{ "Event": { "published": true, "date": "2023-01-31", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-01-31", "timestamp": 1675209782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "ddd9dd09-00a4-45f1-89d3-4150af3c0d5a", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4e17f5-a1aa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675198881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198881, "uuid": "118f66da-91a6-4939-a3c9-5e64d64765d7", "comment": "Malware payload", "value": "237b6777a9cfd8f5f89a656c63f0681e", "object_relation": "md5", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198881, "uuid": "f080a0cd-2df7-4837-9b30-a9dfe2a40638", "comment": "Malware payload", "value": "002fe00bc429877ee2a786a1d40b80250fd66e341729c5718fc66f759387c88c", "object_relation": "sha256", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198881, "uuid": "0b5d370b-eeaf-4089-ad10-dbac398ad296", "comment": "Malware payload", "value": "4a26b1c65ef45d3e2576db71d8867cd2ec8b4336", "object_relation": "sha1", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198881, "uuid": "8415fc41-98d8-401e-917b-d9caba7786e0", "comment": "Malware payload", "value": "374722444d312af68c33c80bade386fc8ce9cb69c31075d34de1c8a1745d75734c82b3c0ffa16617db88c360eba12126", "object_relation": "sha3-384", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198881, "uuid": "717c6b7b-f8ab-403a-bb9c-76d1d236c0ca", "value": "T11904E003BA5FCD15DAAE11B005B66FDBA721AD3293E2936B977130DCAD122B0F44115F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198881, "uuid": "c81b9e23-58c9-4ceb-8890-aa2c9062778d", "value": "3072:21lg8QPXTRA2P/7dq+Jj29Ua2+jYFh3fnWtmncpHJ4:XJtA2PRNJShnj2nWtmcpHJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675198881, "uuid": "7e092fe4-cec9-41f6-a659-93ad16787830", "value": 185696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675198881, "uuid": "49122475-709e-4a41-b48a-06410a47868b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198881, "uuid": "497a1c8c-b599-4223-b828-39ebc72273b5", "value": "408709.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ee005e-a108-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675129529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675129529, "uuid": "f1e4b6f7-3809-42de-9209-226e7cf1fd8b", "comment": "Malware payload (GCleaner)", "value": "6f614548a802eb321793041ffd138f69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675129529, "uuid": "d535456d-dfdd-4480-ab94-2c24352abb8f", "comment": "Malware payload (GCleaner)", "value": "0114d05d3bafbbaa3b6259fe3135a7a6a26b7b84f7cb5198fdea0c6dd898562b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675129529, "uuid": "65e1749f-f5ad-40a6-b667-87a9d91e3776", "comment": "Malware payload (GCleaner)", "value": "62779b9a29a1805d6c4759247abf8b61fc28b01b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675129529, "uuid": "7c74d606-373d-4e38-8384-c842cfd6a39c", "comment": "Malware payload (GCleaner)", "value": "4c18555af2eafaed8aff54f0e95cc1b0faf98df4f1b117995e8ecd1af6da987a8b6cdf6e12689e00f0d98ce226b66e98", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675129529, "uuid": "ebb74ad7-1002-41f2-85e2-b99f0fd81351", "value": "T181A5336B866A40BBC05692349CA594620FBF7E1114BA9D0AF44FF0FD6F3BB813C4A715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675129529, "uuid": "ad9db01b-38fd-4efb-8370-7c9cfb526b06", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675129529, "uuid": "b52ce6ef-95e0-4a03-a6e6-c88f0fa69458", "value": "49152:2cnxA+wKd9g3LAYHb0qafNI3m7Rb0pWZq9XikQ+tLCgv2MR:DnxApSg0ob0v+m7Rb0UGxv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675129529, "uuid": "dcc16388-bab7-40e9-9b27-49db5156e222", "value": 2212507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675129529, "uuid": "ed44fdb0-a30a-4f16-b719-ef3d34b4e174", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675129529, "uuid": "0f0400e4-3b18-4f2f-a945-0a185fe1901d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d418b197-a163-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675168565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675168565, "uuid": "8db7e0be-205d-4b0a-87d7-b0733d606ef8", "comment": "Malware payload (RedLineStealer)", "value": "62efdda1218a7a015ad4255b59f2a346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675168565, "uuid": "5b0af4dc-3f82-4a43-9bdd-cde910d9a3d1", "comment": "Malware payload (RedLineStealer)", "value": "02c4b4dc1d1ee21b58cca2d0f5c2225bb1c3e5a238009394a8d32463b11b2b45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675168565, "uuid": "b25357b9-a221-4431-ab42-b0af3f5290b2", "comment": "Malware payload (RedLineStealer)", "value": "65c448fa0d7f3e3614550e06d42886ce1de3836b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675168565, "uuid": "df4aa61c-a235-4254-af41-5f5a334dcd80", "comment": "Malware payload (RedLineStealer)", "value": "9ee334172100c304bfe9941564da35fa8b484f86f8ec1d0991dce47bc69158afe8f6e727618c5b302d7ca349267783e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675168565, "uuid": "29a74cef-5045-4ba0-b4c2-8814c7e6fea2", "value": "T13225C0212AFB544CF3A39FB61FD4B4AF4ABAF673A609E0BA359107464731D418C51B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675168565, "uuid": "5f5ffe41-4198-493e-9311-d48adfcceffb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675168565, "uuid": "4d2e652f-6560-4213-879d-e7ad1ff10ef8", "value": "12288:prAJ45DASNK8CLrPRPbowqwYFpoX1EmSpAqklITOoKBaUXKDkw9tYstHR7:puwAcK8Cv5jEwvGm4AqrTKPXYkwXjR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675168565, "uuid": "b07942df-d389-4e2d-a040-1ac04ca67294", "value": 1008128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675168565, "uuid": "4507820f-aa4e-428a-b2b6-c9e72a0ea4e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675168565, "uuid": "2dadc461-a0d8-4f50-8a18-f498e33dd342", "value": "SecuriteInfo.com.Trojan.GenericKD.37341261.5850.10803", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bbca839-a14e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675159263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675159263, "uuid": "bddc685d-6156-4a70-9155-01d36bad17b3", "comment": "Malware payload (GCleaner)", "value": "4f2dcb7979b97f0d3b2faac90825a357", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675159263, "uuid": "8f832f50-b4a0-4ba9-ba0f-5b113cd10a2f", "comment": "Malware payload (GCleaner)", "value": "02e11694d610dbe954b3d0ae4be58b1ca8dd49940596df70daa7df72c2d1f912", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675159263, "uuid": "52ac892d-6fcd-4793-84ae-b2c02162c71d", "comment": "Malware payload (GCleaner)", "value": "317c560daa05a777d0636a9de98b4390abd26197", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675159263, "uuid": "c619610b-d0b9-4f4d-8f43-e421b84f6c0e", "comment": "Malware payload (GCleaner)", "value": "d095ef5ccdc579060a27b9668a44e6e78937b41dcefa6d045127cebc0ec063cef2ae2fffd98c5478a406475618b13847", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675159263, "uuid": "15095a18-5034-4225-988f-b8058248cde6", "value": "T14BA533C1F1B98637D2818A3CCE179A8B7D61FD333C7503425CAE2B891B572E89454BB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675159263, "uuid": "e0351896-f692-4216-8164-093fc05f3e08", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675159263, "uuid": "369b1222-7454-4966-ab30-ecdd41e13076", "value": "49152:C27+kjE1gzGredABowqDtTS0wI0aK4sf1S+dDLCgv2MR:dK71KGid5/DtR0aGfPv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675159263, "uuid": "325f3dce-c37f-4f15-9611-6bb975ebc36f", "value": 2203156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675159263, "uuid": "40db6b49-2476-4331-b296-09275821fa63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675159263, "uuid": "99b52530-f213-40cd-9393-585969c7ca6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b28c847-a172-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675174670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174670, "uuid": "53d353d1-9b47-418e-9757-db45210d1ec3", "comment": "Malware payload (AgentTesla)", "value": "98400e1a5fe8e088a86a54dfccbf0bb4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174670, "uuid": "8ec6c7b4-b02f-421a-a986-2a7d215f2fb3", "comment": "Malware payload (AgentTesla)", "value": "0301b9c05ff6834e51220ddf3f7967a32b857187073ea83da75fe803da7379e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174670, "uuid": "5efbae86-99cd-4ede-a6b2-750f150c6d5e", "comment": "Malware payload (AgentTesla)", "value": "10ffc3cc336f89cb7e164ff124efecfa4bdf124d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174670, "uuid": "465ef999-c31e-4118-96bc-05d65c6eb972", "comment": "Malware payload (AgentTesla)", "value": "25dd35486eb859778731df046aeff2571df5cf427a79fd549c26e3e9eaa5cf4e125213a3bf0700ecd3deb2e287ac1614", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174670, "uuid": "b90b42df-8886-4761-bfbf-48da7c387803", "value": "T1CF058B82567B83E2C4B94A741538E83426A65CD18B2CB13ABDC2BD7BBCF674F0495713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174670, "uuid": "f8d228bb-94e1-4d10-a4c3-878ebfd99d01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174670, "uuid": "30143ea1-3779-45c4-a488-571596dd886b", "value": "24576:FOTlQ3+NNx8oBCF1DVXKtEghnCuhAEqj:0TlCy4vVXgnCSqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675174670, "uuid": "fa940fbf-92da-47e0-890f-fe808e995f30", "value": 867840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675174670, "uuid": "4a98f99e-7fd5-4299-9f2e-da0fcc31a59c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174670, "uuid": "e1c6e5af-a5a5-4193-9217-b202570aab4d", "value": "Solicitud de cotizacion.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0805dc09-a135-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675148465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148465, "uuid": "763a41bf-9923-4ced-a5ab-9e73973b7dd4", "comment": "Malware payload (RedLineStealer)", "value": "efd9f6ed91e0429bd5e43f47ecb8a587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148465, "uuid": "d7df48db-30ce-4b1a-be6d-d05b2fe2ba48", "comment": "Malware payload (RedLineStealer)", "value": "034fa2b561a1641601a0755796224a3119f5ccc30ff116df32a0c1585518b0cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148465, "uuid": "aafb5d58-0369-475b-8505-21e9cb3a411c", "comment": "Malware payload (RedLineStealer)", "value": "1cac7cd41fbf2b3fd4d94bd722ecbad7878a8a7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148465, "uuid": "d750221e-dce5-4ccb-a1ca-109d8d1db7eb", "comment": "Malware payload (RedLineStealer)", "value": "df5729d6433effdfe608e6627038a0e3cddc3ad7e39de567d47a92523ec356fb34e271851946d51fb05ad58b20246704", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148465, "uuid": "3f8e6781-40ad-4414-9d95-1fcb3acc64b4", "value": "T10784BF02B2E0BC41F52696768F1EC6E4F61EB592CE14A7663318AA5F25F31E3C772341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148465, "uuid": "2b2ff1de-2d98-47c3-9fe2-93199ced3042", "value": "a2c8bd590ac12702f85d4107db46f8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148465, "uuid": "a3059d31-3547-4391-935c-fd47431de2a9", "value": "6144:IYQ/OLKsDq4POLOjj1vxobzK8UMYn3eWlJM1Gm7f4VKV:yWex4aqo/KX361GmzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675148465, "uuid": "53fc0778-d90f-460a-9cd9-ef56db92612e", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675148465, "uuid": "54aa556c-7f78-40b7-978b-12bdc44c0ba7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148465, "uuid": "79a3c30b-662c-405b-a2be-dd191b0f9e79", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28bef57-a163-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675168562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675168562, "uuid": "f81435bb-1626-4a4e-a961-a203fa27f954", "comment": "Malware payload", "value": "d9e40e69322f6a227a665097adb91e70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675168562, "uuid": "88d4b154-b238-48fe-bcfd-1e65c47d61c7", "comment": "Malware payload", "value": "0365daacdcde2fb93b2d972a46490b9cc4ca6f76e13f7ab745acf9dbcb92c32f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675168562, "uuid": "7d1f62bf-0007-4d32-98fb-a2440ec978e8", "comment": "Malware payload", "value": "4ebfa5d35cca579373626f0056ebb6e41223d291", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675168562, "uuid": "5cc8bc2d-1da0-4cb7-b626-e05e3b59de9f", "comment": "Malware payload", "value": "b997cc4f3146da48c66eb6841e29e624a55b6c07ad3e4019f406e9c58838c02efbf9c4f8bbe69697574aaf991cc4f1c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675168562, "uuid": "86a0fbd4-246b-406d-91f9-d117b4e49af2", "value": "T1F685CF3FB268B53FC4AA0B3245B3C250997B7E61A81A8C2F57F0190DCF764611E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675168562, "uuid": "b6061643-0773-4e7c-a18b-5348331d3b9f", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675168562, "uuid": "99f3dc21-4a2b-474e-9bdc-69c4dcd28a7a", "value": "24576:o4nXubIQGyxbPV0db26sdar9f7Zymuz7lnAjEHLcfVLKswfsI:oqe3f679fVyh71SaLcfxOfsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675168562, "uuid": "80457840-2ae8-4342-8e8a-71917053568f", "value": 