f1d531bcc734d34411eed474a9aa6a7b9f833e3b8f6add3b67e19c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686767563, "uuid": "45f26a77-da85-41a7-8d43-9e577cd2b349", "value": "T1DF052353FAE99533CEB51BB458F702970E377D969C78922B1A50AC1F09B2190623633B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686767563, "uuid": "8788bd3c-0d72-4ecd-a9e3-743dad5cfef3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686767563, "uuid": "1aaea9ad-cf1c-454d-9ad4-7dcdd651d454", "value": "12288:UMrCy900tgoaR8DJpP6qzW6DYtK5oMWBK1cKp+OAGWnpXr0iw5ILZc:2yKoHDvCBCpcnGopXgiw5ILi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686767563, "uuid": "b7561df1-1d39-4a10-984a-8d2667b5363b", "value": 803840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686767563, "uuid": "651ddc86-0e7a-4ca3-a31e-35ac920bb0a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686767563, "uuid": "f9147c47-925a-4b14-8d24-03ff75053009", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce139f9-0af8-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686777232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777232, "uuid": "80db27dd-af1b-4540-88e7-7bccae371f18", "comment": "Malware payload (Mirai)", "value": "613858374f102e6147f088f32405a126", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777232, "uuid": "72cc38a1-23bf-4ce2-9933-e0af65d85d43", "comment": "Malware payload (Mirai)", "value": "e4fec3fa7aa4d0a535811ea9ef9d69d367cef0d54b24569e16d5ca5e36b1bb79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777232, "uuid": "dfee1f33-18ee-4d87-b281-5bd53eaa7c24", "comment": "Malware payload (Mirai)", "value": "ab6f40077675f0ea71f377175ff216d900a2575e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686777232, "uuid": "da442d87-8c90-4e58-9108-c1636c21f0b9", "comment": "Malware payload (Mirai)", "value": "4f3a6849043eb0d74316b6dc6414eb164ca3e7af7ef33aaefafaca714da83b7aca699c2527f24d980b7d0346f21cb45b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777232, "uuid": "4d046c1b-203b-4777-ae97-d37aac321222", "value": "T140E2E1016C5016F2F561FE33CA2D8B4F904F18F5B89F71C92608529919DE88AD73EA9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777232, "uuid": "9c736a2f-bf14-4ebe-8c3d-96a0be4db66a", "value": "768:iAEu6lLqCV85GClzrm85AgDCDW2rmiG3UcU:iAEHlLqCC5GUzFHCS2i8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686777232, "uuid": "32acf2f2-7935-48d8-9367-094ff051b098", "value": 32600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686777232, "uuid": "c5abb8f1-f634-448f-bc87-b23ddc1ae934", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686777232, "uuid": "3e86a5c0-ce7c-4e4d-b35d-1abc7e087214", "value": "613858374f102e6147f088f32405a126", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ef715c-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686750699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750699, "uuid": "84844af2-f4d2-405e-82c6-6b17f32a6b08", "comment": "Malware payload (Amadey)", "value": "54f05c97b3b37c3ae1740bea2c4cf00a", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750699, "uuid": "0e92f19a-442b-4afc-8234-46ae5a64c868", "comment": "Malware payload (Amadey)", "value": "e51cb12829e155b7a5cc9686d474cc958d955614ee778d211986d7599f958190", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750699, "uuid": "ebf62913-ba9d-4bd0-abe8-09de72cfbe36", "comment": "Malware payload (Amadey)", "value": "707d19d238a5ead86c18a1d30fb6a10a6043ca5e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750699, "uuid": "3fecb06a-dafc-4d1c-a573-70b8e4b7c08e", "comment": "Malware payload (Amadey)", "value": "021aa048fb9cf72a53b9384e0901fab66c01c4b65e73db9945bb75ce606a75a9934a12c4b414ff930a10cce5469bcdbd", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750699, "uuid": "88c4ce6d-29a3-4bc7-bb7d-3085b32a7614", "value": "T1CF24F7217D12C032D96161B619F5BFF2C59C6828ABB049DB7B800F77DA122F73961E39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750699, "uuid": "a886471e-df4d-4be4-a40d-f010fd7f9284", "value": "f8cc61ade86cb7277d0ab974de6323cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750699, "uuid": "b919c48a-1883-4bb4-a0be-6010487d0cac", "value": "3072:CXkSckkHbzG1iXAt60p0zuNmnKG7peNMQbuZAIOb2y3xfbT:8kSDAzG1iciuInRexuZAIKj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750699, "uuid": "5763c261-31ab-4214-8f32-61b45ecbd638", "value": 210206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750699, "uuid": "866f288e-3ecc-426b-a29a-68d449ddbe56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750699, "uuid": "5a50f049-bc6b-40bf-b7c9-975e6fc3c2ba", "value": "54f05c97b3b37c3ae1740bea2c4cf00a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d39ce95-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686750657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750657, "uuid": "649b224e-c41f-4ab9-9770-523eb54937d8", "comment": "Malware payload (Amadey)", "value": "1c18cc161264be70106444b7ee87a19b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750657, "uuid": "2ea3d7e7-1410-4acf-9a89-bcc22481457b", "comment": "Malware payload (Amadey)", "value": "e537754fcfc4ccdaf537eee0cf2035cf1110e936ca85a2759c1a6cedfe6d6cb2", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750657, "uuid": "91beac86-dba1-49a0-a6e0-f4c3b89663d3", "comment": "Malware payload (Amadey)", "value": "78ad515efd27eb626bd417dd23ef2389c6ffdc47", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750657, "uuid": "d98e1a1a-f9aa-48a3-8347-5155bca7464a", "comment": "Malware payload (Amadey)", "value": "8acde661c3e8f8fda0bb2776e01669a2f680eae62f2e58ac501f32ed96c02b55ddbe29616167055895f49127a855e0d0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750657, "uuid": "f5b1d4f0-ec77-4736-a21f-50ff11f87725", "value": "T113D41216EBEC4093ECB027B019F703C32B35BE902D7896673745A98A0DB3994693577B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750657, "uuid": "b0ccb933-44e4-4f5b-9dc2-4155af37583d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750657, "uuid": "2be5a225-15dd-474c-b501-1328f41ff99e", "value": "12288:FMrBy90lfDByX8lxnM27nJ2Xr0IfYfSFMBa+NHmT/a:QyYB5/YpQk+NGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750657, "uuid": "9d4f1a39-3792-4faa-98c9-f47fbde7c4b5", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750657, "uuid": "34a7fe19-de80-4f4d-bcc1-d080b1d66a52", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750657, "uuid": "4f794950-1622-46ae-a847-adb763dc8701", "value": "1c18cc161264be70106444b7ee87a19b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df8e62c-0a95-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686734606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734606, "uuid": "99bd1479-756d-45b6-9f72-a676d1e41f9d", "comment": "Malware payload (AgentTesla)", "value": "e0e2a6129f5ac408a4dbf6c14a204eae", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734606, "uuid": "80a09d54-6618-4d7a-8a25-85b70f8147b4", "comment": "Malware payload (AgentTesla)", "value": "e584673e42523aca0fcbd1f9a25758b75ade4279fa07bd0676bc020a4c08a89f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734606, "uuid": "b51b01e5-b5ee-41ee-b1fb-b936f997dc93", "comment": "Malware payload (AgentTesla)", "value": "81d766586f60cb81044efcdf13c8aa923f5bd3ca", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734606, "uuid": "f5c4e876-f6b1-46e8-9f0a-fba804658935", "comment": "Malware payload (AgentTesla)", "value": "f51b8ccd0bd7ec68882bcabdaf72393725d96239f270817b93d3630dd041b211f2c641c78471305f01061de08b37c866", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734606, "uuid": "1933c527-79d5-40ec-a440-2e7414ea196e", "value": "T1E7A423573C9C584D562F8021D64374B66AEAC2BEBCC062D6C3D68706DA00F35EB179EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734606, "uuid": "96df3585-f493-48ab-b8a2-92d0ab37709c", "value": "6144:qSuBK8y7e0GltNzKS81SeFlai3o6bmq4Nnhq/EcgjG02ctnmT2XA6fnw:kR/tN2n1Ui46bIhhqs1KynmoRfw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686734606, "uuid": "2f707d4e-4f3e-45c9-aa7c-d732370bdd5a", "value": 452128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686734606, "uuid": "791df4da-eaed-4e93-9fcb-172bfc5c4b73", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734606, "uuid": "c1b62b47-94cc-469b-9153-a70e1eaaf692", "value": "SOA.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b4d9302-0a9f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Loki)", "timestamp": 1686738896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738896, "uuid": "690954d5-d585-4395-9dca-a7fc0e19c43b", "comment": "Malware payload (Loki)", "value": "418aefdb083ce19b972f4573f3ed98ff", "object_relation": "md5", "Tag": [ { "name": "45-81-39-192", "colour": "#C80259", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738896, "uuid": "1b310bc0-803d-4aed-ba21-940fa526ce4d", "comment": "Malware payload (Loki)", "value": "e6d3f9dc2815e9f7604382a83ffe91cb49a32b2c7866ce9a321a1fb4c35c49e9", "object_relation": "sha256", "Tag": [ { "name": "45-81-39-192", "colour": "#C80259", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738896, "uuid": "8bec8e12-aef1-4ab6-b011-95fd8c84d543", "comment": "Malware payload (Loki)", "value": "bd9dde0f672a66ac0da55b00106c713aefe693f1", "object_relation": "sha1", "Tag": [ { "name": "45-81-39-192", "colour": "#C80259", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686738896, "uuid": "d14d0c71-d558-48f7-8a70-e7a11e7314db", "comment": "Malware payload (Loki)", "value": "602172d7fe60f3d0c57bf0a1e88e4b77bba5255cbace67f176c47c7c426090ef4a3613e830386560446a1d6ae5a5f92e", "object_relation": "sha3-384", "Tag": [ { "name": "45-81-39-192", "colour": "#C80259", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738896, "uuid": "4d0883ce-b9f4-47d1-bf79-aa7d1148084e", "value": "T1F8D202665B8C4C61E25AF8B7865DE00E58BCF63234C215C4BD9DE2B47B3D10E4B6A1B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738896, "uuid": "6a886242-e284-4a7a-8875-3cf1d268d684", "value": "768:xeXX2cCsj02PMV9v4ovzJeBAE9o8W7ShmIHVNR3GyOwmEU:xC2cCsY2EVJ4ovBD7ZCbcEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686738896, "uuid": "fa13408e-b9db-48f8-9f3b-4ca8559d8a81", "value": 28669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686738896, "uuid": "4314c887-f8b6-47e9-b28d-23a256c7dab8", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686738896, "uuid": "4ee8bb5f-6080-462c-9063-4f1b24f17f78", "value": "sws.