1762576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675168562, "uuid": "31ff2e92-0a2a-44e5-9de2-1008efd895fa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675168562, "uuid": "6d95e9f9-e674-4fb5-be72-22d62c852d0c", "value": "SecuriteInfo.com.Adware.Downware.20091.8549.2837", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39a4f47-a157-11ed-88f6-42010a9c006e", "comment": "Malware payload (Cutwail)", "timestamp": 1675163383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675163383, "uuid": "46ca29e6-05df-4033-83a4-ccc8f33c2534", "comment": "Malware payload (Cutwail)", "value": "58860a1c3b2041fef660374813f99273", "object_relation": "md5", "Tag": [ { "name": "Cutwail", "colour": "#ED0EDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675163383, "uuid": "90471848-fae5-4042-9cf2-cc150698f602", "comment": "Malware payload (Cutwail)", "value": "03baf72346c71daa88ecf32ed905a6181d805dc11f6c87a0a7394b171bd1716d", "object_relation": "sha256", "Tag": [ { "name": "Cutwail", "colour": "#ED0EDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675163383, "uuid": "f5ad518e-e555-46da-bc94-d67bf95818a2", "comment": "Malware payload (Cutwail)", "value": "e8d503260b7ca66dfd0ca0e3fffb327c0a6cc7c1", "object_relation": "sha1", "Tag": [ { "name": "Cutwail", "colour": "#ED0EDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675163383, "uuid": "fb3eeb56-5e32-453f-9cee-40fff80e9c51", "comment": "Malware payload (Cutwail)", "value": "bf18b3bc915812300628b410c95a41bd41f43b38bc4db21ee0a2f5daab7c091d8504fb0580fc66204ead68a27d539dc5", "object_relation": "sha3-384", "Tag": [ { "name": "Cutwail", "colour": "#ED0EDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675163383, "uuid": "3ab33f58-953c-4080-bd38-5338d018b29f", "value": "T1CB548E02F2D1BC40F5668A718E1EF6E4F61EB591DE18A3762319AA1F25B31F3C762701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675163383, "uuid": "f29fdb92-47f2-4ce8-9ec7-151ada5a37ee", "value": "78339dc1c5de0e493ea2b28607ce356e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675163383, "uuid": "965e5b17-6cb8-4993-8acd-f401f25ab3fc", "value": "3072:J5ud9dTLzGRoK3FFSNMc6AzvR9OteQMHBgo7f43H7BFbrxsBRCqx:GndTLzjKqBHZQwBgo7f4VpNsj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675163383, "uuid": "0ccf411c-7582-4146-892d-47468c838f46", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675163383, "uuid": "7e80c093-872d-4a8e-a1f0-eeebcd6e4ef3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675163383, "uuid": "cdcc2803-eedc-431e-a192-5123bfc78372", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "902e8b88-a184-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675182624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675182624, "uuid": "04ab52da-51a3-4ec3-a18b-15304139735f", "comment": "Malware payload", "value": "b7956e837b3a42d85f3b20431229e3bb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675182624, "uuid": "5650f668-7035-4df4-a120-f29c0d185bb4", "comment": "Malware payload", "value": "03d3c2ef245130b9decb34d0df99563ee38f54a307a7a5da68102014cff14df4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675182624, "uuid": "8438adcc-f7e0-4be0-b59e-16062f65ac4d", "comment": "Malware payload", "value": "c5fa45aa5c4024dbdf96e105709f70c0175943d5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675182624, "uuid": "c8c53020-c4f6-4e2a-82ca-1e450eb399e4", "comment": "Malware payload", "value": "05034272463e13b60dfb4f669e07dd61fe4ea5781829c00a736e1421484ee2013c98eeda53881ca4f1324276f15512ac", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675182624, "uuid": "b169b9b6-0410-4cd0-8275-761822f09adb", "value": "T121F44CE4FECBE1D1F4071CBC02A9253F59BB23185838BB2AD5113E19D821285AD67F75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675182624, "uuid": "34da7bc5-4ed0-4614-9735-e008fb0cc4ac", "value": "48ee4c9fac8d1206bb74064becdbc1dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675182624, "uuid": "94a6ec4c-6d32-4a98-8a62-5240664d3484", "value": "12288:9qwFxm3G6H4RyuHbR1MxnuTV/iV1SdURA8s2Q5Qp:QwFxm3G6H4IuHbR1MxnuTV/iV1QTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675182624, "uuid": "be5cfbac-99f2-4041-b4d5-36909bc454e1", "value": 732550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675182624, "uuid": "328e4c24-ac5b-41c4-8216-922073699a27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675182624, "uuid": "5afbf67e-53fb-48d4-a87d-cbea5779d912", "value": "300123.gif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e4b1cb-a145-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675155468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155468, "uuid": "cbfca923-7607-4224-a18b-5872eac1ef94", "comment": "Malware payload (AgentTesla)", "value": "84d6b788e33e0f1671451cf5e645a227", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155468, "uuid": "8f798a79-0a79-4803-8360-9b27163ea048", "comment": "Malware payload (AgentTesla)", "value": "0420a47d26110ca71c178181b55c302cafc9c5f52f87294fa5da37e4878faf5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155468, "uuid": "e32b615d-363b-4da5-b6a6-5fe8a226f71e", "comment": "Malware payload (AgentTesla)", "value": "3486c8b9c49ac5af549dd608c1157ceb23b851be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155468, "uuid": "5674ec4b-241a-4d16-8c3a-3d534a8a1365", "comment": "Malware payload (AgentTesla)", "value": "bebe8c11ae46add8a4d54284da0aa3d9519a77047e60718591ac6452c7f63bd0611aeb27a67515fcc830235faeda10b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155468, "uuid": "23777833-bb7e-41f5-8aff-13411ce368cc", "value": "T19964239B78F3B05813966F3074F322990928FDD7360208B87593B62DE659C776F832A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155468, "uuid": "4cf396ee-7018-4a18-8fa9-6b297b84ed7d", "value": "6144:xStfIyp6GUOeyhwr2RrPlbhTBNSU/41StdIrdng2T:ctfiG44M2R7HBNS/jrJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675155468, "uuid": "93152dcc-003b-4a8b-8e19-e717670f7bcc", "value": 311145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675155468, "uuid": "1de5d48d-05dd-4010-9f05-130fd4019c69", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155468, "uuid": "fbf119b9-b996-4739-9ba1-c176a92b6803", "value": "URGENT REQUEST.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b027a688-a144-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675155190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155190, "uuid": "9ed63b53-99bc-4d58-81a7-1c7b12712e8d", "comment": "Malware payload (AgentTesla)", "value": "5cc5abfd9d60653b6e45f9bdd16897c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155190, "uuid": "1e2b9084-d191-494b-bf2b-33d16e840e5e", "comment": "Malware payload (AgentTesla)", "value": "042b8af8fcecef9391842e5940e698299277eeead0c6e2dde08b5020e268e82a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155190, "uuid": "d7fd67f1-307b-42cb-a943-f34540a771a9", "comment": "Malware payload (AgentTesla)", "value": "24e78b48d6d918488869ec6dc060b09941993d1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155190, "uuid": "832b2a24-cfe8-4c49-aa69-8960716c846d", "comment": "Malware payload (AgentTesla)", "value": "462a4abeef469eea75604c503fabcc556f5a5d48bdbc8e175261eda628acef9a732112311fea1135073f0f70a112859f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155190, "uuid": "3b5c2193-f68a-4014-89c4-546c0c12802f", "value": "T1FA452301127803E5C61D03BE65738A30437A9D69B927DB0DBADEB4E517777C207B2AA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155190, "uuid": "598908f9-1374-493b-8be0-cc0acd7e7ca8", "value": "12288:7qjy3thZ+GvJp2eJzJStedQiPGuf/WFmGqYNar8z9i7+pvFCWtO:nth0bAMENP5Q2YNar8zw6Rkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675155190, "uuid": "e0ade611-2654-4e39-bf4d-5b3a265892df", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675155190, "uuid": "3200dee4-0170-496c-9797-fd66f83705a9", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155190, "uuid": "6f08541c-b245-4910-a437-f2fbb9cee7e2", "value": "image-1-18 Produkte aufgelistet.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a72cea-a17c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675179088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179088, "uuid": "98996ea8-889d-42a0-a93f-53b1475cecc6", "comment": "Malware payload", "value": "cefad55884b290f46efc7ab719c029fb", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179088, "uuid": "700d4b4b-f9f5-4d7f-a889-da5e31b160db", "comment": "Malware payload", "value": "04940f1d8d4e881302b399c17500e35dc6a8e64a937e2a760dc3863ca8238274", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179088, "uuid": "9118e3ab-4bda-4345-9c23-71ecb0b19bf5", "comment": "Malware payload", "value": "ec6b66ce21c7f47d5104c2e6081bed48023e471f", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179088, "uuid": "0f6034b6-2b45-43f9-92eb-57581ca5969f", "comment": "Malware payload", "value": "a2d296474f52453bf6afd141d07d8fcc8e6307908e982424c9775f7af43c829d41514fb1d59d0f0296c960a4cfdef8fa", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179088, "uuid": "1485e18b-793e-4bc8-8d9e-af26e247f3ab", "value": "T1BB830BB63438746163535EE123622D0AEF9D4CAB3B057FC0B8DD60B8EB2485C5365AED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179088, "uuid": "f1a5246b-da56-4252-bfbf-42a23f802207", "value": "1536:+AH6qP3bNViLTaGV4MwHLo4PwRCdwtpMnoi1bdANpPvUpR11+pAJXipknu+wPwB:+qRiOHL9oqbdANpQR3u8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675179088, "uuid": "f606fc56-a8b8-47cf-adcd-ea31adc587e8", "value": 88542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675179088, "uuid": "0bbf0a44-1c5d-4a7b-b1fc-f0c771b21a09", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179088, "uuid": "4e8f3c8e-26f5-49eb-bc29-96f746e83568", "value": "uEM4uDmm.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e68df6-a146-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675155904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155904, "uuid": "c2c9f5d3-211d-4336-be99-0346c33d9db8", "comment": "Malware payload (Mirai)", "value": "50a472bd2f4f6591ce36f71bd7376c79", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155904, "uuid": "ac9385c3-907d-43d2-9dee-da2960259c52", "comment": "Malware payload (Mirai)", "value": "04d8e06853fcd273e427ea4ce98d12a137740038ccb2856672321a276dc3b03e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155904, "uuid": "bbbf2cf5-3c83-4fba-8618-bbc3ce18f00f", "comment": "Malware payload (Mirai)", "value": "89a68eb4bafa4d453d13b2b51b322d750da867cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155904, "uuid": "f02d0dad-1044-4c75-adc2-f0fc727d03f6", "comment": "Malware payload (Mirai)", "value": "adcf308e195aa6d4c9236dc4485aaf12164d7133e3fe140fccac36bd4ab53c5fe3c5f0cc28192768e52aa51a8b3cc7fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155904, "uuid": "99512532-fe69-4492-8f7e-230adf51f84e", "value": "T1AF832952B8C29A26C6D423BBF66E518D372163E8D2DF32179D212F6037C651F0D67E81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155904, "uuid": "27ce816d-0735-4450-ac55-b25282e623f2", "value": "1536:5O+ZcVVSDmL/VQUTa1mBtH/b0EruTtl6nKEahWt4u9wp5OU6W35Xd8mf+w:5OEC2M1uponKnhSUpx3H8Qf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675155904, "uuid": "e83ea6d2-e6a3-4a18-9a66-9c699aab4bd2", "value": 81536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675155904, "uuid": "5c8b79a6-0e61-4c7b-9086-a7a02b98315d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155904, "uuid": "e9285f69-88c2-4161-8b7b-119fd29a6f2a", "value": "50a472bd2f4f6591ce36f71bd7376c79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef33350a-a13e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675152719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152719, "uuid": "17cee165-8e08-4efd-8ed4-c4cd362d7568", "comment": "Malware payload (Mirai)", "value": "a25085cf2d4dfdd73758fa0bc5b24f1b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152719, "uuid": "02987bf4-0afb-49f9-8caa-f0762ebf064e", "comment": "Malware payload (Mirai)", "value": "05077fcc7c3288b55a58c5c79bcc430232b78a270ff13f84ad502ad3ca223668", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152719, "uuid": "0792fde9-ed73-4744-87b9-f2a9e7111569", "comment": "Malware payload (Mirai)", "value": "102e02bb7d564c0a9bc3a42d21cd1222792698b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152719, "uuid": "7c6e7616-e32f-4290-9c66-248acc2cccc3", "comment": "Malware payload (Mirai)", "value": "320b755c02174f16ad8fb58d67428deb75eeb1f344f85d654381c69300ee034bd0336f8c72218420d03280cc1ec57aff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152719, "uuid": "995c1622-55c8-4b7e-ab25-6d6f07d50f6f", "value": "T15A82CF30619F75E8DBF10431EEAE8EC6971A0BF9D1FC36A217587B78898110211F92CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152719, "uuid": "2ea201f4-29c2-473b-9290-29245eee931c", "value": "384:MjlzRV0P6iOwrkom0DRnVATuSlShu6NvmPWtUn+KMa3shymdGUop5h5lP:6/V0P6+kom0tVAoNvm+to1cs3UoznlP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675152719, "uuid": "862e3a33-6739-40cb-a322-cdfb3e920d73", "value": 18488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675152719, "uuid": "9c4a4463-c1d3-4bd0-8687-c3c29ec02c2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152719, "uuid": "939d4dbf-80b1-4328-aa06-8424261278d6", "value": "a25085cf2d4dfdd73758fa0bc5b24f1b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c0cef5-a144-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675155018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155018, "uuid": "3cda152f-4461-4a43-9cb0-bcd8a24ff047", "comment": "Malware payload (Gozi)", "value": "34ef40251bf0498fb0d07bc628fe6dc5", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155018, "uuid": "de12c88e-c829-4b65-af83-2a0d505f645b", "comment": "Malware payload (Gozi)", "value": "06072724949dd9a1fad58acd4086cde0267cd8e1b2031b90c2d4bf93e249acba", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155018, "uuid": "f7795635-c428-409e-8fe3-ff1a9d700c3b", "comment": "Malware payload (Gozi)", "value": "c60b8038e313f8d243fa56b03803297ce42cde53", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155018, "uuid": "ac5c5f71-1d8b-4473-b7f1-d2ba4e0df6a0", "comment": "Malware payload (Gozi)", "value": "573c6feefdcbe82fcdbeebb061a998cc7f72bf6dbd91340b71259a3840f5e7eeb364baab119888ea64c8faa2a8590ff1", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155018, "uuid": "430de4ab-dc53-4cef-8c66-c8e85c6a6138", "value": "T1AFC55A2272F4D1E4D7268039B59BB307FAB4305913188BC353E04E9A5FE6BD429FA365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155018, "uuid": "b27e06f2-bdc5-4145-9562-6f6bc84db7b5", "value": "c87688a4056ff5023a5fd00d0e4be4f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155018, "uuid": "fa6d976e-04de-47d5-910b-f4a2a1d9b0f4", "value": "49152:dL5W79bCsT6TRR6OGykEzWCFC6mkAWb2zCeeYBKyCvUM7c:nSCONiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675155018, "uuid": "f540f946-2ee6-4129-af70-99beb72b862b", "value": 2686808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675155018, "uuid": "0c8adc45-1a43-47d3-80cb-32028c50965e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155018, "uuid": "d06164f4-a34f-4355-bf28-0e2903b65c1e", "value": "63d8d6091add1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e472a558-a14f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675160002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160002, "uuid": "4c45c8bb-62e2-482d-ade4-c462a4e706fc", "comment": "Malware payload (AgentTesla)", "value": "448305e882247a5257ba6f476b9dc18d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160002, "uuid": "1045ccbb-021a-4f11-9e14-0852c5f98f7a", "comment": "Malware payload (AgentTesla)", "value": "0626c9ae8dc050f093f16fe2c12e80162489ad4482fa628da354839d1d7cc8ae", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160002, "uuid": "9348ada4-43c6-409a-a91b-59044eeec4ed", "comment": "Malware payload (AgentTesla)", "value": "d0b8220fcb0b14fc9fa3d3728811c30d67269165", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160002, "uuid": "c391b6a5-0144-4cc7-ac5b-cd10556d6ffe", "comment": "Malware payload (AgentTesla)", "value": "3e903ce77608cc91449f5bbde062a1a23168c262cc54323dff90c5d38c378bfa6fb84b30d80d59c2a7b88cbab3fe1d89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160002, "uuid": "b73c9942-986c-4054-b398-6f3a6cb4da11", "value": "T1D662C057D2E0E8FCB83AA7B856F433FD58D94296DC15D1C90A48EEE8F145B38D08894B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160002, "uuid": "892b8520-1a7e-4898-85fb-4dede55efa83", "value": "384:B4wzTw3N3cqh3cpW05Giu/dqu3a86FnvcNWOrAHPcA3:BTzTAZc4cpZJMObvcNWOEvcA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675160002, "uuid": "e2ad2edf-31f8-4a3f-b0db-55d10d8f6dde", "value": 15492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675160002, "uuid": "fd53f743-d276-44db-9f61-ee6a3449a051", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160002, "uuid": "11671967-01cd-40fc-9ccc-45e6479ce113", "value": "DOCUMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a29d482-a165-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675169112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675169112, "uuid": "8ccb4459-a1d9-4bcc-a2b0-b540f8b2ca4f", "comment": "Malware payload (GCleaner)", "value": "b2aa12e5a519caec6938397bf516138e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675169112, "uuid": "db439122-1b4a-4d4c-9801-9a07e867e480", "comment": "Malware payload (GCleaner)", "value": "06c8c164908661ca0f152fa9b03110bd15ff3ab485dd54a7acda389e6b55e00d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675169112, "uuid": "8d276678-f560-42da-b4ac-690204d0ebe0", "comment": "Malware payload (GCleaner)", "value": "159d05c8201c5627cb645f9b6a0b66d45525a548", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675169112, "uuid": "95e5753f-db38-4ace-a3cf-81709206c798", "comment": "Malware payload (GCleaner)", "value": "0597e9fd88cbcae6b6a139f074eb6915ac9b24190f1569b1ca00b441b1ec2d23e8a8d9929c9b10452668c04b16437c0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675169112, "uuid": "98caa516-e283-45ae-8fe2-869318f6c400", "value": "T1DCA53363D4B68437C248C932A61A7F1AAA3B7F35AA311301B52D324D6F725842D3DB6D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675169112, "uuid": "b29c6ec7-1ef1-450e-95ae-0e221c44f03c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675169112, "uuid": "8ab0146d-7dfd-4184-8414-111eb1430214", "value": "49152:C2CjL6oJH4LA83N3VNj+s9WTE1wYfttPf/I3bYvA72LCgv2MR:d8W84LAsNFNj+iW41bVY0vKmv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675169112, "uuid": "c105ab45-c4ea-499a-81e5-cec5d66c7bf5", "value": 2216471, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675169112, "uuid": "ba6b3ab2-ba11-4e1e-b3f0-7cf59e232725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675169112, "uuid": "00006b97-eb8e-4c01-852c-e8c0f6687d20", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "078fe60c-a161-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675167362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675167362, "uuid": "1a0ca934-a3c2-489c-89a2-dd803062d215", "comment": "Malware payload (GCleaner)", "value": "e1337ae26c171aa48969a7af64819800", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675167362, "uuid": "0bff24d4-b1ff-41c7-b184-628c64b64a53", "comment": "Malware payload (GCleaner)", "value": "06fbad71abca0180281b33d91895e98b67bb89f370f7500ab2e4cb3c2e0ab070", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675167362, "uuid": "b9636b11-5bed-4dda-8ef0-2397669b6860", "comment": "Malware payload (GCleaner)", "value": "f69cf699a1f31896f66a628a40905b4f0e6308b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675167362, "uuid": "50a5f92d-062a-4075-91ef-8ab20be61089", "comment": "Malware payload (GCleaner)", "value": "7445dc444fdfd875232359988922fd90b87b68b5ba9133d53d5a42087b7d75615457917014dbd05e3931b29c8e6b5431", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675167362, "uuid": "273030d7-e272-40bb-abbe-b6785245643b", "value": "T192A533469176D237EB135A321F198D4171BBF6356CF9064531BFA60F0AB329AB80B783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675167362, "uuid": "855c6a96-590a-476d-9f4f-51e9a4b023aa", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675167362, "uuid": "ab3d513a-7314-4e63-9ffb-220489190beb", "value": "49152:C2+jqOZMh5M4w4S7KMcOPRvzlCTnGlY226aHweNs7WVjVLLCgv2MR:dnOZMh5S4S7qFGW7lw37WVjV/v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675167362, "uuid": "3d84ad65-7261-4093-b3de-b973adbe24ee", "value": 2206236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675167362, "uuid": "3837ec8e-8130-4e40-997c-ec897025e4eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675167362, "uuid": "02240749-ceae-4f4a-a4d6-9fab50d3eab7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6da65bd-a172-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675174985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174985, "uuid": "81dfa136-b8c2-4871-be70-b0b0dd838463", "comment": "Malware payload (AgentTesla)", "value": "553d8343044e51d96046c676a94fe822", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174985, "uuid": "2578b0d1-d20e-49b1-9a06-5101bc159125", "comment": "Malware payload (AgentTesla)", "value": "07735a9f61dae1c8540cb2a374ecd1d13a2b42e564caeadadef51a16e1d92a81", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174985, "uuid": "52123dd4-9ac9-4b72-b772-630d0cd31e69", "comment": "Malware payload (AgentTesla)", "value": "683e80bc8154582e2b9439900c6f1270b20a58ba", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174985, "uuid": "67edb7af-4dd3-4b06-b173-e2516adf6654", "comment": "Malware payload (AgentTesla)", "value": "1e1497b6e66e3c89a5da87691105fdfb905035561271e5a3f4bc3e642b45c87b6ffcce2adc4a551b5d1428b22e3cc75c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174985, "uuid": "02253a33-41ff-44ba-b028-22e4bb738f6e", "value": "T1E5E46A410A7B87E2D4F95D78163CA42826A21CE14BBDB13ABDC67D7A9CEB34F0055723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174985, "uuid": "31cb5288-ebe2-429d-b9a2-5768b0c66a00", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174985, "uuid": "a7ebbf69-ce3f-41a6-a909-2de5628031fb", "value": "12288:d+Onu0bcd7EOnoYQ9Lk8t3218DFoAQTl:t3cd7xnoRm8J218DdQTl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675174985, "uuid": "c9968edc-1fcf-4f09-8c23-8f60d54d8ff0", "value": 680448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675174985, "uuid": "0c6faa64-8d5c-43bd-a275-8fec28eee756", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174985, "uuid": "1c19f32f-1850-468f-939b-c79e68640969", "value": "Project Tender Proposal & Drawing Specifications.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af712bea-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140586, "uuid": "1b3a68f7-8fcf-4e2a-b667-3f48e275d21a", "comment": "Malware payload", "value": "37633ea59be871c0315a9452c45a4538", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140586, "uuid": "2bd5d515-5ec3-4121-8f17-c5a4f3212965", "comment": "Malware payload", "value": "07e19a9d1756ed6a2088651ccebde3d2eae598aa60fb9bed67db9b34f2ff8f2b", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140586, "uuid": "30e9a4f0-4e55-468c-8d59-9f9c37ff538d", "comment": "Malware payload", "value": "5d345955a9d11482c0283a6ef69931ea0272674e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140586, "uuid": "d2610c6f-a7f7-49e8-b43f-ea7148896f5c", "comment": "Malware payload", "value": "06865d2ca902ea06c73fe5b855b03a55dfed1d78ebc3b21a09fedb805b691ecaca85e56cb953819f4707e232c544afc4", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140586, "uuid": "0033c94d-5912-4156-ab2a-849263dc4d19", "value": "T1AA363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140586, "uuid": "294a1375-2a36-4d19-9a9a-cea00bbe4add", "value": "98304:Ov4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXF:OvpvFa+g8RWLdPk/84tCEr0RtNiC5eSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140586, "uuid": "ba016570-78d4-493b-bdb9-4cdda5c52a00", "value": 4993536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140586, "uuid": "cd7fe181-64b6-4738-98f4-f2aeb0cb64e4", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140586, "uuid": "7031c682-6edd-4a01-80d0-85c7e0eac4f0", "value": "07e19a9d1756ed6a2088651ccebde3d2eae598aa60fb9bed67db9b34f2ff8f2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80bf0bf2-a124-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675141366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675141366, "uuid": "6d7944da-82ae-4928-b02d-1689b0ca5fde", "comment": "Malware payload (RedLineStealer)", "value": "b874c7e31b764118ad7052faa4e0ea6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675141366, "uuid": "9498e6a2-6e1d-43b0-8c9b-fb840ae7e15b", "comment": "Malware payload (RedLineStealer)", "value": "089542da42a2164096246bbc10deb051e7351393ce172186d39e1a20460bb01a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675141366, "uuid": "8ddd0d9d-d8f2-4acb-b149-5ea9d8523eac", "comment": "Malware payload (RedLineStealer)", "value": "f819781e37e4bf3b95cfa2fad4370e1683e22c0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675141366, "uuid": "0f9de236-8319-4161-ae73-bf6b327686fe", "comment": "Malware payload (RedLineStealer)", "value": "6faa90551e219fb4ec674072cbd16be73ff0e12c4194cad22fac291f787886dac79a1bb45920352fa8b8e2416405c8b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675141366, "uuid": "ca9c49a4-f1cd-427f-b15e-6f9e8c1a72f2", "value": "T181540141B581B032D42568B81938C2956A7FA9314F7E6807BE4A1FEE5F732C1273B397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675141366, "uuid": "0f090eb9-d25f-4abb-811e-06d4c6428a0f", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675141366, "uuid": "ba7fb37d-5262-46ca-bcad-fecfbf264f3f", "value": "6144:uLZmOcDdMGNJr4+6OlsEvN2q2QLxnVH5:uQOcDNJrzdNl1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675141366, "uuid": "295f1544-8d91-4fff-841e-2948aed0226f", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675141366, "uuid": "8de2121a-ce79-4881-9b74-ecf0741d801b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675141366, "uuid": "c2662eb1-4586-466d-a6c9-d52359589791", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9f7281c-a182-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675181862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181862, "uuid": "5a7d35f0-9cab-40f7-a20c-87ba2ac38bdc", "comment": "Malware