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbc26cd-0aeb-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686771888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771888, "uuid": "4d01988b-0cb3-4366-817e-3fa08507e585", "comment": "Malware payload (Mirai)", "value": "aab1b7b31f208d8eb407ff6901be78fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771888, "uuid": "a1335296-7f48-403c-8b8d-92ee239f8f65", "comment": "Malware payload (Mirai)", "value": "e70413db4c15aa56f44291d2e281d106a83726f0eb20a3665946cb03fe87029b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771888, "uuid": "cd8d090b-3ae7-4947-9551-66b5d07c524c", "comment": "Malware payload (Mirai)", "value": "fb944e4604621a71a3a5b7e7a4645294b8af44f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686771888, "uuid": "850677c0-961f-4b9d-8949-3c16522972d4", "comment": "Malware payload (Mirai)", "value": "16944d723c512f9a4f64fa68844904c16b8726dee9669e5581847a762a1fb8e904d3df8e61b854800cade80e8772ce49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771888, "uuid": "30667dde-4660-4d00-a8b9-3e39ab1ab9b5", "value": "T16A432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771888, "uuid": "5772f96d-0c3b-4edc-894f-a9e2a2fb78b4", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwj:RqtmZPuutfbltZFBSJsBcfDSTFI+BEj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686771888, "uuid": "cc10dfbb-d9ee-469e-acf4-56bbca8e78df", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686771888, "uuid": "e6fb23f0-20c3-41fe-b22e-437b21853a4f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686771888, "uuid": "d6a81620-c394-40fc-9233-94ba51805185", "value": "aab1b7b31f208d8eb407ff6901be78fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ee3ad4-0a6f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686718402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718402, "uuid": "897e84c9-b871-40c5-9d33-8f81aebf77e7", "comment": "Malware payload (Formbook)", "value": "ce2cfba268902b485d863ad2880e613a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718402, "uuid": "41717b0d-0805-47d0-ba0c-ed856abbafbf", "comment": "Malware payload (Formbook)", "value": "e83a100ef343119544c86c96100a05b5a710fc04479d6ac1673cc5ec6c8d11bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718402, "uuid": "15bdca72-85fe-4928-8210-e92d944a5deb", "comment": "Malware payload (Formbook)", "value": "f6bebe9e1a8b8bc9452ac28d5d0403dd3674c88c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718402, "uuid": "b5e5a94d-65db-4ad3-ba0b-db0aa54340f0", "comment": "Malware payload (Formbook)", "value": "ea6efa2d1cc96c37467e33407592be27bb087cd306200797e60a3f6ad6f9ae645e6c083dc358b4d844c55ad8dc7040b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718402, "uuid": "64bbad6f-c32d-45eb-a7a3-0b0a681bcd62", "value": "T15205D0A1723B1A27EAB88BF50150527097F62E5FA25DF6D8DCC2B0DB52F0F804A51D27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718402, "uuid": "c5a5b8bb-81eb-40e4-b86b-7b9a9cdc10d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718402, "uuid": "432123df-31ee-44c8-9750-2972c9f5e2ba", "value": "12288:WlKnuoEXqXdVMPi7GBjB317PLgFh3iL6PfbyAO5iNrNRqcbMOrWv:jh4qXdVtSR7PsCL6PjfNrClOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686718402, "uuid": "14ad394a-592b-4e32-b1af-862582fcc8f0", "value": 835584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686718402, "uuid": "b9737a16-0da7-4b2b-b36c-ee5877acc248", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718402, "uuid": "6bd7d421-10ab-46ab-be0b-585a28cca4fc", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009778df-0a61-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686712223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686712223, "uuid": "0361036d-24f7-4ea5-bf0a-333473586a98", "comment": "Malware payload (Amadey)", "value": "ddf9b79fe7f9490ea76f50ba5b37d4a4", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686712223, "uuid": "19a1e4fc-bbe0-4132-a9e4-ef003c8f705d", "comment": "Malware payload (Amadey)", "value": "e8f5a6e4da45ed2ef4566266b31858251db870931c6fc2b7175a21dd2c2ee3b5", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686712223, "uuid": "baaa9604-4188-433e-85d3-36a9ed01e3ef", "comment": "Malware payload (Amadey)", "value": "fdcb57b2748ec7dfb838d4f4fcd84dc4bfea3f52", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686712223, "uuid": "29b13c81-6373-4d78-9d08-fb1d9a1628a7", "comment": "Malware payload (Amadey)", "value": "bdcd8defcc13b67306ffc47500c41a68fd7681f59eba5c7313f9a4fbf13f2ef6ebc0ca959e20594f64f8024cf76c28db", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686712223, "uuid": "5a1cf858-9eb5-4a71-aae1-770319969977", "value": "T1B8F423526FF49032EBF6273008F203974B327DB64DB8475B6745982E28B3A84E476767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686712223, "uuid": "8ca935c0-727a-4e9d-8eec-06b26d76ae91", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686712223, "uuid": "7ad6fd87-f1f9-4a79-8675-3e6f307d3443", "value": "12288:iMrYy90TDtfNFH1DVE1AYdSBw9dTZo2Exlj3uzvb55PCuOzfgirP07:2yKHw1ZEXyzvb5UWijo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686712223, "uuid": "bab41039-8b5c-4da6-80a0-f936e91b50fc", "value": 787456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686712223, "uuid": "d01640d9-1eca-4c40-a367-b738ab0bc914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686712223, "uuid": "b3f5ac4c-3d52-4897-836a-41cf6873bb78", "value": "ddf9b79fe7f9490ea76f50ba5b37d4a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b68127-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728655, "uuid": "d95f5583-5cbb-40cd-bf04-776b0d1d18e9", "comment": "Malware payload (Quakbot)", "value": "139175d271c79edf24c48579b550a45b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728655, "uuid": "3d87e1a5-3b34-4077-b11b-f087a837fcaf", "comment": "Malware payload (Quakbot)", "value": "e918e17a0a639c0f284a76059249a8398b71eb09bb54e4409fe6ae526a332431", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728655, "uuid": "efd78b17-6e96-438a-92a7-1e7242883928", "comment": "Malware payload (Quakbot)", "value": "512a047de067eb4fa6b7c6b4f224e05672b7fd36", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728655, "uuid": "391b4002-0666-4a73-9e61-0a31b7e3b13d", "comment": "Malware payload (Quakbot)", "value": "e5a8fd5ace732421c7e14d8f83f246aaa666140f9e63ceb802d0b09f9f787e19205f7827dff87fa3786d585db78cd497", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728655, "uuid": "c0dcff1c-0126-4c04-92ef-27b165e6d344", "value": "T1B37455896A45E0E14037B337DA578420FAAB1F1B2084C972B97C555C2F3E86D7E77E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728655, "uuid": "35c77b06-aabf-4f2f-b8d8-76ed44e2c763", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbVrND9ZcrWd3EhS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728655, "uuid": "9aa7dcce-d147-414b-8c48-a867cad29d0c", "value": 343958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728655, "uuid": "817de25d-106d-4e1d-bcb1-76670b9c660b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728655, "uuid": "3f0e0fd6-3761-4209-9636-76d0aeb9726f", "value": "SLyRRCkPdUhEg5.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71bcd4a2-0a75-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Gafgyt)", "timestamp": 1686721003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686721003, "uuid": "5f424206-3dad-48cd-b56b-69e04031ba44", "comment": "Malware payload (Gafgyt)", "value": "25b648abf9e73597e019f4679ffe9a1a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686721003, "uuid": "b8b62cc5-6e6a-457f-bf6f-7f286b492d7f", "comment": "Malware payload (Gafgyt)", "value": "e939849db1d5a22fc8d236c834d6272d878ca5c998e4be3f999028638c8e105d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686721003, "uuid": "ee4580b4-99be-4c4d-b016-531ea5c7c71c", "comment": "Malware payload (Gafgyt)", "value": "904d1c98eadf57488b71ff9fedfe5875f2488f69", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686721003, "uuid": "62f8105e-6535-47f1-ab3e-f59a6b8c24f0", "comment": "Malware payload (Gafgyt)", "value": "d34d9f647e22a642a9de20b990390a1ff827e50bca80bc69fc34858023b8caaa1cc1b2d3b8f415ab0b0d1b2c1e7ce958", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686721003, "uuid": "ad418071-e83d-4c4c-935c-c6a31df72151", "value": "T1C943029EB3CC99F1F45425BBD493802FA1554336FAE432701919222FEF88496AB34633", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686721003, "uuid": "ca7801ca-c8c8-4b06-aff0-a73901924201", "value": "1536:+ubt8yj1HszcFVJjIxabf+rb59oT582oO+:5bn1HPJIxabKmT+2oR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686721003, "uuid": "270fc40f-7d21-4760-87f6-5fe368e47f52", "value": 