payload", "value": "340da5eb56ed0b954c51974b78c8534f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181862, "uuid": "971daf47-ad50-48e1-bfe8-a613951c9683", "comment": "Malware payload", "value": "092de5665e5923681fd32749a84fcaedf053025e9689448ec7417e40a483f782", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181862, "uuid": "c7fd0610-9b75-4fd3-a764-370b2cbc3cb3", "comment": "Malware payload", "value": "ffc51f129c18121da7aa1a3ebc91e0753460f43a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181862, "uuid": "97c0b8ac-91b1-4d4a-b745-41d0fb717700", "comment": "Malware payload", "value": "0ed045ebdc56d3115944d05efb99713c6926bb67ade4483b1ff27d7211a91d3380d928dfebb8447809a1acbfdfe7de56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181862, "uuid": "b852d592-fec2-475f-967a-6cfc0eab31a5", "value": "T11BF4F09D7620B2DFC41BC936C9682D24A6607CB7531BD313A453369C9A0EAE7CF065F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181862, "uuid": "53e9634f-e9f7-4839-bed3-9b4c34680245", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181862, "uuid": "d1b9136b-535f-4abe-a169-b49c78e340e8", "value": "12288:PBGxQTBFjCfuXdm4S4w1gzs4UIxoSjuF0d9h3k8/rsl2t/oOVgXN6XBBnMrMIlfF:1XYwwIxoSjXD2a/kN6XBC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675181862, "uuid": "9e0e6756-a6be-4810-b8b2-ea5d30eff5e1", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675181862, "uuid": "ee766637-8efb-4752-89d5-2d2f5d1f0a43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181862, "uuid": "29cf65dc-0876-48ba-aa06-f0476047e73c", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8377a642-a12e-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675145666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675145666, "uuid": "2c02e525-0936-49cc-8aed-fe48e22eb01d", "comment": "Malware payload (GuLoader)", "value": "aa62920130adcf9c00c3c8af9b059b23", "object_relation": "md5", "Tag": [ { "name": "BoredFluff", "colour": "#F93A09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675145666, "uuid": "8d2f4d83-ca4c-4c4f-9dd6-71ababbb6c07", "comment": "Malware payload (GuLoader)", "value": "09454cff8e1b6d8a06a3731f417fc2e86d61cffccf2cab60064e7f7a1672f4b4", "object_relation": "sha256", "Tag": [ { "name": "BoredFluff", "colour": "#F93A09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675145666, "uuid": "e8f706d8-aff7-4a0e-ba93-1545b9d31def", "comment": "Malware payload (GuLoader)", "value": "c579411fefdf3006dc176b193f6dda8b07da0fe6", "object_relation": "sha1", "Tag": [ { "name": "BoredFluff", "colour": "#F93A09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675145666, "uuid": "a26b784e-b2f9-4b76-a2a7-fa3c1f4d1544", "comment": "Malware payload (GuLoader)", "value": "a9e61f5721ff9563847125eab4354eb5b23ad4f9b161d2088d8763bfcce2b4b7b3d68c02bbf6a7c8008eb2996da60e31", "object_relation": "sha3-384", "Tag": [ { "name": "BoredFluff", "colour": "#F93A09", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675145666, "uuid": "39582fff-61e2-40e0-b99d-eb413f575b39", "value": "T198D4E0813350D753CD7FE6B02C51C8DA656BBC30E9A5A68A27A07E4B5FB50B0CE0ED25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675145666, "uuid": "5abe1455-ed1e-45dc-a7ab-fde725dc7055", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675145666, "uuid": "2a808890-4345-4ac0-b9b0-6967467f5647", "value": "12288:b7EWNDJccwIWYh7j7TY3POh48Wfb9g5stErYyqJNBUcNjRtBnMAr8D:MUlyYtj7EojiB5Er/qPBUsNfCD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675145666, "uuid": "c26e6b4d-9a62-4bdb-ac88-3f254ed822c4", "value": 635389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675145666, "uuid": "6671937b-bf51-4781-bd36-d206bee3a43c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675145666, "uuid": "e1414369-5f8e-481a-ba2b-c528aa89ce21", "value": "Destination Document pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ba67494-a18e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Cutwail)", "timestamp": 1675186938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186938, "uuid": "920f1455-aed1-4fe5-8039-4f0ce241bf3b", "comment": "Malware payload (Cutwail)", "value": "84290327a8ab5af7ad02aee63fcb57f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Cutwail", "colour": "#ED0EDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186938, "uuid": "8f66581a-398c-410f-91dd-efc38c88dfdd", "comment": "Malware payload (Cutwail)", "value": "09c55db03356ef131aed108a5983b70994301132a3ac6f5743a0a6cb6bb83818", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Cutwail", "colour": "#ED0EDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186938, "uuid": "c57fc367-8804-49a0-9de5-9803b7687a28", "comment": "Malware payload (Cutwail)", "value": "3a4a03db0ffa8a1a1fcdaea89ca5f15597599468", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Cutwail", "colour": "#ED0EDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186938, "uuid": "663b133f-1f8b-416a-85d9-74cdb1cc1201", "comment": "Malware payload (Cutwail)", "value": "10a0ef28cd5a3f501a4ca2270195a74bbd925df9ee3fd10389f4d6bfe6d4a35960e16f749864502c8894f10eea1a408c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Cutwail", "colour": "#ED0EDF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186938, "uuid": "656fc3a2-b1b7-4ef4-a40d-69c0c13d35d0", "value": "T115A4F19002B0AD35E2543EBB18B6AEE774DC963C775C80C7B59B1CE64500DD1ACB26AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186938, "uuid": "1bd9cafa-50b8-4969-bda9-2c1ba3af7c3b", "value": "adc671d382ab71ca551afdb52eb0ffc0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186938, "uuid": "26d91c12-e430-41fe-98a3-1fc29f946e70", "value": "6144:+FZrc/z9K35CBQ4qqWbkMt1MQBMF1CJLtso0NxtftKNE4DSJVJKk:+F2/z9K3Me+Q+FcdtQvtfCsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675186938, "uuid": "0f605c0b-174c-4e2b-b82a-4d7edbbd01cc", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675186938, "uuid": "0028b049-13ae-4593-a800-a414a13b03bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186938, "uuid": "eff4bdc4-b48f-4c98-b355-feb6447d185b", "value": "84290327a8ab5af7ad02aee63fcb57f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c435a02-a167-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675169947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675169947, "uuid": "2fbc5efe-cdc7-4a2f-a0c9-8a32cbc6a277", "comment": "Malware payload (Smoke Loader)", "value": "c145ad28e78d37544f6e4f60ba20a5d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675169947, "uuid": "95499df6-d8e5-44cf-a351-d88118e1eacb", "comment": "Malware payload (Smoke Loader)", "value": "09d5443877e9b4d3152509801503065854eaaf49fbb492ab29cc94973bb3109d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675169947, "uuid": "65e3c40f-2c9a-48d0-8773-181df167289d", "comment": "Malware payload (Smoke Loader)", "value": "d27991ec88ee934dbfa0f81f9f394f52a2dc9c8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675169947, "uuid": "a688be19-1872-48df-b52d-1263364a5cb1", "comment": "Malware payload (Smoke Loader)", "value": "772848a7b6ed291b67ab191ea44e2f15a60c609748700d4495fb421160b0bfb26e8d74459e95a3df56fe0a2a47e781be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675169947, "uuid": "a0cc6849-cd7b-4a4f-bef8-89ca717bee01", "value": "T184549F02F2E17C40F5668A718E1FC6E4F91EB9D1CE08A76523986A1F25B31B7F762301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675169947, "uuid": "85c269a0-5a1c-492e-a601-ee91bcaf65e1", "value": "78339dc1c5de0e493ea2b28607ce356e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675169947, "uuid": "f19d0c63-cf7a-4d02-a59b-1134dc116ed0", "value": "3072:sauvM7CLCLRo2sw5TXUX8he5UmGMNqsUOZM7Gx7f43H7BF6/85RCqx:8k7CLCi2swljhe5UpiZ1x7f4Vc/87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675169947, "uuid": "50b34766-835f-4c31-a110-f0464c30a7fe", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675169947, "uuid": "874ea904-e28e-418f-8560-a3908927e085", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675169947, "uuid": "bccdab6d-3821-4f02-88ec-6930d75c5b3c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88d85ac2-a179-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675177887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177887, "uuid": "47293d06-accf-45f6-bc6f-0839aec84dd6", "comment": "Malware payload", "value": "5cb666232021ab1b945fa77cef207263", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177887, "uuid": "83499b2a-af94-4029-b5b5-5b6a610c7130", "comment": "Malware payload", "value": "0a4011a649f719a61e7b3922aadabe7caf4b8b49345ef7724abdb0641d1a9169", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177887, "uuid": "db49c871-3d1d-415e-9acf-6fddaab5585c", "comment": "Malware payload", "value": "d283e386af8c942acacf06a7bebf954d416acee1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177887, "uuid": "8a60820e-1de0-4c86-a7dd-dab39b243afc", "comment": "Malware payload", "value": "bdd5ede865c2ae14c790c6c58aff10dfe6c3c9f936e0823c019cebba119a0f3e79eadbe87531635c1a83f9e9c7cf5576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177887, "uuid": "ad1e3ecb-80a8-4e27-8b02-54ef45b4542b", "value": "T1C0969E16B291C1F1C9AA90701A175F3AEB7EAE135612C9C3DB7728E85E31684E77F301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177887, "uuid": "7386706a-91c5-4f76-9962-718bbdcd7213", "value": "9a36de15e6d4da8dd7cc2ceedf680c3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177887, "uuid": "19c8c67f-0aad-475d-aab0-7ae36c4a84f7", "value": "98304:UL+yVi7sRjkzpNcEDvDgYmTIhLmB9BAUZL26X30k3OxHrOC1Md1Cevfx4TApM:hoQpfmTIhLmB9Vy6XkFHrOCCd1CeEAO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675177887, "uuid": "ff6e1db7-9482-4745-9aef-b44294f49aaf", "value": 8781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675177887, "uuid": "0b024275-6b7c-456a-8b7d-c152266ac203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177887, "uuid": "4187709d-d2e0-4356-aec0-43d82c76ec27", "value": "2023-01-31_5cb666232021ab1b945fa77cef207263_hacktools_icedid", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5b94cc-a1bb-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675206322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675206322, "uuid": "fa0c8f81-446e-4818-8119-b8125f819758", "comment": "Malware payload (njrat)", "value": "f59893b9ab5aae7d213c3f7b7845c9a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675206322, "uuid": "19abcdfd-9b54-4ca5-9892-82fd30460a1d", "comment": "Malware payload (njrat)", "value": "0a513f65bf5684873d3fc95eaa0ddd20a78887f05683f64aa1926557c2f51759", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675206322, "uuid": "5eb8202e-f4a2-41ef-aca0-f2ad34516eb7", "comment": "Malware payload (njrat)", "value": "d30cd5bdca11a1f3290939d15f88d01ebd2aea3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675206322, "uuid": "49ebaf84-480b-4cf0-931c-e7b35fd3eeca", "comment": "Malware payload (njrat)", "value": "95e999ec43aaeda8b082b437e5f44fd7dfffe27019f8baa70ada20c18b001da6524488f37f7f58c73cc72719d0caa075", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675206322, "uuid": "53a844e0-c89c-4b70-b225-8ff382f94128", "value": "T1A0B2294E3FA98856C5BC1B7086A5965003B491870423EE2FCDC554CBAFB3BD92D48AF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675206322, "uuid": "19f65dfe-f92b-410e-ac6d-41919b6d2a1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675206322, "uuid": "32575420-ceaf-4eda-8fcd-0963c88c888a", "value": "384:f/MKFYuEEhERvoBG16Xuy0MHNw6Tg1Y+75JTFmRvR6JZlbw8hqIusZzZz6:fUW4V6+yDRpcnuh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675206322, "uuid": "0c6523de-242c-4fac-a675-6cdf5a21ee53", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675206322, "uuid": "440ba074-3b67-4ac5-a544-bff90b58662b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675206322, "uuid": "327003e4-4514-41ae-be5c-c04a9130c1f2", "value": "0A513F65BF5684873D3FC95EAA0DDD20A78887F05683F.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eb7e16d-a179-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675177897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177897, "uuid": "9d225d2f-83ec-4426-b667-3e53656b40fb", "comment": "Malware payload", "value": "0ccbc7fc65551e5e93756805506dd9e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177897, "uuid": "8f231ba7-5eff-4d22-870a-85753c97ee1d", "comment": "Malware payload", "value": "0a730568c71b2ead7a45d90312afc0c45abe14b1fbf0f88a7637304a156d6fc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177897, "uuid": "e4f10dfa-c4d2-430e-b93c-23821a3a622d", "comment": "Malware payload", "value": "7ee47798be9b1545b8076903ca6e91fd10bf35d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177897, "uuid": "f033c80a-f8bf-4a11-a485-045a1d71c0ed", "comment": "Malware payload", "value": "645c3af8affa42e66cd5fa4615b2c410b3f7173c83f75075dd1d14869d4889b7298039ae1aa7ed65ea123cf0a20ba79a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177897, "uuid": "0d1e491d-0004-47a4-980c-a5b78f7692f1", "value": "T1A7256B2277E58035F1B36B3099399324597ABCB29C39850E73C8666D5FB0792CE74B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177897, "uuid": "8d4e9704-e83d-4728-acb6-09f8a343533c", "value": "1c9292c45c48e645e239d8f3aff7d1c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177897, "uuid": "2b6b5b86-f59a-40cc-969c-1c512223e199", "value": "24576:mREB9ccSBdJZbBr+RYhwASiTDNPxxilcltY:DccS3D8qqMTFxQcl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675177897, "uuid": "0498036d-6fa4-4a2c-b8a3-5b543ca82823", "value": 1009176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675177897, "uuid": "cad2ae65-9349-4569-b81a-f58773e53b3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177897, "uuid": "737e6ac2-0f7d-4984-bd09-94e3b8f1c678", "value": "2023-01-31_0ccbc7fc65551e5e93756805506dd9e6_mafia", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0f422b-a140-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675153354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153354, "uuid": "e8b36efc-fd87-40ac-8664-f2a9c8c242ed", "comment": "Malware payload (AgentTesla)", "value": "9d176a9d772d3d92500870851dae413e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153354, "uuid": "b1f4558c-0bc7-4eca-b6e3-a0ff7a5df03e", "comment": "Malware payload (AgentTesla)", "value": "0a91d8b6054a9776ad103099cd1fa52dfb3a81da74946c7b092a2c5e1451ea0a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153354, "uuid": "ea1b88a3-d76f-49c0-b6c9-82b367cbb116", "comment": "Malware payload (AgentTesla)", "value": "4168a6e970a35576017e5b1f2e678cc68d7e3fe3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153354, "uuid": "fdba729a-6e81-4c48-ade6-37cb7a9678d1", "comment": "Malware payload (AgentTesla)", "value": "ab58b4caf555d770bf9ef8061a8519db2767e298d01e1abacefe7fbcff46bdee98d321ca0be87b2bd9773dec60f52015", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153354, "uuid": "7b4d0787-f6b5-4140-ab77-eb1774ef1931", "value": "T1B3C4230962B09F2807BF808E67961BB99E510DC23B5F136EB3F671E351662236775331", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153354, "uuid": "1b868a73-30a0-4380-ad65-652df6c6f2b2", "value": "12288:maGP0ljcA0anA6bJkHKycOAvZltSANqrFXeh:rh7nqHOOAxlKkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675153354, "uuid": "828424b5-b198-4967-9fa1-c8d43546227b", "value": 548237, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675153354, "uuid": "94e359dc-5f6a-46e6-bf26-97cc9b93fca2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153354, "uuid": "0108620e-56a4-4120-a849-f54381566e87", "value": "New Purchase Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa711ec7-a143-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675154751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154751, "uuid": "593be981-3f8c-422e-8734-42a230bfcda9", "comment": "Malware payload (GCleaner)", "value": "4b6b15177dbc1fb1493d1fe9b78c8db1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154751, "uuid": "5894ff33-dadb-42b4-b5f4-58c894ae8770", "comment": "Malware payload (GCleaner)", "value": "0ae057621ea5057a75a3add2b27546f4e2c79e464ee368eb63515f14546c5f57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154751, "uuid": "8626b3d8-0523-466a-a94a-cc736ed89b5c", "comment": "Malware payload (GCleaner)", "value": "6bddb8fa5c0d84c96c597bdb85052b944541a0f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154751, "uuid": "d96606f1-dbf1-4fb6-8e12-e9f7d80bce49", "comment": "Malware payload (GCleaner)", "value": "add4e797df007e97f37f73e577f4a6d354f4d5896aa67087f6891e1da031cebec4b857c54a4b452b9bdbc313197a04ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154751, "uuid": "3cf24a11-3f8b-4e27-9e9e-fcf52402e04c", "value": "T173A53307215394B7E5A38B7534388452BE63AEA6516C8636307FE90F0F33192652FBE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154751, "uuid": "2f0e2d1c-bc9b-4b31-94d7-8f272a524044", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154751, "uuid": "f8e8d84f-e363-4572-82ac-f0d02c7bc2cb", "value": "49152:C2KXEdSfIrXdn1U0TGT2GWQl1OZH/4U1PYWWQpVLCgv2MR:dKXYSfIrXN1XGTzZ1Wf5rxJv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675154751, "uuid": "a2fe399d-018d-4368-9589-c2e099abe246", "value": 2183215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675154751, "uuid": "2679e22e-1e28-496b-bf57-0b389bfae347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154751, "uuid": "bc5a44c0-07bd-4979-8079-8862e15fb474", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2a9b46f-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140591, "uuid": "aab6485a-6ec4-4b1e-a417-bc9fff96677f", "comment": "Malware payload", "value": "df081f7edccfde43c041f4cb2fb81cc1", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140591, "uuid": "e887134c-e1c0-4355-aeac-20e31b5eab33", "comment": "Malware payload", "value": "0b260e735eeec8d411cc48aaf8dc2c7f60e6d56bb44f0ab7579210ee61e67777", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140591, "uuid": "52571e8c-c1e0-4dd2-a7b6-6b7cca6391d3", "comment": "Malware payload", "value": "106be4da529aa33e237d092c210fc70c46bed00b", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140591, "uuid": "731023bc-122c-47b6-bed9-d81f35abc0bc", "comment": "Malware payload", "value": "dfa630d66b40a829a0ac4534f9063af7e65016397e88bac6dc855680e044fc7d6344d1b731d07682196208c6dfec65bf", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140591, "uuid": "74aed0c6-f205-4aa4-9638-8eb704755ffb", "value": "T16C363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140591, "uuid": "67688210-c2d9-404d-8815-5ab3cd19c81e", "value": "98304:Vv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXb:VvpvFa+g8RWLdPk/84tCEr0RtNiC5eSi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140591, "uuid": "0de60d3f-fe96-493f-aa00-e51e79dd234e", "value": 4993024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140591, "uuid": "52fd7ca5-3809-4b2f-ac21-0eefaa6e69c0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140591, "uuid": "46ffab21-bb97-4a24-96e1-c4952f620db1", "value": "0b260e735eeec8d411cc48aaf8dc2c7f60e6d56bb44f0ab7579210ee61e67777", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2302d296-a139-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1675150229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675150229, "uuid": "433f4d89-3113-43aa-9332-80b7b9f35353", "comment": "Malware payload (AveMariaRAT)", "value": "63b0d7d1dea091acae5d5a04ec6d5d69", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675150229, "uuid": "842dc641-7382-4093-8f12-d8ffebdbdcda", "comment": "Malware payload (AveMariaRAT)", "value": "0bbdc2b18ba665641f8cd7829ab805fd9ca549737d9a17a1c4aea701cdff06cc", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675150229, "uuid": "28161563-8010-46c0-b7dc-4b9be10c471a", "comment": "Malware payload (AveMariaRAT)", "value": "6975aafdf116a8bb8e8da2c259fb17c95b82e806", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675150229, "uuid": "490835a6-3672-440d-9c12-b8b332ea239f", "comment": "Malware payload (AveMariaRAT)", "value": "4162bfb56dce75cd636308b7e496388ca935abeef2772cdf0141931781381b601bb548156f152e9dfbfdfb8b504f26c4", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675150229, "uuid": "78b3eca3-fde0-4231-94de-189cbb71247d", "value": "T12EF4026983F8CAF9D66503BE2DB074441F322DAAF15ADF0C0E9EB4D948AA301153579F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675150229, "uuid": "54074a46-0e63-4a42-9dc4-ad9d681e5cf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675150229, "uuid": "fb33ff71-7e94-4bd1-8592-22912f0d5153", "value": "12288:/SQDZGHkCMxoXsnDnsa4LUvisGRy5dqLnWeh3ih9HNABKq:ZZGHkpyqArLUOR0mnBYTWBKq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675150229, "uuid": "84443135-3661-48de-a592-b12f01558ccf", "value": 728064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675150229, "uuid": "1e669309-e68c-453c-b887-7d61e1bcdc27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675150229, "uuid": "28e535ef-7d08-494e-bac1-519826d5a5b4", "value": "6pvBHFV9E3Kpuk5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb4a8e3b-a15e-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675166456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166456, "uuid": "688968a1-b9b4-4667-adb2-d36b7333a7e9", "comment": "Malware payload (RedLineStealer)", "value": "abde9cb0b590c991b172ea630b1a89fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166456, "uuid": "8d664574-eed0-418f-b675-5a7f4031cdbc", "comment": "Malware payload (RedLineStealer)", "value": "0ca994fbd061c8854c060f0e07c85cf1e5036ea391964ef2c32895567b78d2da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166456, "uuid": "7033a39c-679c-4229-97c2-349cbc26a4db", "comment": "Malware payload (RedLineStealer)", "value": "f3b53bae1b81ab214ad5b66a2e579bfa22215ac1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166456, "uuid": "262f5297-c5a6-43f2-9919-320db56e2f09", "comment": "Malware payload (RedLineStealer)", "value": "ca41fe78c6667076e2838d891e0529ac2505e2d06947a85d59f47b793544d7e8c5f6bcfcce2d105995bca59e8cb01b5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166456, "uuid": "7d935710-48f7-4d74-8f6c-833423dddb38", "value": "T10C84BF02BAA5BC40F5658A35CE1EC6E4F61EB9C1EE14672633186B1F65B33B7C762301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166456, "uuid": "85338aad-172a-40ff-bb12-3f91138a9bf1", "value": "78339dc1c5de0e493ea2b28607ce356e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166456, "uuid": "6cf0cafd-7943-4845-838a-9050fa468c1c", "value": "6144:z3WfLNxx6HgIPotBlfpiTL8c/NRMQXVoPbflabr+e5m7f4Vh:LqbKgIPa4RZoDflaXVmzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675166456, "uuid": "df6b7355-01b5-4ac3-864c-07dc1b5130b0", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675166456, "uuid": "a370fbbc-3a20-4cab-85bf-b564f1ae1456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166456, "uuid": "18185011-7a9e-4143-a7b3-5075efdb284a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdaa01d3-a168-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675170674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170674, "uuid": "257aae4c-c01f-4d11-8619-0b98052ae5f0", "comment": "Malware payload (Loki)", "value": "2e48f709098d4c50ad693672ec645052", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170674, "uuid": "963edd1d-b15f-4763-8b54-e0246fadc4c7", "comment": "Malware payload (Loki)", "value": "0d4669a03c579e59594575a1a1ee54bc98711b5f1045dbddc61a57cb4e32976a", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170674, "uuid": "7f372e31-8e37-40a0-b253-af6b6ae6dd5e", "comment": "Malware payload (Loki)", "value": "cda4b8faeef1406b0b5991ca4fb7f96e37528c8a", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170674, "uuid": "c4998aa1-9e5d-41e7-b2f2-0888e58ccea7", "comment": "Malware payload (Loki)", "value": "81d686acc24d176d2b5fa013ac4a5eb4333998fe8fdca7bbd208675a6dad7caff76c34271606a32c3c26f017b5d674a6", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170674, "uuid": "04906239-b4d3-4ff4-a605-6eab20a767c3", "value": "T171A4231233BCDBBCD53F17BE66B2902293B52542351BE7484BD560F8291FB84A7A2371", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170674, "uuid": "c54cb5b1-89db-43a8-b6da-dae7f7520b69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170674, "uuid": "13b8d3f6-5fc7-47c2-9cb5-abd30a15e58e", "value": "12288:wr8z9i7+pv9ODFQkZTZPr9Em1PCckBgqtjss8CWtO:wr8zw6R2zZTR36ckBgEDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675170674, "uuid": "a746cd65-57e2-40d9-8490-e2b99d87a474", "value": 485376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675170674, "uuid": "1ac2d50d-2c34-4104-b216-6899f160fa51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170674, "uuid": "133d96cc-bd9b-4f83-b2f5-b2e1407f48ad", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd535dde-a1b2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675202483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675202483, "uuid": "e6c6748e-4dc0-484a-96fe-b8f92562595c", "comment": "Malware payload", "value": "acc0011bcb1cf164d4be187abe6aefb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675202483, "uuid": "dcae1fee-dc0c-41dd-a460-3b7969430d3a", "comment": "Malware payload", "value": "0db49d6ff765c0dccca3f96c334ad1435733ca0fce33667037a3e0caabdd9594", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675202483, "uuid": "18d46d41-7f56-4d2d-afd3-63db992f030d", "comment": "Malware payload", "value": "fb98348ec6fa8034945669a6cf65823bd9b18eb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675202483, "uuid": "bad7a9d7-1a92-4c29-bb4a-8701add8971f", "comment": "Malware payload", "value": "d3aa3c63ecd427625be55ffc2fb618e84b55ecc44a1f292c58a5b743dacbf91e6e0b7567a2bd5a9740b7e654cfc3bfad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675202483, "uuid": "c95f91f5-b252-4669-89cc-8f16ab50b633", "value": "T12B549EC2B2B27C62EA218B719E1ECEF8761EF5524F087766121B9BDF15B01E1C5A3341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675202483, "uuid": "4ebb7006-f327-4e30-8328-4591c972e4a0", "value": "d84aba910fd98bff40c3867e1dd713e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675202483, "uuid": "f1d754cd-f94f-40eb-b23b-980fc90a515b", "value": "3072:LbuNzILTTbnRsAqhhnQouXjqzgMdzcvljUv1mqPUx6WfQz86vluh3MM:uNzILTXaAeJ+jXcR9mqMoI7h8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675202483, "uuid": "265c07ed-ffe2-4e46-80aa-047699b5122a", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675202483, "uuid": "ddf09560-caa8-44c1-8cfb-d763e3434a6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675202483, "uuid": "eee95f19-90ba-4ab7-bd8b-af6f639bb1eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2a0b283-a143-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675154818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154818, "uuid": "bc9cb5a2-68fe-4adc-8a77-35b460929a27", "comment": "Malware