56820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686721003, "uuid": "77c7564b-4fd6-4976-8c04-e0de1e83e24a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686721003, "uuid": "8e99ee0d-6df3-4f05-a58e-e14cef3e10ad", "value": "25b648abf9e73597e019f4679ffe9a1a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51a0252b-0acc-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686758315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686758315, "uuid": "77ea6e09-7d42-4c6e-968d-0cd6d1aa6225", "comment": "Malware payload (AgentTesla)", "value": "21fdfa600fadab7c8e68401ac768906a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686758315, "uuid": "0a0db35d-f8bc-4d2a-979d-cc7d2e1ed5e6", "comment": "Malware payload (AgentTesla)", "value": "e9703790c616ac9dd9bc823da2867d5df41dcb51c1c82bd83d521d8feea5e8f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686758315, "uuid": "4d3448db-84d9-4747-8bf0-413d10a74de1", "comment": "Malware payload (AgentTesla)", "value": "84f4eb2ddf8753c4b44be2b259b101d8f14047fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686758315, "uuid": "66ea0cf5-dc6b-41eb-b774-7bc74ccdfa95", "comment": "Malware payload (AgentTesla)", "value": "ad5946d089c93c7715f9152458a6223ba13f25e80ed9b8bb82ef02b3d77551bfe91b16eea40df1d76f0fa0dc6d91322a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686758315, "uuid": "7bd7b34e-cbc9-4814-9aee-7fab7984650f", "value": "T1B7050284ABAD870BD8FB27F4656491740BB1B96B743AD35F0E42F0E66663B100E11F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686758315, "uuid": "b9590d2e-befa-417e-9a2b-6babcc801734", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686758315, "uuid": "71033ad7-a6c9-4176-956b-e039877c8ab9", "value": "12288:WNLrX/CfLe2zL5DpO5urUfImdY4UXgACm5basf9LjYqWEXqXdVuUE:Wv2LeezO5urzT1Z5esf9Lj/W4qXdVzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686758315, "uuid": "20d6290b-322b-4a70-b7c1-29d23fce2068", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686758315, "uuid": "65f1c910-70a1-4372-9a9a-9974e8a77698", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686758315, "uuid": "39603f1a-71e6-4e29-99cd-ca4c29fd342a", "value": "PO-61423.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d64f0a-0b01-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686781198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686781198, "uuid": "c0d21459-a27e-4c46-ade5-1cf5e37fdf3c", "comment": "Malware payload (AgentTesla)", "value": "f01a1c028cdfdc1e918ee317ad00b08d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686781198, "uuid": "d33aa5fa-fbc5-4ed0-ad59-059f6900131f", "comment": "Malware payload (AgentTesla)", "value": "e9b0ec0a9227f39255d2febd7eb08b56e436ba8e10d8d894294937b380eaf320", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686781198, "uuid": "d8d47b71-a841-4ad0-b6a7-5dbcf4cc3204", "comment": "Malware payload (AgentTesla)", "value": "11d262e4079386a30c73c0525290b1dde01f4abc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686781198, "uuid": "be465004-98eb-4c56-860d-d03ab27201e7", "comment": "Malware payload (AgentTesla)", "value": "ab99f653be2598c23417a4ae17a54afc3d88eb46aa63219d7b869259d5f66019626b982cfd72c8f984c4016f83b292ad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686781198, "uuid": "e13df119-2915-499e-af28-5ece8d547389", "value": "T13FD4F11B164B8836C46506FC5635E2FDA2326FE8252BC32AE9E7BC73F1793435C0A195", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686781198, "uuid": "19257fca-4b66-4c7c-9e78-3dae8e8869ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686781198, "uuid": "b00d897c-cd08-452d-986d-689c085c3875", "value": "12288:i+nasnHFXq6c/hApjmqwI7V2sIrg8cUdJXks:pHhqvYaqwSEst8cK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686781198, "uuid": "bb6da394-52a0-4470-ad30-fbdf4341179e", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686781198, "uuid": "78b0be1f-6111-4522-bac2-992c610d64b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686781198, "uuid": "8b7370e6-e816-4880-ab33-94a166720cb4", "value": "9292095.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36830d24-0aa3-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686740660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740660, "uuid": "b62005ea-47bc-428e-8337-4bb25dd22eaf", "comment": "Malware payload", "value": "563a836720b1e8668f69052db9f8f234", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740660, "uuid": "b98553de-cf72-41aa-a675-54373d228f3a", "comment": "Malware payload", "value": "e9bf2748b558e8d186519dc467dd2178d3ae17976c0f01c958e62e040465dd1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740660, "uuid": "f1b676f1-6011-4204-8769-aea7817d11f8", "comment": "Malware payload", "value": "b61c7c42bfdd457c446042fd51ea25c0f09ecaff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686740660, "uuid": "2707107d-248f-4329-a0ea-66cc04d749ac", "comment": "Malware payload", "value": "e5fb4d1dec339a81517fd9118257ca73f4332fc9113f4826a1cb32331eef71dabf5746a7ff0fc730bf20eeb4b50695d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "meeting-app-org", "colour": "#01C678", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740660, "uuid": "bfccb887-8f3b-4336-9271-0b51dc99116a", "value": "T11D7712D26A8592F8C18381385143039B25E074CE8BBDAB9F39C5DC123E52FFA1D6DB65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740660, "uuid": "0bdb8792-9a36-4571-a00d-165876900e99", "value": "b82d613d4436173e2ed82c5b2ad15c92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740660, "uuid": "727f1f12-0693-4b90-8378-30b9a5981221", "value": "786432:rkF25ESc0VqBqL1EG/6K54olc90MFb825QwX/xSO:LJcNB81EPoe7F95BX/xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686740660, "uuid": "8535210d-1c7d-4c5b-876b-44227075c437", "value": 35775120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686740660, "uuid": "6bfe9e33-38cd-4753-9948-3bb2d131d7ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686740660, "uuid": "16cb6878-b301-4f15-9b2c-be67297a1ea7", "value": "e9bf2748b558e8d186519dc467dd2178d3ae17976c0f01c958e62e040465dd1f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2612e2ef-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686750511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750511, "uuid": "4c5e8fce-a360-4593-99ce-4f5f674f9017", "comment": "Malware payload (Mirai)", "value": "797ab7efc4376cbae38975d01a6e08ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750511, "uuid": "5b19a9d6-094f-4ea3-b8f6-c426352ea293", "comment": "Malware payload (Mirai)", "value": "e9d9a2bc4df85e802c5ec6e2306754c078d450132e3d40722c0f9a7eea57f4dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750511, "uuid": "d0ebd84c-0b3b-4603-b193-230984e8e494", "comment": "Malware payload (Mirai)", "value": "ddcf1ca4a246498750caf0f389b5d71869fa2832", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750511, "uuid": "6bb0ff91-b59c-43b5-b9d4-b4df1db8ad6c", "comment": "Malware payload (Mirai)", "value": "9bba67fa12f04376d35ed984f267f26eb9717dafef8f0e7d2dcea06a51869210cfefaa0fb9aebcc5042ac4733848de90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750511, "uuid": "a6b17218-4c17-43ee-8c16-588e63b37c02", "value": "T1B3A2E15211C9E123DC05573A3B1EA8D9A022B0429FD3C794FE56A4DAE3D24C7B729C4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750511, "uuid": "bd235151-a6bf-4ca5-8ba2-3f125504280b", "value": "384:Ma6R9gWWe+6napkdlDMFhjgxBCKdkpnHaTmpnIvwi3YrTt9YebCB8ejAO/CJy9vT:V6D51SFuxIKdkBpli8X3YOgvNV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750511, "uuid": "64daa05d-60ac-40f8-b7e8-660cd92c54ab", "value": 22704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750511, "uuid": "6b7eaeb9-e17c-4f27-a6ab-715487b57497", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750511, "uuid": "25fdf767-436b-4074-8b1f-ac65b6a01978", "value": "797ab7efc4376cbae38975d01a6e08ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e43116b-0a9c-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686737747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737747, "uuid": "828865f0-ff56-40e4-b3bc-ef3ce4590337", "comment": "Malware payload (Amadey)", "value": "03794dcc205584c5749a3361527fa436", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737747, "uuid": "07c9f76d-4b9d-4ade-8c83-5c12b4fda02b", "comment": "Malware payload (Amadey)", "value": "eaaea60d9b4608bace5567c5a075dd95db16599aa625847eb8d499bc7fe0f47c", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737747, "uuid": "e3e265c6-1647-4676-bab0-c7c75dd26ee6", "comment": "Malware payload (Amadey)", "value": "8e165a5cc3965270944c978fe6e4708efd8a658a", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686737747, "uuid": "b10117f2-ef64-457f-a704-1c0b554dfcdd", "comment": "Malware payload (Amadey)", "value": "86d86b1134f182ed001c79c2927196de08ad3f5a0ba37db68ca52d80df56e4ee27617e2c1410f19ef94f4771d40d2dd1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737747, "uuid": "1b30576d-18d6-44ce-bf33-b0834d29e37c", "value": "T161052253F7CC8127E9B6277169F603831E36BD618C71822B1A85AD5F4C73A50B0727AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737747, "uuid": "f6c6b7b6-12a6-42b4-9737-2ea7e9d41044", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737747, "uuid": "728dc6e4-fdcd-47fb-b7f4-5fe341790460", "value": "12288:gMruy90e5mwl6y5r2TOyZJdi+Eg5W+grlVGsNUOuDp3rWtVt9shX0iVTpzRBsofS:+yNcXyZ+Eg5W+aVGP/DVmsN0iR9fS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686737747, "uuid": "56b7a382-ee19-44e7-96ba-7a33ca1e9f74", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686737747, "uuid": "d841577d-2884-4646-99d0-0d31a5fdb3b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686737747, "uuid": "017fec2d-024a-4538-999f-a69815334bfd", "value": "03794dcc205584c5749a3361527fa436.