payload (Mirai)", "value": "db35b325162a2ffcc25440b7055709b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154818, "uuid": "905770a5-5517-4bb8-b0b9-60d53b400663", "comment": "Malware payload (Mirai)", "value": "0f5577443ae55e71e83f5948223ad2d75ea785443cb589becdb2e4f9be9df21e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154818, "uuid": "5d895af5-4336-4126-b02d-06699936daf6", "comment": "Malware payload (Mirai)", "value": "d782f92d4213ce6cc4f0a8f90e016360aba81aec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154818, "uuid": "bad20cc5-110a-400c-bdec-9fbe9696fc52", "comment": "Malware payload (Mirai)", "value": "f1134dff1a9d8fcc26db12300ee04233ce2b11bb0b1077aea6fc03cfe8b8f51c0dec9ef1b60f37081591f693c18285dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154818, "uuid": "401edb02-2c0f-4e21-9f2f-d71ba9c85d1f", "value": "T155633AC6B643DDF1DE0202B43077EF325A76F2B6111AE9C7D3B4A623EC826519407A9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154818, "uuid": "a912d968-4b72-4653-bf61-93751fb3b293", "value": "1536:PXqCtJ481RErbhvMB7f0m6WJs43QAYvFBUHUVfvaOnEZtowKE:P6EiOErbhvMV0mdJs43SvFcwxnE7NK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675154818, "uuid": "10b8aca4-c21c-42bc-a60b-e8a138bf47db", "value": 70640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675154818, "uuid": "80a1647d-2fc2-48f2-a2b6-9155fd235c89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154818, "uuid": "b4b84122-3da6-4984-903b-a081858008e0", "value": "db35b325162a2ffcc25440b7055709b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889b758b-a13c-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1675151688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151688, "uuid": "f51950e6-e70b-455f-b32c-1aa1ad026374", "comment": "Malware payload (DarkCloud)", "value": "55e5e28196aeef77c5eee53b57e3d080", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151688, "uuid": "f72e87c3-8c87-4793-8bb1-76d508a1a172", "comment": "Malware payload (DarkCloud)", "value": "12106652a544b41ff02bfaf4693a7a797a59419964500170be740933fc110363", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151688, "uuid": "ef7af968-535a-45b2-890e-e21943be2cba", "comment": "Malware payload (DarkCloud)", "value": "93f51f38cf8c92443c5b40043821e2e740e1174d", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151688, "uuid": "7daf77e8-7770-4ea2-9fea-74dd5deb2725", "comment": "Malware payload (DarkCloud)", "value": "34423428042b6ed6d6b190f86992b8b2cd3d2c34bea0666d3af40bcf946f9f9b57449715dc9bcc5ae98cd509e58d5d2c", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151688, "uuid": "11bde4ec-84fb-466b-b557-40d911eee441", "value": "T10115026953788B96C56A43FA35F414693B301276F0D3E7484D8EF8E588873F08E6762B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151688, "uuid": "6f057bb0-b563-4013-a0d2-4a4f2b36a535", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151688, "uuid": "919d1c50-c86c-4a0a-88b3-f560a2096cbd", "value": "12288:KPLRouMhO9MEI+5n9oJuLZJJEt0PFOMv/QPghTis28X146DpkoWeh3ih9HeA:KPtouql+j1ZJ62UOf246gBYTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675151688, "uuid": "b3e5fee3-2ba7-49b2-b40f-4068466d0f7c", "value": 953344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675151688, "uuid": "6c4203fe-2804-49ef-9edb-644d21f2b06c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151688, "uuid": "fb22128b-f21c-4720-9b9e-2d9e69bea9f6", "value": "payment advice copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2176410-a136-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675149234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149234, "uuid": "ef136ec5-d867-4d20-8f4f-ca0afcfcab81", "comment": "Malware payload (Formbook)", "value": "efbb3f198196b39bb10475a6bce30e27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149234, "uuid": "8a115eb0-9663-43e3-87cd-a14855346307", "comment": "Malware payload (Formbook)", "value": "128505a47c9f43ff7ee232ae8e617756b0fc1bef2548dd893245514008dfbe58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149234, "uuid": "d999aaaa-be61-4370-bba8-c15795a8e8e2", "comment": "Malware payload (Formbook)", "value": "e9841c39e32d88396cd52dca28a3722910bd819e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149234, "uuid": "5ad13823-a9e2-4adb-9dc3-a539f440fb4c", "comment": "Malware payload (Formbook)", "value": "2bf211e7b1d932f6d604ca92be0f2386a13a049108df8cafcb1d2ad55f847d74467a5b43a0c78b7aaffef3693d20563a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149234, "uuid": "6dd0374c-704d-4ca1-8b81-cc5e36632d04", "value": "T17E54124A1380C097E5E77B31193E09165FAAA6242BD4970B67CD969DBF33094FD8F3A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149234, "uuid": "9ecc5c09-33d7-458c-ae84-92fb58b4b0ad", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149234, "uuid": "1fcefc33-cef9-4076-8894-a18db2bfa24f", "value": "6144:vYa6+1DFYAwJjOLaU2SwQoEJK9dkckNLDTZfG8zHt3NoIZiT5fY:vYwFeAAOB2STopkcoTZO8zN39U5fY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675149234, "uuid": "97ea2ef2-8dc8-4805-914b-3ffa1c53f6d5", "value": 293110, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675149234, "uuid": "aa72d157-3fea-4af3-befe-f36722517f0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149234, "uuid": "69b32f75-48f5-440b-9a58-9d7dad2548ff", "value": "love pas.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97352440-a16f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675173616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675173616, "uuid": "37f1bfeb-9c9b-4acc-a783-7543790d375a", "comment": "Malware payload (RedLineStealer)", "value": "7a9b8295d9e5c75543f21bc0d5093a96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675173616, "uuid": "8e8b5654-4586-4210-82e1-cdf510168788", "comment": "Malware payload (RedLineStealer)", "value": "131739218d908bf77106b5c72ab456bce9a7cacc56eba93434eb3de497bd8fa2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675173616, "uuid": "01e76ab1-b208-4a7d-8a6d-0d0e43372d1a", "comment": "Malware payload (RedLineStealer)", "value": "3506db1633ebde4eb3c2d5531dfff991d1116720", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675173616, "uuid": "d617345f-b8d8-4f52-a022-dd063d12c1a0", "comment": "Malware payload (RedLineStealer)", "value": "a4607c208fcf54c3b3dbd0f760c1816d5d831094ee88c7200210efc98acd14c594cca6b877f74e4251e6de136168c19e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675173616, "uuid": "e29e16d3-2e1b-4f17-aaec-f5841c8b0a9b", "value": "T1B684C0C2F2F2BC6EE92286718E1EC6F4791EB5424E597766121B9BDF24B01E1C1E3341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675173616, "uuid": "bdf5eb48-18e2-446b-883b-27380f96801f", "value": "e73db8d7bd9f9f6b2076d026a8fb8fc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675173616, "uuid": "6f5f866f-cb7e-46ec-ac69-28a09db974ba", "value": "6144:3GcYL3FMxxiy/L8YOZ1Yp4cXax0y6/6+vIX+M6lkNmqMoIfV8M:2frEi28YOZ6pkZ63Au5kgqMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675173616, "uuid": "c5de9487-8fa9-4b31-930a-d1b0f0abd0ba", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675173616, "uuid": "13ef376d-6b97-4077-bb45-44c801518d06", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675173616, "uuid": "ad905b7c-9c43-4774-b66e-46f7cf4df1b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49062fac-a1aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675198826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198826, "uuid": "dc07e388-d28f-49cd-b0f1-f5f1e9913662", "comment": "Malware payload (RedLineStealer)", "value": "b3176d3fe270f8aa12996cca4e4aa250", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198826, "uuid": "8c945b2c-e3ab-4fa5-9a00-c22f98baa17a", "comment": "Malware payload (RedLineStealer)", "value": "139664361838d8a301758e93a5d3a32b13ae1eea6d64e467fdfa7b840cbbf6af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198826, "uuid": "876bf961-32ad-4ace-84de-af645a76898d", "comment": "Malware payload (RedLineStealer)", "value": "74fc3fe6e8376d8a83b76ecabe342c56b8257d4f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198826, "uuid": "efde669d-1b6a-433d-97bd-eb6241f051bf", "comment": "Malware payload (RedLineStealer)", "value": "31bc63d3d91aa7ef901c28c7b49de3a505ef8ca578995874643587c6128f6b60640a139cb095e0fc7e99afcdb54da289", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198826, "uuid": "861c7a66-91b0-4abf-9e0e-808f7b5b2fcd", "value": "T19815E05072B8EB42EEA48FF5101191914BB22E6BEF64F3681C82B1E71A73BD13E50D57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198826, "uuid": "e010b6b2-d56c-497a-ae88-1a4d515b5c25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198826, "uuid": "9fef6556-419b-4f26-bec6-01abee5eb2cc", "value": "12288:Pur8kyGy+ysqQzjkATGds3MtEwcU3gZ+7wM4ELmE3fsZLXycBT29f6bXaNI:o8kyGyOqQzlGI6AAgZ9SLbatBT00b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675198826, "uuid": "f00f62cb-3bdb-45e4-a475-15670c8e5172", "value": 886784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675198826, "uuid": "233bb0c1-4aa4-4b1b-8a0a-4482508e57e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198826, "uuid": "2ce671e5-dd50-49ee-917e-c976b1cb2829", "value": "b3176d3fe270f8aa12996cca4e4aa250.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44802eea-a141-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675153721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153721, "uuid": "56932dcc-fd6b-4091-8c1d-1d34f6861df2", "comment": "Malware payload (Formbook)", "value": "43056ad325dc432700151289c7135e81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153721, "uuid": "84ceb0e3-b9ee-4475-8d83-0188f176086c", "comment": "Malware payload (Formbook)", "value": "139c10bab25d09231dfa465708c27632ed0618caaa710af0a1f326f80abd365b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153721, "uuid": "d2725278-8635-4ba4-967b-d6a3f200ea88", "comment": "Malware payload (Formbook)", "value": "7bbed739e54f8c6806d75bc1e07b64f3585297ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153721, "uuid": "66f3c506-db70-4cd9-ac51-b1176b4da23d", "comment": "Malware payload (Formbook)", "value": "bfd818f500c016f2392937e2c0a7988ce733242e3e4768096e8142ed5b5509f9a7875a554b4253219d298311210f51a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153721, "uuid": "bece4eb6-07c2-43af-a16a-a5d6c8f797a1", "value": "T100541255A694C4ABC8F30B332D3F0B01B7D9FA06447D9B5F23907E897A72A80D94E352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153721, "uuid": "a503000b-3cb7-4b7c-bd2c-7928b95528b2", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153721, "uuid": "8d4c2aa4-cf97-4f3b-ac61-db7f02d79aee", "value": "6144:ZYa6lRGw1D8yslb006YIaSt+sBa6klAF/uGBe3H9ZOJ/chVmabHyvbCfnN4K:ZYTRn4yslb0BYXH6a6kI/un3nIuAa4bS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675153721, "uuid": "0b0b9aae-bd05-4e2e-b79e-ba0e8a2dd61a", "value": 283897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675153721, "uuid": "f807378d-bb71-4f4d-82cc-46e2a6793d5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153721, "uuid": "6d3d26c0-5733-4e84-b0fe-c1e001e89d39", "value": "SecuriteInfo.com.Trojan.Garf.Gen.10.30679.23954", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c40f3773-a145-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675155653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155653, "uuid": "756ec6c0-79bf-4c7c-a939-872e06cefd22", "comment": "Malware payload (GCleaner)", "value": "7d0a529644864cbc883f53afad4cb79f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155653, "uuid": "7a40271c-d401-4dfc-8eae-ede6e4bfac0d", "comment": "Malware payload (GCleaner)", "value": "13e7cbc5df47b36dc411a3da5350dc0bbf53ed461b9112f598304fd2c85aa66d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155653, "uuid": "8b2b5067-4e87-499f-916f-188d0187e4fd", "comment": "Malware payload (GCleaner)", "value": "6a060899e687f8da70c68a99e0f36234e6607b22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155653, "uuid": "9d9a49d2-5997-42aa-a745-a594f0087372", "comment": "Malware payload (GCleaner)", "value": "6265045881f43064987cad249017a57cc37aa593ded06fd8a162f4963012213378b5f5dca02beeef1bc0d2d9fb80850b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155653, "uuid": "cf201d2a-6d05-4110-bee4-f96eb1aa88ed", "value": "T192A533161BB2C471C803A7BA6DB1E692FCB17F276C213264305EA6DD0FB3758702935A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155653, "uuid": "6179db82-e536-46af-b049-465fdb40b68b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155653, "uuid": "f713a125-5fc8-4a86-8e0e-001c5f91a5b5", "value": "49152:C2114fMRaX26DOo02uQ6JBIVFXLgcz4h38/oePKOvQlpb4ZYeb3ULCgv2MR:d1afMRaX2SOovuQ6WFX0eFiTbCYeb3Et", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675155653, "uuid": "65ee20da-89c7-46b3-8c57-231aaa37f1b7", "value": 