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "808582dc-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686750663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750663, "uuid": "be33db2b-262b-4d29-b655-5e34bacbba2f", "comment": "Malware payload (Amadey)", "value": "30262bc52d969d02362ee57b20cef25f", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750663, "uuid": "1315b246-ee2f-4c38-97c3-f5200f490c9f", "comment": "Malware payload (Amadey)", "value": "eae4cea34cec403048cf411e6f2fba11351c2fdf9d0ae9015cb2390fc01d5947", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750663, "uuid": "c0fa6bb9-fcdf-40fc-a9a8-3366b01117aa", "comment": "Malware payload (Amadey)", "value": "dfb3d37f2cb300388ad1911622d72c31642203f8", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750663, "uuid": "cf692156-e42f-4d75-ace7-90ab200fec9b", "comment": "Malware payload (Amadey)", "value": "59d4578dbbcadb2121c97a18d127b516497bda348fd8ebfa3063047f44003c1e6ac1557539a942fb961e1eee68ee0d7e", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750663, "uuid": "07a8d2fe-384c-41ee-9e6d-6353835d0e4d", "value": "T1C9F412176BE44472DCF42BB048FA53D317397D759A34837F1382998A48B22E9B23572B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750663, "uuid": "f0c10825-998f-4339-a118-62afec9c86b2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750663, "uuid": "84373eb6-3b90-42d7-9b2c-f3b8201e4ee0", "value": "12288:7Mrny906pQfRuEsgmdTGjwKoio9aVSabdmGdAYeqQrGX4kw/V:gyNa5uEAdTelmawabdeYBVX4kw/V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750663, "uuid": "3bdf9466-80c8-437c-bafb-b00e301e7e11", "value": 767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750663, "uuid": "42dd1571-fffc-4787-a34e-4d550e561cc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750663, "uuid": "69e7c93c-8cc3-4bb0-ba45-c071619d5a88", "value": "30262bc52d969d02362ee57b20cef25f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c1272c-0a7b-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686723633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723633, "uuid": "45cb7c1a-13cf-41a0-bc92-3ebd991d61ff", "comment": "Malware payload (Amadey)", "value": "180c48785c32065b9de7b2bc4704fe2b", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723633, "uuid": "60ce5d78-50de-4daf-b137-fdc14d9baa41", "comment": "Malware payload (Amadey)", "value": "eb2cb0dd906110f051d7c49dbe7c28f47b48e32c999da1534b776dc94a274c73", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723633, "uuid": "c113812e-9150-4108-94ea-dbdf3e2e8f76", "comment": "Malware payload (Amadey)", "value": "7169f7f0c7915d42916c3a8d8fbc8032e63d3565", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686723633, "uuid": "f027c2da-68f9-495f-9bda-fe42228342a5", "comment": "Malware payload (Amadey)", "value": "0ec0fd34df62641a0ef0f4c8af0fc80ddfbc5615ab84c71cbaad8163504f3f0cce02c20985337fedac4af5efe72faf8b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723633, "uuid": "9307207a-508d-4751-bcba-812d6b8343da", "value": "T135D4125297E88133D8772BB05CFA02D31FB57DE1197C8367270A695A0C72888E93677B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723633, "uuid": "32e096a2-a877-4f13-8ca0-0cd4804f064a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723633, "uuid": "c9885f47-6293-45b6-b3da-9a65ebc9d4c5", "value": "12288:TMrOy90COATx2Yqw0tNiunecamu2OwX7JCOrbhdf8FuyLj:RyTOAARw0tNiATamu2OwLgof0Iy/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686723633, "uuid": "d294dd08-0aa8-48a3-8ddf-9eb64405ede9", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686723633, "uuid": "820ec119-9c92-4a4d-aea4-1820d649eab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686723633, "uuid": "b538abb2-bb4a-40ad-9b18-53e8b2c3510e", "value": "180c48785c32065b9de7b2bc4704fe2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22af38d8-0aba-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686750505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750505, "uuid": "93ec129c-9e8b-46ab-ae0d-59f6b7691c9f", "comment": "Malware payload (Mirai)", "value": "2ca17a31cd78cbe5b54e99e923913ed9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750505, "uuid": "331b7911-c121-48bc-9f4e-191bf1e6eb64", "comment": "Malware payload (Mirai)", "value": "eb5cce599dda090b75bd020c0eb2fe3f16b1c2ddd3e6a62649c3126ad846e637", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750505, "uuid": "2700b695-d67f-4656-8b21-953f069ab335", "comment": "Malware payload (Mirai)", "value": "dcdb34e9e498cabe8dd818424bd5ebeff8832840", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686750505, "uuid": "a1957eaa-fef6-4513-acea-f4737ef4f93e", "comment": "Malware payload (Mirai)", "value": "31193be5713e51078699df41b7b683957c0c6c3e39b8bac2b58b04be0fe0bc9c442d29b0454ee7f39f97753f05d1645f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750505, "uuid": "9609f5d6-fcad-4b26-9512-1db93477a7df", "value": "T10FC33B06F5514B53C1C3177AB69F521977232BB897CB33229A24BFB42FC179A0E3A950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750505, "uuid": "30fef8d2-5d29-428b-a7dc-b00007525acf", "value": "3072:Yd5adFfNQamBJl1OM5hudKRvF2/bBbmOQUJ1UXpTn:E5adFf4OM5hudK9FabBbmOQUJ1apTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686750505, "uuid": "3ff0898b-028f-4c74-b1b6-573c37e3b94d", "value": 118812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686750505, "uuid": "107d7f38-d6c0-4e5f-87eb-b4def1a3736a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686750505, "uuid": "3928c97d-3934-4287-813c-509699d064f3", "value": "2ca17a31cd78cbe5b54e99e923913ed9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2ce06e3-0a73-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686720333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720333, "uuid": "f3855273-9ece-48cb-8fb5-d2ca25c1ad7b", "comment": "Malware payload (RedLineStealer)", "value": "61cafbe3b44581913986fae838b9b058", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720333, "uuid": "7ca46c19-4ad0-40d3-8ab6-ff3dc4fcd94a", "comment": "Malware payload (RedLineStealer)", "value": "eb6387debe9316951a92ba6ebac65383b0ed86019a577802d178f83d61abb94c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720333, "uuid": "17558609-a31b-4299-9d22-512f071ae59a", "comment": "Malware payload (RedLineStealer)", "value": "b66e7307b282618ba1c419f6f54fb8f52df669d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686720333, "uuid": "b30ff4ab-f9be-4284-a1ff-eaf1320e8ef7", "comment": "Malware payload (RedLineStealer)", "value": "e100b51cf3aaed4a08db3c89aa45b3d1306f605e67f3ae4ccc9f63658331002f6aa10e9fa18ba11a43bddb89b905a86b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720333, "uuid": "6dc8b6c2-5d79-405f-827a-abdf6be72a0e", "value": "T18FD41292B6E88073D9F527B059F10687073A7CA19EB887373696990F0CB27C4A57077B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720333, "uuid": "ea87ddcd-4231-4280-9dd2-73bb85546c16", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720333, "uuid": "38bffa19-e4b4-4b2e-86d6-7afaacba0d52", "value": "12288:+Mrby90QVX93QAPWxMW69GXDPejrpvq4fZeTcWXpAPw:Fy1NeZ9QGXD6ZHReTfpAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686720333, "uuid": "d63cb127-9f74-42aa-84f5-55f99737e422", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686720333, "uuid": "281870ec-13b7-45a7-9880-9610dfce34a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686720333, "uuid": "9a6beae1-0763-4079-a00d-7e9e8cf61460", "value": "61cafbe3b44581913986fae838b9b058.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97e1fe9-0a85-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Smoke Loader)", "timestamp": 1686728075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728075, "uuid": "5fa341d3-e95d-4aef-833f-555875cd5584", "comment": "Malware payload (Smoke Loader)", "value": "22b52826983dda65910e1d97a1c2958f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728075, "uuid": "53dabd10-0e50-4db8-bbe6-95ad57c806ed", "comment": "Malware payload (Smoke Loader)", "value": "eb70d795a9bc30cd25af85d26eeb6807375dcbb5ea1cd3648df10dcd7f6f717d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728075, "uuid": "d7f013ff-ad39-4c1d-b426-051eaaec5cd7", "comment": "Malware payload (Smoke Loader)", "value": "b5fc36a40004ad6ac64fca74293413d83e3c8bc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728075, "uuid": "aac51ad7-12f1-4a0a-a37d-f9ee2cb6e558", "comment": "Malware payload (Smoke Loader)", "value": "27f7ee16651d0e807d7027dc7a6d8813cc2c644131ba5a30b427051e8f4ab47c3c07b13c71f1dece80ae2a304284a6f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728075, "uuid": "6e0e1395-0e97-479f-a97f-70364ad77c6e", "value": "T1BB64CF113224FC53DC4C2DF1781B99ED9EA74E701AAC063AEEE07A093B71B0B975E255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728075, "uuid": "9c170bf2-d70e-4c3f-9ef2-597749e81424", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728075, "uuid": "89906da2-77ef-498b-a7e2-369454c367b0", "value": "6144:39X0GWKbOg4xxABZ50EesSYG2ANfJZVNwzK7WVONtJ0543gfpw:R0zaORREe19DVNqUWyDJ3iw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728075, "uuid": "e2476277-05e0-4cc1-825d-1fe685d04a10", "value": 328952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728075, "uuid": "53077b3b-fc68-43b0-8aca-218847e384b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728075, "uuid": "19b2ddda-3220-4c3c-b9f2-ee0c85d8a5a7", "value": "ORDER-11028874..pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03e9d68-0a8d-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Amadey)", "timestamp": 1686731442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731442, "uuid": "aee62376-c86d-4a04-a7dd-b0c19b508e53", "comment": "Malware payload (Amadey)", "value": "2a2cbb1b64c23ab2a77d840e6a7b52b0", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731442, "uuid": "ed2028a4-40d8-4435-b920-f9434de3ae8e", "comment": "Malware payload (Amadey)", "value": "eb981830f8dfdbb251d95234c1e5352eae56b8d11f26de0b2404c388b021c1b1", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731442, "uuid": "9b15bb23-7654-415c-a13c-e6ff3b7755f9", "comment": "Malware payload (Amadey)", "value": "68500a4e7d9b05b0fcea7f98d38133037244a9f7", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686731442, "uuid": "84429d91-1eca-4618-a2ca-996367c2a1c1", "comment": "Malware payload (Amadey)", "value": "423fb36f0edfecf5a608268771d23c12d94c7c2dd879b197cde7582bf69309f465a5fc679c62cadd14c2eb84e52641f3", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731442, "uuid": "b0ce0977-7a8a-4992-ae74-2bd00b9534fd", "value": "T193D41242A7D48433E9BA3B3059F713C31B357DB18969836B37D99D890CB2690E472B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731442, "uuid": "3e6ed104-2d26-4c83-be74-de9bff49322d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731442, "uuid": "51d6c535-01e6-4e95-91ca-e3bbddf2226a", "value": "12288:cMr3y90I3TdX8QhlomwhtQfbribbUzOYk2yaVZ:zyF3TdMMMtQfafUzOYQa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686731442, "uuid": "a99fc759-79b3-4813-af98-e4300d597036", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686731442, "uuid": "d27bf167-1527-435d-bf5d-3e945e8dff30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686731442, "uuid": "82d08f1c-6433-4177-810d-d16b90724f77", "value": "2a2cbb1b64c23ab2a77d840e6a7b52b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48c029b9-0af4-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Mirai)", "timestamp": 1686775480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686775480, "uuid": "72eaa207-76e1-4bd0-8d48-7bf65ba5d3e7", "comment": "Malware payload (Mirai)", "value": "4378064471f062e650082bc047dcbb33", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686775480, "uuid": "caff6454-7997-4f51-a42e-3d1351045636", "comment": "Malware payload (Mirai)", "value": "ec06fd8eaf84ff204657f8ad7cb18c7a9903ac875ae32dcf5b9a9496aeaef9e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686775480, "uuid": "6d4153d2-cb3e-421c-be36-8acc1e34336a", "comment": "Malware payload (Mirai)", "value": "5e0fd5864bc91201f7194cf776bda702f70d68f5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686775480, "uuid": "4ba1b864-8d06-470a-b7cc-a0938a0eac65", "comment": "Malware payload (Mirai)", "value": "995dca647eca7aadb2cbdfed216771d3cad3ec40a6d1525b58cbd632c5a2ccf114bf46d3d8ce63d01afb1889ed375ba9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686775480, "uuid": "1e555517-2386-40d9-80db-0fa40c6bcf32", "value": "T13213E1E673679754C16D90B0668FBC820410FB19A0804BA7EBCD37B6CD97F6C2D2971A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686775480, "uuid": "be4a5d1d-cc4b-41a9-8f21-4518442844f3", "value": "768:5FBDCpExX3YGsGyjoqIWYd5vz8OnbVeJtZ/gAvAVkOdY1Uo85dnbcuyD7UVyq4:5/mpExCL8WYvIOn8tXIqOoUp7nouy8sP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686775480, "uuid": "b7a32b08-2845-48e0-87c6-d7b60b12d10f", "value": 43448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686775480, "uuid": "04d3f2e6-8e11-45dc-8b16-60def04916c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686775480, "uuid": "15ce8f50-aa04-4aa5-8c2e-139a55050df2", "value": "Yboats.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5288fb-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686725798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725798, "uuid": "96a87750-8193-4538-86a9-2479bdf4769e", "comment": "Malware payload (Quakbot)", "value": "8b55bd0d7a63ae9bf5a4166add67f7e1", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725798, "uuid": "bd809d7c-f301-4eb6-942e-86d53066600a", "comment": "Malware payload (Quakbot)", "value": "ecd880678a249910b68ab6ee237be079049165ff0c4dff22355823e84ac59d9b", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725798, "uuid": "516af89f-002d-41c0-8660-51b24914c9b3", "comment": "Malware payload (Quakbot)", "value": "84dbed00c44ffe27748b04a1efa6a94f3b5329de", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725798, "uuid": "b6696f2b-c938-45ac-bb3d-a0f8baf90c6d", "comment": "Malware payload (Quakbot)", "value": "24ce86f9afdb4e19fbb53aab2a309b9becb3bd4155f39b0e96cf693a41f12c68e124c95551d34b145d17fb03bcf50a41", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725798, "uuid": "3ee6ae15-5235-4071-8809-57b4253ec0c9", "value": "T1747463496A44E0F19137B37BDA574420F9AB5F5B20888932BD3C505C6F3D8297EB7E88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725798, "uuid": "f975142b-5d12-4782-a33b-89854aa46a90", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbnNBxCfBAUizfWTFwrDHB5pe:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725798, "uuid": "36674f24-8bbc-43b8-8374-10c6a9b9b629", "value": 348046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725798, "uuid": "fbe51763-685b-4363-8d03-55a2731487c9", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725798, "uuid": "38f07dd6-e5e6-4acd-8d28-51823618a4d9", "value": "jlcCn1rAoRSNa7.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d70f68-0ad1-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686760464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760464, "uuid": "440a006e-0326-4305-87e0-5a80c8097416", "comment": "Malware payload (Quakbot)", "value": "14c84f5847acee09fd079c0ee302864b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama268", "colour": "#C8D754", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760464, "uuid": "72abca37-5799-4e72-845b-1c2ecbe2d3af", "comment": "Malware payload (Quakbot)", "value": "ed5dcad3d414a0179732324c6e5581d37e0b6d275dfac1feb6ed66cde47dd1d3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama268", "colour": "#C8D754", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760464, "uuid": "dd2d5e24-4cf7-4b78-8d25-8e1159d605c3", "comment": "Malware payload (Quakbot)", "value": "e9340c9e0af2533cc2355d71232a3196b0338eba", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama268", "colour": "#C8D754", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686760464, "uuid": "7ba8c47b-fd1f-414a-9027-2d6452acaef3", "comment": "Malware payload (Quakbot)", "value": "abbb1c3b6698249e39bc38607a51bba96edd955d1576e6860878d81847cd9eb1453962639d5b49ba1647a3cee50096c6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama268", "colour": "#C8D754", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686760464, "uuid": "56841323-6e5b-4844-9bf1-7919444034f2", "value": "T12434C014F80798B5D98616BAD452E66F763C8F4883170D1AEBA73CD8FB7BC006534A36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686760464, "uuid": "f4389d8f-78ca-4adf-96b6-bbad1afbc08b", "value": "b82f222a9ed7cfb1419f0e64bdeaac8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686760464, "uuid": "2e816c95-352c-4db9-a255-7b6be0c72442", "value": "6144:cRixgWEZ5Txh9QQU7kVTAHluobjrA3XqpyNj7R5o9nPz7gS1Tzy:cRwBEZp11EFcUTzy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686760464, "uuid": "4cd2c555-947d-41ca-8f0c-553d23858562", "value": 252229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686760464, "uuid": "f97c5486-2362-434c-81f9-2b608978d244", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686760464, "uuid": "cf6b6bf2-a5b2-4b23-a711-bc2fe48a857e", "value": "0.3275080431729882.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0710a342-0a87-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728555, "uuid": "fc21c73c-096c-4bbd-ba7a-7c901307be84", "comment": "Malware payload (Quakbot)", "value": "08965a1d2f068c8f784a518937e14c6c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728555, "uuid": "de84b1b6-c845-4308-a1de-7cdbc7aa79be", "comment": "Malware payload (Quakbot)", "value": "ed9bae40483b816224a77502bb1babce59730bc71e77e04251f6ff79313b9ea4", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728555, "uuid": "04bb358e-2f06-42e0-8b3e-a04d117447a8", "comment": "Malware payload (Quakbot)", "value": "ebb22dbccba72d39558cfb609ea456bb00445243", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728555, "uuid": "b0945e6c-b85c-4100-9d22-3c2acb2318d0", "comment": "Malware payload (Quakbot)", "value": "f92166b54446fc770081496430a86b54f6bf7f97701457d3ff6394c6966bac919da757ca75833d2d62f1723fd3cee589", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728555, "uuid": "a5bf485c-d941-43e0-8c08-23a539fef732", "value": "T183742385AA42E0F14137B377DA578010F9AB1E1B20888D76BE7C505C2F3D8697E77E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728555, "uuid": "b7dd6500-e33b-4713-9ca4-0c5c1d460e81", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRblYhKklfQx+FnTcRPttU/Foa:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728555, "uuid": "0d4a2533-321a-47a9-93d4-2712958931c3", "value": 365510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728555, "uuid": "67f027c1-f11a-4692-a0ef-dbc997f7a8e2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728555, "uuid": "2b6ff718-2724-4fec-8f78-8dfe8e0b0ae5", "value": "UDlgp3uIJRRLO9.