2208431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675155653, "uuid": "fa148d3a-8278-424b-9d61-2da99f5ddb80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155653, "uuid": "09b1b217-831b-4173-aee1-0d4241e73510", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "764800e4-a1aa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675198901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198901, "uuid": "ae11c710-e376-4371-9010-14b5076d45ff", "comment": "Malware payload", "value": "192b1e7905bc0da7c35f65c24eb537b8", "object_relation": "md5", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198901, "uuid": "aabde73e-b996-4ee6-a413-890deb12f761", "comment": "Malware payload", "value": "145e9558ad6396b5eed9b9630213a64cc809318025627a27b14f01cfcf644170", "object_relation": "sha256", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198901, "uuid": "1a6c12c6-ebf4-4f67-825b-ccbd69c542b4", "comment": "Malware payload", "value": "e9dfcd57a5020a0e472d6eec6fd18116d135da7e", "object_relation": "sha1", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198901, "uuid": "4725922c-9ee5-4ae1-bfdf-0e1538e37d6b", "comment": "Malware payload", "value": "b02a8b76833905d0c38df1b0388e410af1323ad4534480d14e441672969d71baae8d86d63caa4e50956cb0c6914e88e0", "object_relation": "sha3-384", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198901, "uuid": "321252db-d4ec-4d43-bf93-43380fe9e273", "value": "T1B5514ACCAB2AE8D60AA9414C52AFC9A45565CC1027F2F7A42A4D30F3E591BB4F95D31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198901, "uuid": "6638ed6d-d93c-4d82-a1ed-59cf0f1b3572", "value": "48:srcHRJ+qHS+3pNxHKol70h+uSLaytqASMP0h+kIEZ39XMg7TMMa49V/y3Tpl:soHRJJHSaHHKodeo7Pk77TM4qDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675198901, "uuid": "920a296b-6a48-4085-a4aa-f14858d61967", "value": 2536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675198901, "uuid": "925cfef2-afa8-4034-83d1-c3d894eb6064", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198901, "uuid": "bbf42842-7e9f-470c-b11a-4b61bf66a13e", "value": "attachment.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04cc8939-a183-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675181961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181961, "uuid": "04a9d75f-9e6e-4c15-8ccd-aaa3d7370af2", "comment": "Malware payload", "value": "9bb347432d6e8b9547423d3669480fea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181961, "uuid": "d6a9b010-9c41-4f3f-acaa-0c749875b520", "comment": "Malware payload", "value": "15d5605f08420bd6b2ed02d9e08885e442c3f3e0bd4423b2ca7450f593799963", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181961, "uuid": "c74bee0c-3503-4c1b-a764-6375a0bedf51", "comment": "Malware payload", "value": "7fce085a31c86c3fadd50c4112de8a29ce6f56d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181961, "uuid": "7a932004-6842-4361-8b34-0a55ce28b970", "comment": "Malware payload", "value": "d8fa62a12684b748aa7d863a9e871a704671ffdd7309090c299759534d234ffb769792c10227e9a0d7a3a7cfd426fc75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181961, "uuid": "65290570-8f8b-4287-84b5-e719eb4cac21", "value": "T1F9E2074677E94215C6BD6AFC8CB313210772E3438532EB6F5CDC88CA4B676D40256EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181961, "uuid": "4015489a-cde4-4538-a42f-190f256dd1b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181961, "uuid": "727331c6-9d2e-456d-82be-c2d8cd17e088", "value": "384:I0bUe5XB4e0XmOntlXCpF7r/HWTztTUFQqzFfObbT:9T9Bu1tlQQ1bT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675181961, "uuid": "eac264f5-7979-43f4-b6cb-695b09b5e5b9", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675181961, "uuid": "2c83aef7-a15d-4438-ab88-80e23e3a3413", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181961, "uuid": "8d1ebf4e-8675-4831-a1ae-9ce9c25324ce", "value": "xs6Wrp6hsMa5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "697d165c-a1a4-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675196303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675196303, "uuid": "7af536d9-5b4a-4c46-967b-778dd751ad1e", "comment": "Malware payload", "value": "1c5a2acb330956c96914df403be60a91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675196303, "uuid": "0b6f851d-b796-4324-b92f-de849759af09", "comment": "Malware payload", "value": "16913d5e67c1fb8860148f92e0152c83dca0109749f7bd0b355354ce612fc131", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675196303, "uuid": "3844a693-649d-486a-a317-6fc340dafb39", "comment": "Malware payload", "value": "5d3ee6b7025b3407973146a565b196f07a9eb2ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675196303, "uuid": "e92610f7-a708-4a8d-90a7-ed1930268ff3", "comment": "Malware payload", "value": "098b0c1a3e588ea40f5988b9370e35c20978a1cdf3409fbc12cc32bfaee6b97f2b616ca4a0224339df4c06a69475b57d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675196303, "uuid": "e0c7b1f1-db21-466c-9c45-55bb549b4c15", "value": "T175548EC266F2FC62E92186719F1EC6FC753EF5D24E087766121B9B9F26B01E1D1A3201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675196303, "uuid": "e96fd523-9038-4d03-bb54-ec4cead735f4", "value": "e2474d94404febb68b5af309915f543b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675196303, "uuid": "d95748e4-2b07-486e-b723-901b90bbb6e6", "value": "6144:sG7WOL/VMsShN3Aos26TeH3SFFVVmqMoIfQ8M:3rzrNCH3SXVoqMtQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675196303, "uuid": "cf1bd57f-042e-44ea-90d5-dc63b6e2aa5f", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675196303, "uuid": "1468ae16-e54c-40eb-afbf-ec8c42c3aabb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675196303, "uuid": "fdefc422-6229-4733-9e2c-74727835561b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eb9aace-a16d-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1675172555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172555, "uuid": "122ff2fe-42d6-463f-8755-4aeb8e78eb1b", "comment": "Malware payload (DarkCloud)", "value": "9db0cb8ce863c77576b7fe8a65c4c200", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172555, "uuid": "acc25b27-c524-43b0-b148-c12db8dfb1f2", "comment": "Malware payload (DarkCloud)", "value": "1716487b103dc267d5d1d0ad0f83565c11e3a18b0fd840f7b16893a14716b299", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172555, "uuid": "21f32e54-6136-4a94-aa65-56361f556669", "comment": "Malware payload (DarkCloud)", "value": "fbc4371a517670d9e0f3df4b423f1128c98538ab", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172555, "uuid": "67de12ce-94ec-4519-bbf3-96549fc9aae4", "comment": "Malware payload (DarkCloud)", "value": "c893cfeee3c420af3945af550ba18929796c99328d6ef0584f3cb7a1b6da676d34f25edf3d568afa90a709ae86153fdc", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172555, "uuid": "b1d72afb-1e8c-41b2-a16f-8822f36d041d", "value": "T195058D8B6952885ED4D0BE706CF5558B39379CBA0018D283DEDFFE2CBE7134462C6698", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172555, "uuid": "c07a1082-4207-4ba3-b677-203d8ced217b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172555, "uuid": "13a0cd56-2f1d-493d-8636-df36af360a4e", "value": "12288:2Y7mobjGBDlFYlWxHE1DtDjZ6mmjgn9LmszAipCEKW/DiaC:2Y7HjGRlFYM9EttDjgPgnUHWLi3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675172555, "uuid": "e041c0cf-7012-478a-b764-d3b02910c598", "value": 849784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675172555, "uuid": "ba43b8ac-b04b-4b31-9d11-7ec146792f25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172555, "uuid": "75aca846-0787-4576-bb79-f5fefc24be68", "value": "Payment Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c77962fd-a141-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675153940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153940, "uuid": "58b3d44b-01eb-4ca1-a56d-842aa1beafb9", "comment": "Malware payload", "value": "3b5dd379c2276fdf49032934fd8fb736", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "senseofswitzerland-ch", "colour": "#B73529", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153940, "uuid": "1abba755-e129-42cc-bdf9-34a280b5c4a4", "comment": "Malware payload", "value": "178995f0584cfbe8e83f10926465f064993f30a8a1138432d6c956228e5c3483", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "senseofswitzerland-ch", "colour": "#B73529", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153940, "uuid": "ef53b90b-96f9-42cd-a0ac-509d84bbf49a", "comment": "Malware payload", "value": "dd5dfd71c65687cbf294cf22efc4e580207441c8", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "senseofswitzerland-ch", "colour": "#B73529", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153940, "uuid": "ac5dc4ea-e967-4023-98a7-c0c7acd92bf0", "comment": "Malware payload", "value": "16e2ea0cd2021e176dad146120c38f32f7dd0786ed16f65b4365d96bc0272b87e178fa0d2da52c62122890a4e4dcd7e0", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "senseofswitzerland-ch", "colour": "#B73529", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153940, "uuid": "c3c8092c-09f7-45a6-bfdd-603542d28b7c", "value": "T156456C107B2014B7E114C3754AD137A27BB1FDFAB6320A87704C57394F8AEC16E609AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153940, "uuid": "43e76bd6-7ef9-430d-9299-703ffb05ea95", "value": "384:c4KpM0zWCeRUqrjR5ciJTfJE4RREiEhJCxyq:c4KpXCCXWNfJEAEXRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675153940, "uuid": "a4da3073-dd28-4763-86fe-cc2899ab81fe", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675153940, "uuid": "f4a98972-ce48-47c5-bfc1-8d0749d1800d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153940, "uuid": "7ed26c66-37ac-4bba-bb94-33b6dbf09036", "value": "0085437719.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9d57fe-a107-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675128741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675128741, "uuid": "09a7a194-b0c0-42fe-9ade-81afe97d50d4", "comment": "Malware payload", "value": "2478dd0350147358149d3f176b79edb3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675128741, "uuid": "fcaa3c9e-3c64-40d2-8a3f-e1e4b1b06a12", "comment": "Malware payload", "value": "17b663a0fd2ee928ad5611283fcd8ef3a7c93ccff9527517a0ed892726c82ac3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675128741, "uuid": "4920cdd6-9159-4da1-8f52-ab041b8b3595", "comment": "Malware payload", "value": "09e70da9e19a4359d3f9d711422e40b4e7895017", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675128741, "uuid": "0c10ff84-f5d9-4cc5-bf6a-79b0057dc9ec", "comment": "Malware payload", "value": "63296c3921e3109fd2c0078ea04bce4e9085a06e885bd630fbfa369fb38e5446d9904afadfb0e491ef88b7ef5c13a4c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675128741, "uuid": "705721fa-a951-419c-925d-9cf77321f714", "value": "T12295E042D8F789DED8F7CD7A3E6BB79781E8176897C61321B0964B021C809614CFA4E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675128741, "uuid": "df41f1b9-465d-401b-bae7-c9e9d7577b92", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675128741, "uuid": "12466798-2de3-436d-86b4-80a772119637", "value": "49152:w8+Oi/59OwXkkoA7hjdjWCsv5AQyQfuzM:w8piawXkbAtjeV0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675128741, "uuid": "c8f40ed8-2287-44bf-bee8-aaff760e7fc5", "value": 1951744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675128741, "uuid": "3cb93bc3-4fd1-4848-b778-3d710c436b70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675128741, "uuid": "38477519-943f-4f13-a1ae-ba3ce58b6923", "value": "2478dd0350147358149d3f176b79edb3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77811e4d-a13e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675152518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152518, "uuid": "4c9e7a3f-3b1d-490d-bdd5-efc5ce51b45d", "comment": "Malware payload (Mirai)", "value": "1153d6ec340c8f63dfd6f4f8ac0554dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152518, "uuid": "2e05d4c1-816c-4bb5-b0f5-eb545752de54", "comment": "Malware payload (Mirai)", "value": "18c9c7d48a092af4e43a6a77a3b38d84b72c947604ad45147c0e75415e25fe4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152518, "uuid": "e8c51c84-285e-4f15-bfb5-061210e706f3", "comment": "Malware payload (Mirai)", "value": "ec44eb70120439683cff50b14ca526daaabdd9f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152518, "uuid": "6e879938-3d63-43ce-9c2a-f011c2ca897f", "comment": "Malware payload (Mirai)", "value": "147234b2afae628b0ef02bf3ee5212e5c8d1d6170de3650c1ad9fa636e0ab37b73fbaca2275aaf116101e12ef5d7387d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152518, "uuid": "56c88a5a-980d-4e77-a0a4-fe91bbb0f4d7", "value": "T1C7C2D1E0B726EA31C4206C3DE52B4D893951063CD1FF393764158D358EC2A9B67E88B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152518, "uuid": "26eb88e1-41b5-4c7c-a1f0-4e22b6f3529e", "value": "768:JMKyhegCCMqfizjoNpd2vJdX6vwrK9q3UELuz:OKy4qfqoeJdXWg/LO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675152518, "uuid": "13b2d30d-29a9-4b07-9e29-b2c47b7be24c", "value": 27300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675152518, "uuid": "2bf834e0-d739-4d8d-8180-e86c01c47ecb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152518, "uuid": "f2c4a5da-18de-4d44-9619-1494f333f998", "value": "1153d6ec340c8f63dfd6f4f8ac0554dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd3e9d2-a1aa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675198998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198998, "uuid": "8b4bdb7c-0d66-4886-9003-4642f8b21597", "comment": "Malware payload", "value": "5f340be7aa8f0d1eac8531f1013021d6", "object_relation": "md5", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198998, "uuid": "edcf5db6-fa99-4622-a7f0-c0228c9c62fb", "comment": "Malware payload", "value": "1931dbb7d8136e1ced29e896a98bc9345162d98f3af86bd0775d1416171072e8", "object_relation": "sha256", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198998, "uuid": "112e799e-7eee-4187-be82-c28346394f27", "comment": "Malware payload", "value": "34c25fa88720c62f48f99a4510cd359785c214f5", "object_relation": "sha1", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198998, "uuid": "0615e671-c7f6-4fbf-89da-2bc669ff2ddb", "comment": "Malware payload", "value": "fc00c9a1ca9d0f86e5914ccb123aad5e528f98daea28142b3e60aff178aad4519494052fbc1bd2e1ea1c658769652b76", "object_relation": "sha3-384", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198998, "uuid": "38391774-c8be-40d4-a44d-5f0912b4a09d", "value": "T1B781CCC38A0F2065C1F7F2F6CA35E6A1125689140AF9E20ED12C7A05BDE1079D6FD2F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198998, "uuid": "b89a7672-47b2-44a6-87ab-ef97300e6434", "value": "96:Cl5xkJLZevpB01M45B7rvAHl1uaL2JZ3KeopG3YxDgglBdN:yX23zMG3YxBdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675198998, "uuid": "be248b8d-1ebb-4d05-ae24-9fd95071e1c6", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675198998, "uuid": "92942539-7fdc-4799-8f2c-721b73ea1bb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198998, "uuid": "19b9c893-7d5e-4bb7-a513-5feb3cb4b67e", "value": "121.