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac73e61-0a81-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686726333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726333, "uuid": "9562878c-bc14-4b6c-b452-df3f2cbfda71", "comment": "Malware payload (AgentTesla)", "value": "96de99ec31700046c73921737ae7686a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726333, "uuid": "084c87f3-231f-4043-b682-33eecee322ed", "comment": "Malware payload (AgentTesla)", "value": "edc7431f81049c3df92735f6834e59da7a2b7fb3f1c9c7838d0ae4ebbdf86cd0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726333, "uuid": "a084b061-a2c8-4c8c-84d7-2e0cdd05b149", "comment": "Malware payload (AgentTesla)", "value": "98d84e597ed0c2c059353c22828b7413f72e5001", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686726333, "uuid": "18ceacd4-51bc-42c4-a8e5-16b1b09cfa8a", "comment": "Malware payload (AgentTesla)", "value": "5e2012e4245b79db87bd0589eed2e74620ba8f29030e60aeb08fb4df77cd22756a2e4b8429de005e8dea93b730e1a906", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726333, "uuid": "cce3a0b6-0bdf-4d6f-8e1e-0486eeb6d6df", "value": "T1E705D040727E2963EABD8BF5011152B097F62F1FA51DE6E84CC6B0EB62F4F804A51D27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726333, "uuid": "367e7a5c-6354-4639-a4d6-b2978183d320", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726333, "uuid": "d2375586-7b50-4159-b7d1-2c153fc0c078", "value": "12288:PlKnufEXqXdVxwa0lgHoLluMANIzCV8Pe05atlLBGcc9SX9nd:sq4qXdVxwaZGCVB00tlLsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686726333, "uuid": "ab67ef32-40f4-47b2-a875-82fddb323c41", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686726333, "uuid": "7b1abba4-3053-4c4b-ad64-f51b94f43853", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686726333, "uuid": "536f5bf8-9b80-4393-8460-aaec0fbd844d", "value": "10409R4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "647a3775-0a80-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AgentTesla)", "timestamp": 1686725705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725705, "uuid": "a648d72d-3f0c-4e39-89cc-de17e15bb5c0", "comment": "Malware payload (AgentTesla)", "value": "9836715cd63ac6313cef624812fb6867", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725705, "uuid": "4995f56e-e710-4eaf-a9bf-96508229e91a", "comment": "Malware payload (AgentTesla)", "value": "eeb2bc1861ce16da1ce6bf7a28f19b6096454dd3f1133d3cc4f89e6eadf67dfa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725705, "uuid": "5add9927-aa75-48a0-b698-575c8a4e3697", "comment": "Malware payload (AgentTesla)", "value": "35bb8440f4e891b801e7bc2ce3eeb6b292d172c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686725705, "uuid": "91f28f41-5b9c-41b9-bc15-a8a33e82478c", "comment": "Malware payload (AgentTesla)", "value": "b9e6b2043c4586f2e29b3d30237f8ee023cb2cd4291bee0316dfcf6ba8c833053fdb7cb50f24a49fae92088668cd00a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725705, "uuid": "6cad1578-3788-4eb6-b862-45d8ee7aba1c", "value": "T1E235913E1CBE523B96B4D6A6CFD58827F480E1B731226D39A4D353864356D8239C723E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725705, "uuid": "e3fee2b5-db76-4ec6-8439-dde1e6dd97ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725705, "uuid": "68d9b7b2-c08c-4147-b392-d7ba1475743c", "value": "12288:8qrTnjmgiv48fK2QPzZgIIU/dWLCGTmAw1:8KnCBnSrzZdIvLCGTjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686725705, "uuid": "8ffa29ff-cd45-44a6-8819-4c12260de843", "value": 1095680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686725705, "uuid": "a2661a3f-e746-4fc2-9081-6235dfb68b72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686725705, "uuid": "40a4089b-eea0-4334-8059-f9cbc8d69b59", "value": "ZrNQuJwFtUcsaFS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ab07c16-0aff-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686780315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686780315, "uuid": "63fd529f-4b6b-4884-a138-963a50dfd4a9", "comment": "Malware payload", "value": "90009cb5921a16cc9676074582ff85c7", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686780315, "uuid": "e97e477b-6de0-4d0f-9b25-14d6d576c8ce", "comment": "Malware payload", "value": "eef2e7113b9dcc84545a37d3435a6e0c5924ee1a95019ec4bd2a133b933f2295", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686780315, "uuid": "d67c21d7-7b60-4b46-b023-6c4b312c8094", "comment": "Malware payload", "value": "0aa39fc76a659ad134a49913cb92e5715871f3b6", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686780315, "uuid": "fac328f8-95be-454e-a483-90aa79c12946", "comment": "Malware payload", "value": "97afc3f1e72f84faec601d321d85d4e117fa7446a75ff4a39b3199bc6ecf253388423b9e6e4be93944b326670523632d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686780315, "uuid": "929a2d62-94fe-4867-86b4-fc08cf650ffe", "value": "T130B633EC1BE1A79D88148F2B2ED39556F2D3887710C9891B5C0D9327EEDB86CCEA5443", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686780315, "uuid": "cc24f91a-1331-4f3d-8554-018d1dc4e9e2", "value": "196608:jckTATdbDH6lGd/E+ykGv4qETBK+57BH2bd8zhPsKJuc1KTZfoui:dTAT5Dal/xV4qETYEPsac5vi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686780315, "uuid": "2bebff83-b13d-4dd3-912e-505a0021e037", "value": 11314557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686780315, "uuid": "1739a30e-a623-45e5-a8c7-f8d47fb489d3", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686780315, "uuid": "af70e8b6-dc63-45e6-b6b7-2491b321fb7a", "value": "90009cb5921a16cc9676074582ff85c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d6f2b6f-0abe-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686752402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752402, "uuid": "3b94fe40-4009-46b8-a6d1-16fe4a229ce6", "comment": "Malware payload (Formbook)", "value": "d08a460cac4ff3eea6484336953a0d08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752402, "uuid": "46e7ac2d-f279-4e15-ab05-6323122a12e5", "comment": "Malware payload (Formbook)", "value": "eef51981f7cdb215ed2578d443d27eddbed6dcaa37c568200edfc545b43ec69d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752402, "uuid": "1ce578f7-819b-4d22-926c-9435254e46d2", "comment": "Malware payload (Formbook)", "value": "662dd7717e21aebe261d44b57842aea44c2c8939", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686752402, "uuid": "69f6a07a-5311-4963-a550-154fedd46084", "comment": "Malware payload (Formbook)", "value": "9303c9c755cdcb21c2b1c9b200189207bb929970ec85bec07f0f7632ad45f095f6a6adbf023ad4cb445d21a88914b13e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752402, "uuid": "03119d0f-3a65-4852-83d3-a57dd0a61499", "value": "T1C444121E2655D17BE06346722E352723CE9BB93304E48FAB1306BB59BEB3541B81E731", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752402, "uuid": "344971c3-935f-4954-9b72-d3cbce08e92a", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752402, "uuid": "fb6f1569-141d-4446-8dba-f6d0cb71c18c", "value": "6144:PYa69YhsG4XwmevagvImdFMtRTNTpPx07s232DglOw:PYHYhs2XIvfTNNPx0rim", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686752402, "uuid": "8ad24f1a-d24f-48ba-a9ab-e6be34543781", "value": 274064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686752402, "uuid": "2ba7e796-8a81-428c-b147-f7f885738d1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686752402, "uuid": "57a098b1-0808-4372-abda-630cc9f6545b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d534f21-0a90-11ee-b3cf-42010a9c0076", "comment": "Malware payload (RedLineStealer)", "timestamp": 1686732645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732645, "uuid": "66deaa23-b18e-46d1-9c40-ce7009ce5d98", "comment": "Malware payload (RedLineStealer)", "value": "f29cf7d7c2be639aca482572cc9659d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732645, "uuid": "5ee3cc4d-80a5-4b34-8b4a-afc50cd2d554", "comment": "Malware payload (RedLineStealer)", "value": "f073ea9518691008c951d156fcf6c6d7f2e1d71ead3779813494f418e9bc4611", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732645, "uuid": "a29992c6-a00b-4ba3-bf75-820ebd25417a", "comment": "Malware payload (RedLineStealer)", "value": "d6570f3b4d8c646b628ba3f225cb3865870abcee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686732645, "uuid": "0e2170d9-c9a5-402e-a8ab-eae49d6f9f00", "comment": "Malware payload (RedLineStealer)", "value": "48810e5c47350aec09f8ad0ed4f639d0e877d9c65fcf4a465b519b7c4ea9934b638c3e6a165372d851902f2f04167758", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732645, "uuid": "8eb5f9f9-78aa-4110-a9bb-a5dcf9829443", "value": "T19AD412538BE8C472D9B9277460F607D30F3A3CA6AAB992676394681F1CB35C4A531337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732645, "uuid": "a629ebd1-25e7-4cca-a73c-aa27d130dd2b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732645, "uuid": "ac39783d-d23f-40ac-a744-d51ee8e694df", "value": "12288:cMrOy90XbQfskMedTZNCnw3rU0CscNINbI9dMq1uFH+:aym8sEFUnCBcNIVI96+OH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686732645, "uuid": "955262e1-3181-47c6-a59e-6c1612528f46", "value": 604672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686732645, "uuid": "c229a439-e1a1-40f4-be03-f1f667274631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686732645, "uuid": "7aaeb42d-d616-4043-93a6-9a1073a656af", "value": "f29cf7d7c2be639aca482572cc9659d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5564a1a4-0a70-11ee-b3cf-42010a9c0076", "comment": "Malware payload (AZORult)", "timestamp": 1686718808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718808, "uuid": "3cace27e-4181-4771-adb9-6ecf280aaa05", "comment": "Malware payload (AZORult)", "value": "3d226b4fd4459eaa8072e280a3e5e115", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718808, "uuid": "da907f15-2a6b-49a5-9eba-d44fb7657716", "comment": "Malware payload (AZORult)", "value": "f18ab6cd601b4c49bce537de83bb3a796dce1f7b93089cde9d11c004657edefc", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718808, "uuid": "73c4bef2-840d-43e3-ad4a-3375b89f3700", "comment": "Malware payload (AZORult)", "value": "692f0ed445db630556342965d6ad65a0c39923f0", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686718808, "uuid": "75a2bbc1-18a8-4b06-b3a6-dbc7f7201447", "comment": "Malware payload (AZORult)", "value": "044d8044a89e6f94e6088825ecf79a1b102912582671139f60a0aad47de51faa0ea4f63fe0674fc8be05dd4451fece3f", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718808, "uuid": "c5e53c1d-67b2-43cc-9ab5-74046a72cf35", "value": "T1BB052388F1010C27F8EA533C0D68BB7255DA564DD6448ABF1BA46EB6F57324FC21FA41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718808, "uuid": "8553a300-af04-4921-8c37-f53103d8b041", "value": "7fd61eafe142870d6d0380163804a642", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718808, "uuid": "c0605362-447a-483f-bb40-28ce92930e8e", "value": "12288:GbM9g5j+R0SooQ++DsM0BiD7yfKlYpohXo+Mpm58M3sckknG2lQIto708vE:r9g5iyK+DsoeKlYpKnqm2O5n5QY88", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686718808, "uuid": "25754cf2-c9e2-46e1-90eb-e55b1d6f10f6", "value": 809096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686718808, "uuid": "014d1de2-143c-49b6-be24-adf98c0ed659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686718808, "uuid": "36e4cd34-f406-4b2f-b141-0b999293c93f", "value": "2023 Haziran Ekstreniz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19079b0a-0a85-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Formbook)", "timestamp": 1686727726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686727726, "uuid": "d66efbd8-7341-4ef1-9b47-4b91e4fd5765", "comment": "Malware payload (Formbook)", "value": "611e45d45bdeecee767e46674896385d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686727726, "uuid": "6b6e412e-4636-43bd-8028-6f6df4f3c35b", "comment": "Malware payload (Formbook)", "value": "f25beb74b5cbaeaf3ed9497d7c29d276fdf449f7c634dda71b72f2d9b5483f37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686727726, "uuid": "e9ecd8d9-31dc-433a-911b-91c3178876ef", "comment": "Malware payload (Formbook)", "value": "c96afc1c22bdac5619cda63918ce2ad2f729c85d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686727726, "uuid": "ebf4e62f-f9ba-427b-916c-44c475afc144", "comment": "Malware payload (Formbook)", "value": "322454daa39b9a6c8e02964f1d42100bf4af912a1d6fe17aaa26b6b5b3bfd06197c9c6594813a83660aaa83d711b0f8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686727726, "uuid": "be0ee9ea-edc3-48ba-86dc-71061b47c85a", "value": "T19905014468AA4F67D679B3F98F1032B037FE5BCE2811E38A1D87F0E69564F491902D27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686727726, "uuid": "9188e064-226f-462b-b50f-7057bbb77cac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686727726, "uuid": "593a03d2-6891-466e-9d8d-38424d607d04", "value": "12288:DhcvG73htU7/2eQ1x9W9OrIxkBqwaO7PE2utz8oKEuJ5CzEpnoC96x:lgG1tCuei89JkBm2u98duzE6C9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686727726, "uuid": "ec9e6c25-0922-43da-bb45-75e53e9e2898", "value": 848896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686727726, "uuid": "54b659d7-a8b5-4d89-98e9-9468c262e528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686727726, "uuid": "a6dbcd76-a8fe-4bfd-8743-3ec576e211db", "value": "Enclosed (SOA).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b2c370b-0a9a-11ee-b3cf-42010a9c0076", "comment": "Malware payload (NetSupport)", "timestamp": 1686736802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686736802, "uuid": "a8293e4d-91b4-479f-88af-2af0e447c99f", "comment": "Malware payload (NetSupport)", "value": "c5b3b22579773fea09e9b28a0c35acee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686736802, "uuid": "62db2de5-59a5-4b33-84a3-672c4907a9c5", "comment": "Malware payload (NetSupport)", "value": "f2b420f6222b61f6ebe76f82a5cde60d8abeb669a6865fceb9ebb8225cfb0b1f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686736802, "uuid": "9002f7bc-9dbb-49d6-83ed-67250c6efcbe", "comment": "Malware payload (NetSupport)", "value": "e2576e3d51325b3ddfbfadf6e71844eb408de47d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686736802, "uuid": "a628b8f0-b0ce-4163-915f-6658541d2d0d", "comment": "Malware payload (NetSupport)", "value": "d226f9a6b22de94a29e3d94558cffecee545bb5fe7c30cb92eb40c9956084856b43f55d708cd16c09ed53ab6a9890579", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "NetSupport", "colour": "#A33C43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686736802, "uuid": "85f1c070-e656-4eee-830b-7cb13e226ae7", "value": "T177330FF8A9D361A4A813707F4B6FA444A0D105430C68FA457C5CE9905FDE92C7BB8AFB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686736802, "uuid": "b9360e13-04ae-4e29-bb22-ccdeb6f1f44b", "value": "768:MvMFOYkBZTuKFKQRF6JNDJT0bSmO6AmXeZg6ig2WnMVVVPvYIoJsEmAxKMWuHoZl:McJTO2mXeZUVW2PAITzAxFWuI8OTN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686736802, "uuid": "5bea886b-de1a-4bd3-8390-389b48a2aba0", "value": 53234, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686736802, "uuid": "cfd661a4-219b-4e6a-8f68-c11081a5aba8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686736802, "uuid": "ac38f473-cd2f-48e8-a986-7434790ee87e", "value": "doc674.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69421c2e-0a93-11ee-b3cf-42010a9c0076", "comment": "Malware payload (IcedID)", "timestamp": 1686733873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733873, "uuid": "c677fd9a-2af1-4e03-9944-5fd48bee5625", "comment": "Malware payload (IcedID)", "value": "b4750a24c58b42614f57871b9fe637a2", "object_relation": "md5", "Tag": [ { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733873, "uuid": "bd8ac7d3-6988-443a-9634-9f3ebd0e979c", "comment": "Malware payload (IcedID)", "value": "f3711ae1b9946801d56d6cb28f2a3ccb306f56d657e27180370cefa7d1ae73e6", "object_relation": "sha256", "Tag": [ { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733873, "uuid": "e6dd0132-44e2-420b-81e0-7c280dca4b30", "comment": "Malware payload (IcedID)", "value": "24077f369ba67e7f39df54dd636edc18f86fc921", "object_relation": "sha1", "Tag": [ { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686733873, "uuid": "e5f4a23e-e340-41ba-9020-3b63cd57e8b8", "comment": "Malware payload (IcedID)", "value": "44f22abebec6d2113a516320258c3a1e866e12b6c84f7064a5747ce982acbff87c7293c732a0792298661a1004244717", "object_relation": "sha3-384", "Tag": [ { "name": "funplexresortng", "colour": "#C1A6A5", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733873, "uuid": "4a354648-851e-45ca-83ea-786e00030860", "value": "T12705B9C227EBFE4304271372736466E5DA39CA65C9C998DCF4457C58F0EDE02B9A82C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733873, "uuid": "3be91503-8820-40d5-866a-8cf1b89d5853", "value": "24576:AgORZXUBvnN0E9HVsc1zoLwzpSsurWwlYUW9wfPFKi7dOV2b1+pnN37IM1wl+oXB:Ag2XUBvnN0E9HVsc1zoLKpSsurWwlYUj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686733873, "uuid": "ee2099d1-edef-4e5d-85cc-f9ab864732a7", "value": 814503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686733873, "uuid": "b2ea1667-2448-4223-8653-973ac1b02198", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686733873, "uuid": "4594aa05-a742-4433-a627-6b7b6a87abbb", "value": "Docs_Request_06(108).js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5921399d-0abc-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686751456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686751456, "uuid": "ee19c5b6-299a-4794-a562-ad7a307b4720", "comment": "Malware payload", "value": "78f2bc55220756d098f75229fc390c60", "object_relation": "md5", "Tag": [ { "name": "browser", "colour": "#77A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686751456, "uuid": "7eb717bb-7202-4020-91cf-08841c7bdfb9", "comment": "Malware payload", "value": "f386085aefb882cf07fab5673fa4c4eed8c7c92c6660aae5b5835877a5133893", "object_relation": "sha256", "Tag": [ { "name": "browser", "colour": "#77A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686751456, "uuid": "b45ba671-5cec-4904-ac57-4b1f6b64dd0c", "comment": "Malware payload", "value": "68d90aae1e1701d076a405fa225bf3bbb568312c", "object_relation": "sha1", "Tag": [ { "name": "browser", "colour": "#77A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686751456, "uuid": "825519ad-81b8-48c8-94c2-07e081682f7c", "comment": "Malware payload", "value": "037f744955662f1fe93b23a2fa2b3112746656eed75e12dd6d2017f3edb48fee1824a8b92a33a99ac378e8daaa2b2fcb", "object_relation": "sha3-384", "Tag": [ { "name": "browser", "colour": "#77A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686751456, "uuid": "462a1fdf-b81a-4b14-85d6-8ba83ce36b31", "value": "T123373956B1D10095E135E0388D6A806FFA623A9653B16BDF7394A79A1F33FE12D37308", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686751456, "uuid": "754969a2-04ba-46cc-a4e3-a326474e86e8", "value": "f26de1a4916aee7c3191148978bae754", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686751456, "uuid": "09b95836-cd76-47c2-8946-4ff7e71a6ccd", "value": "393216:YRA9CDx56ELsixfLM/hbXSfpBL+2a27CusutjxJsv6tWKFdu9CmJl:YG5KZ2ru4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686751456, "uuid": "f3d2fdcc-2e61-4259-b3a8-5a5cc651dc10", "value": 23636640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686751456, "uuid": "b53af236-8a94-4be1-9038-7cff357c6b4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686751456, "uuid": "0ba587a5-6046-432a-a677-0dc00368dbd9", "value": "Altruistics.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc63bf0-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload (Quakbot)", "timestamp": 1686728240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728240, "uuid": "9890d677-52f4-47c6-989d-2ab6dad5ad10", "comment": "Malware payload (Quakbot)", "value": "f37461aa9c4a8f83e61a3366b511cbc5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728240, "uuid": "ea034ffe-eb02-419c-81f1-b1cddd10d420", "comment": "Malware payload (Quakbot)", "value": "f3c89b57ec700157818293b4ab3cc6998e1cc99bce9e06431180baed8e8f8333", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728240, "uuid": "35e5a495-898a-4930-8080-3bdce9637955", "comment": "Malware payload (Quakbot)", "value": "b6090d4ba9b1262f55bd4aa38112d32bbd34748c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728240, "uuid": "2294fe4b-7898-4989-9434-8980a914478e", "comment": "Malware payload (Quakbot)", "value": "5c84a3c9611a9937fc5a7d28a8991188c5341d6ecd9f64fd806feab9f9de81c31b8f03128cdcc54eb248ae61c7b46b91", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728240, "uuid": "3450ca68-36e7-409a-be8a-814ae56754d7", "value": "T15D7434846A41E0F04237F37BDE178460FA6B1E5B20848976B93C605D6F3D8697AB7EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728240, "uuid": "05b4d1e5-fad5-4aff-8d78-f448afd5ae78", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbwUouimYZtM7pKCsi4q7hS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686728240, "uuid": "39fedd5a-318d-43a5-ba9a-de5b23d21b42", "value": 354233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686728240, "uuid": "3c66c88f-0f4c-4426-b673-1a1ef3500c1a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728240, "uuid": "a6ed9975-56f0-4fb6-8a1e-131d672b89a2", "value": "aymRhNHRHLW6I.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47cc645b-0a4f-11ee-b3cf-42010a9c0076", "comment": "Malware payload (CoinMiner)", "timestamp": 1686704611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686704611, "uuid": "9b56e12f-33ae-4486-9c4b-6b3ab2bb0a12", "comment": "Malware payload (CoinMiner)", "value": "e7633cb2a5f2a9468ae67173684bd10e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686704611, "uuid": "331fd20b-29c0-4d33-a3fc-d4501de30e6d", "comment": "Malware payload (CoinMiner)", "value": "f4397698ea8b227faab54f8d2cb98346e32fcac147a878d172cae6b17f3b26c5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686704611, "uuid": "479944f9-b975-4b89-a9c5-993484aa32c2", "comment": "Malware payload (CoinMiner)", "value": "13f2fce97c6e5e57cbfbf94425879501a5d63c01", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686704611, "uuid": "424e6fd0-662c-456a-9682-58f5f1a05e64", "comment": "Malware payload (CoinMiner)", "value": "8e81b524ad2085aadd5863fc9073ef0a4af85c508c01f7e6685c6942ea3b484cf4884b086d43a76b5ef6033d0854bd3d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686704611, "uuid": "d64bda47-a0e2-46b2-9e59-86c53299f620", "value": "T177061224B7492F8EF465B8702BC8D721D6D93C2DB8CDBDA043E4659D2E72182E70685F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686704611, "uuid": "b2f59df1-998b-4f75-8961-7c7a40ecd5f2", "value": "df9a7bc1c6c6cd97d04c3762fdde6719", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686704611, "uuid": "2789ce17-36f0-415c-b476-e53e50db64de", "value": "49152:gPu803iSM2N7aUjjqpEbUS2qv5MQBsSY/b7KoiTFUgxylC42lVJpiU71PP:Y12BEE4vqxMQzub7OTFUgxylqTiU7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686704611, "uuid": "6719b541-a0f3-4ac5-9d5e-ae575df767a5", "value": 3890176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686704611, "uuid": "47962fc4-dbc1-4dde-b373-75bd38478796", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686704611, "uuid": "bf76d447-0110-4252-b662-e86bccbeb00a", "value": "XandETC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31b8782-0b0b-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686785590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785590, "uuid": "c38d93bd-db7f-423f-b79a-102143816f1a", "comment": "Malware payload", "value": "a74d7e85c4087a1c9b6c5386a4c00cb7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785590, "uuid": "04c432aa-c0df-4e0e-8f5a-1161b7e168cb", "comment": "Malware payload", "value": "f46b5b289501e88dc89c7d8daf37156459bcacebceaff3af7718190384546dbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785590, "uuid": "5e384a5b-865b-450c-a2cc-186a5e013135", "comment": "Malware payload", "value": "21a592bd7311c8919b78349a311cde9ad9221c9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686785590, "uuid": "4f51a484-81c6-41ee-824a-32752235fa67", "comment": "Malware payload", "value": "857d5a4a5611620eae4de476ce8a63a6391555a79941f424208608ec0a92c2207ac4206c5c06b698e7187d394bd977cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785590, "uuid": "a30ba607-eb53-48b2-9742-bef0f8c55fd4", "value": "T18A54E02236E5E832D5635A314C3BC3946A6EFD121F38679F23681A3F0E722D1DA76351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785590, "uuid": "b5be0257-9d57-468b-95ec-96c81a62f500", "value": "3865ca37561d2aa29b9e83d3d87488fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785590, "uuid": "85d9245e-db25-4619-a628-3725e0d41dc0", "value": "6144:qTrgz7qnSQn65WUZDgwyMWjRTp17PC3mpIs:q3gzqSsSDgwnWL17PC3ls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686785590, "uuid": "e0989273-92d2-48ef-ba46-0f80dff224ea", "value": 282112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686785590, "uuid": "9271e78f-d0bd-4e80-a50c-5d9992b4a5e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686785590, "uuid": "d5ef1480-5310-446a-9ea4-2bcad78d3d49", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f372f26b-0a93-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686734105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734105, "uuid": "704951aa-7559-447e-9d04-5800fe36f3a7", "comment": "Malware payload", "value": "a0b9614b7d181537b0fc0ee8f35e9c17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734105, "uuid": "ca646568-0f21-417f-a04c-4ceb86ca1b4c", "comment": "Malware payload", "value": "f4a8ca69754a9297989662f17cc6c427c10f1008862911bdcf6e6838d021ae07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734105, "uuid": "326e155e-6048-42fb-97d4-3c0493ff732d", "comment": "Malware payload", "value": "e8d560e5e0b913f6cb753a42a1b94cc4c2bc1b66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686734105, "uuid": "8feff523-5b47-4de6-905c-4939128dabd0", "comment": "Malware payload", "value": "9d0b42bd9792cdd366afc37b1c60d60f33ab0f1ebaddccef690eb47bd1a96861b42dc6e0f1485cfdca5431ea9180e4c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734105, "uuid": "d9dc4de8-b46b-4bc1-8884-3a99b25d48e1", "value": "T118D4AD263AE1D03AE07252B2593A87261DB9BC704D32885F33D31F6D1F74A41DA36B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734105, "uuid": "425f497c-2ce1-472b-b404-e0b549f4334c", "value": "ee0c7086a29692b63177e35532649359", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734105, "uuid": "fbaeff1b-2cca-47c1-812b-621c894e6e8a", "value": "12288:B2s5rS0TUtzgzUpTN/MRj6NZwJTthveVCH2Jq/iCyWqZ3ZvrVSat/oAuydy7R974:YzQcFNaJ55qZ3Zvj/oAVdy7R97E1pcy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1686734105, "uuid": "995ca594-2069-459d-b751-ffae62fa543e", "value": 636456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1686734105, "uuid": "cf624c4f-81ba-4c82-b818-4acc229e08fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1686734105, "uuid": "dd53019b-0674-4b1c-abff-3bfdc34e1993", "value": "f4a8ca69754a9297989662f17cc6c427c10f1008862911bdcf6e6838d021ae07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51c8c43-0a86-11ee-b3cf-42010a9c0076", "comment": "Malware payload", "timestamp": 1686728390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728390, "uuid": "52e15afe-ec21-49e1-9760-3facc44b3926", "comment": "Malware payload", "value": "ebdb5e56ea405b009d1fb60f821bb504", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728390, "uuid": "a5eecd3b-b98c-46f7-9efc-609090de8c82", "comment": "Malware payload", "value": "f4d6d0cbb49030eaa5d641467d627325c68f6eb4bf43dbffba27d74fff101aca", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728390, "uuid": "4e4f28cb-8f0c-4145-a225-20592782ca0b", "comment": "Malware payload", "value": "7183605492a810e4940460af730b888c6279fa51", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1686728390, "uuid": "2213c84e-af3c-4dac-915d-0daa4a18b3a4", "comment": "Malware payload", "value": "cbe1e2d537bdabe1e53b92f5b204189b3bfbc6a75003edaa26bce2a1320659400ea2adcab0fab7a0432e21fe9ee04e7d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728390, "uuid": "122db76a-49e2-4f0e-95fb-27fc0034068a", "value": "T1B16444856A45E0F48037F337DA579410FAAB1F1B20848932B97C516C2F3D85DBAB7E98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1686728390, "uuid": "5178bc35-8d74-4338-8826-361e7ddfe869", "value": "6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRb6qHEtghS:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/yga", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "categor