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78027efa-a18e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675186878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186878, "uuid": "30c9882e-7e90-4673-9194-53d704b3f80d", "comment": "Malware payload (Mirai)", "value": "3ef9599432ae943c3a3d8b4e9fe715d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186878, "uuid": "a8276d15-1288-4b93-ad45-da9ee94ae390", "comment": "Malware payload (Mirai)", "value": "1967cdb03e86829b29b74b6ccae1b711948873d0133f17807e4fa3a71b8d6184", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186878, "uuid": "55f3bf47-50b6-4f78-9be7-8e7183462c77", "comment": "Malware payload (Mirai)", "value": "5fac4c96c8a626bc4722db718a05d0c5ab142da3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186878, "uuid": "fe30dfbf-6ff0-4ab3-882d-8129c69e2649", "comment": "Malware payload (Mirai)", "value": "30e9b6752fe7de8cee6280d6cb5624bac4e81fa983442ba0d8f671314676b70b854f7cad2e7d92fb68cf8721510c8557", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186878, "uuid": "9a808428-5067-4dd2-8abe-b429b9eb9216", "value": "T1FF733995BC819617C6D112BBFAAF41CC332613E8D2EB3203ED216F21378A95B0E77655", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186878, "uuid": "f570c15a-47c2-4052-8567-bd2cc4a42ffa", "value": "1536:TNe6DCt7iG4fVMUhcmu9t5+wPFeYO5L36jZV7vSdM:Je6Do6fyb+w0YOhM3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675186878, "uuid": "d5ad7731-2b81-474e-9608-0c48cc5bc516", "value": 80600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675186878, "uuid": "d76f5d2b-ec12-4c07-9184-3020295c8964", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186878, "uuid": "7f947e5c-9da3-4bd9-b15d-4adc8f4bb4d9", "value": "3ef9599432ae943c3a3d8b4e9fe715d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60acfb3c-a152-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675161069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161069, "uuid": "6f68a98b-10f2-4a22-af75-f240603f1284", "comment": "Malware payload (GCleaner)", "value": "fc1f06f7a81f6c5612304199f6cfc2f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161069, "uuid": "47e6dbbe-c53b-49a3-ab82-4e56165bbed8", "comment": "Malware payload (GCleaner)", "value": "1979fbf4f765d2764adcd58a3042e8fc7c4fd484f19e8edea2b07e78cca2a2cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161069, "uuid": "da6f8db6-75e3-4f55-b11b-ea92dfa14aa6", "comment": "Malware payload (GCleaner)", "value": "4771f4c93edfde8c7803e32dcf75033b943487dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161069, "uuid": "24861705-cca2-49e1-bea1-c486013c69ee", "comment": "Malware payload (GCleaner)", "value": "8fdf3bde94a4458b6eded49927d18486f6c2c2bc98391e4a5ba209c4c82ed083cd51c0359a2a2a27ce9ac10b3de0df3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161069, "uuid": "ebc77fc2-f71d-48d7-8949-ca4189bfcd70", "value": "T1C5A533966FB5C937E116CB324D70A9056D323F2F24768B76609E478F2767228306F21E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161069, "uuid": "47cc73eb-779d-48ae-b3c0-7c611d4bf41f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161069, "uuid": "3dd8962b-c0dd-4f9c-83c9-02a656d6fb3e", "value": "49152:C2/ldGtKS9NCY1/J7DQnF76sxxlpTCqbJGSjpRJRXhgiLCgv2MR:d/folJhn07zBCqbh1RXjv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675161069, "uuid": "b82e45cb-f286-494e-ba7a-50171bcec37c", "value": 2183553, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675161069, "uuid": "eec21060-e3c1-4272-8e38-5b1d09702c6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161069, "uuid": "da210d39-471e-431b-8deb-673edf982620", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0825c3c0-a15f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675166504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166504, "uuid": "182c505d-16db-4496-a6d5-f0f52ea17488", "comment": "Malware payload (Loki)", "value": "c50d80419e4c55b394596d94c7798940", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166504, "uuid": "9972307e-9f02-41d5-8c5f-3ffc031a8c89", "comment": "Malware payload (Loki)", "value": "1a2a1944e212c814e081a7cdb7f2aaa1146cd544f183ba074f729122bad5a93d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166504, "uuid": "40d5bd31-1f14-47ec-959f-f6c55c1f4a9e", "comment": "Malware payload (Loki)", "value": "4cd5823ed1b1b863beae95321d74d83922d1f882", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166504, "uuid": "101fa080-589c-4459-86f5-c83d0d813df4", "comment": "Malware payload (Loki)", "value": "3b573fe04ba425ee6813e229a7a33107220b5297cd37a06f6be93b79c9f56689e08cde25a17b455f3608b709822ab156", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166504, "uuid": "4b878d1a-a5a0-44be-87af-bd32f23cf538", "value": "T1C3C59D2DBC790E9AD0AB30788153AF41A6174ACC4B15BC072E7EE78D454B44BB6E3397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166504, "uuid": "c8ab30bb-dfac-4757-9745-50b34f7779e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166504, "uuid": "372d9372-cfc0-4111-b4f4-3c6255cb1c77", "value": "24576:aRkc2/UfpKexbm2J1mct8SDVtNOU3qCAbg7T/4Wm8HaB3Cgqd1l3ty6N91f2DTZa:CkcwUfpnF6BSXPtLqH85Wjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675166504, "uuid": "90acaa01-4f13-4706-8880-9cd480073422", "value": 2652672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675166504, "uuid": "5bb89643-fc34-4e20-9784-9c4d6c75babf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166504, "uuid": "64c0edca-ff9f-484d-9576-f592f0af02a7", "value": "Siparisi_(PO22738158)_Naturel Su Ar\u0131tma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb0adad-a143-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675154674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154674, "uuid": "de35d2c2-8424-4c28-b323-bef1d5792837", "comment": "Malware payload (Gozi)", "value": "c419654969c1c15b835888f018fe42a8", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154674, "uuid": "530fb8d3-1209-4fb1-a83b-9cf547d8d7bc", "comment": "Malware payload (Gozi)", "value": "1b3b1ca6973063eb1db5400f7d484da6556d3c2649be87cd7e1c9b0fcf30518f", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154674, "uuid": "3dfc1834-b312-4699-a27d-171d5d94657a", "comment": "Malware payload (Gozi)", "value": "4b42620fbcb2bfdcca26de9d955a58c2159e28b8", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154674, "uuid": "f3dd53bb-43e0-4694-a299-f9b56ebb98e6", "comment": "Malware payload (Gozi)", "value": "5e74095d66f013893b456dd22834bb7cc0539fc9c210b5d1e31da431789cdcc91dcb89a31d8cadcc064f2ae9012578f4", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154674, "uuid": "73a990bd-fdc5-4357-b1d1-070d30861b5c", "value": "T1AC733A19B786D846D6562B3A5CD2C7E97332FC406E97830B3284F77F6EB2690C903646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154674, "uuid": "92f23761-2523-4e26-af1a-d387bb96b1d8", "value": "1536:IElYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm07ViWr41M8YQDokp0UARiyXZdBG:IElYkEIuPm3fNRZmbaoFhZhR0cixIHmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675154674, "uuid": "4acd8c6a-060d-49d7-8a24-5592b87ce043", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675154674, "uuid": "a27a7a4f-6957-4ba5-8b2a-3425a6c2f5de", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154674, "uuid": "29560c2b-21f1-4cf2-aeda-495c5cddb319", "value": "comunicazione.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958a969f-a152-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675161158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161158, "uuid": "0aa562f8-6c52-44c4-84cd-db06351e8352", "comment": "Malware payload (AgentTesla)", "value": "d0998026b3664e29246f446d533e5e7a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161158, "uuid": "b689dac6-15a7-4cfa-9afa-f248b9ea5b60", "comment": "Malware payload (AgentTesla)", "value": "1b5e68835b0da2de07ce67adf6af21002650171e055a54dcc7f4f102433e4868", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161158, "uuid": "60e1b811-fa51-437e-be6c-cc351086180a", "comment": "Malware payload (AgentTesla)", "value": "0cf9c50441a74311e23cb3683ef47095b0d6ae17", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161158, "uuid": "647e00ef-2a85-4ecc-a24e-3daf6d71be33", "comment": "Malware payload (AgentTesla)", "value": "0a0fc5b42b1edc38a4e7700398afd81291d7fbc60247355519cc7a20e3068d2ff367cb4e22a539866d46b73af35fa80c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161158, "uuid": "c6db195f-704b-4b01-ae5a-89e6c471a912", "value": "T111F312D7D51DC439ED7B2AB60C49B26D83A042637946F06FEF653110095BDC27F6A88C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161158, "uuid": "82bff153-41a2-4d9e-b4d0-b0474e979955", "value": "3072:C9U2EUlDfd7i/kpODg4iqEEQtqeMLvgUx4h6KYPomQE2n6VmNIhtzz9G1dz:s1RiLcxqEEWMLoUWMPomQEHINITmN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675161158, "uuid": "7352f416-1a39-48ad-a12a-188246b5a9cf", "value": 169799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675161158, "uuid": "3844d498-b311-416c-8acb-2c117c846e92", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161158, "uuid": "51c4b97c-ebca-4aa9-8957-2d5057fa3341", "value": "ORPO-INVOCE0987.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "935929d9-a189-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675184777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675184777, "uuid": "1438f03e-8b36-4b3e-9a5b-7f6129d42127", "comment": "Malware payload", "value": "ab5f556f96d8899eb5f77be82419107f", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675184777, "uuid": "053a97e5-56bb-4fc2-b804-8a6cc1342eed", "comment": "Malware payload", "value": "1e2ec32a10710dd484a69caa60bdacc87a3ab932e6a0316a799646a8d0517eff", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675184777, "uuid": "ebc28151-4905-481c-931d-b81b087263aa", "comment": "Malware payload", "value": "65c9f27bee36e773a7db8a4ee4f5d77c126e570a", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675184777, "uuid": "8adbf2cb-58f1-428a-9f55-af5611783b78", "comment": "Malware payload", "value": "475e82695ab21d0606383b3deeb45a49a3850e8f24c15eb39be289a07468cbf6c9a8bda09766ca8d8701df94111eb909", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675184777, "uuid": "56688f27-e12f-4f1c-b074-8d9215b07f96", "value": "T1FE73D9D47AE96CDAEE25923C41EBD232753DF8D042534F1BA234E6321E13ED07AD9642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675184777, "uuid": "85ddb49e-55e3-47b3-be7b-8732a5f84628", "value": "8834c2b2bf8681f0c1fc93480ab35ab3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675184777, "uuid": "968ce054-7bb2-43c8-a39c-57b0e79042b5", "value": "1536:1GfKhE0XUKlOZ9p+Ut3hGy3Nr8dGAaUDBMQ:kChEuUKlOZTxt3hGwry/DBR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675184777, "uuid": "c366ca34-4975-4ff2-b6cf-209ca64c85b2", "value": 77277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675184777, "uuid": "57c5dd05-0aab-4870-bbcf-4ae976c48429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675184777, "uuid": "a2bb7845-83b4-450f-a113-26271363c5db", "value": "BankStatement-1675184346.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61de5b84-a146-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675155918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155918, "uuid": "3f3f5a1c-1062-4339-84d1-3547670184c6", "comment": "Malware payload (SnakeKeylogger)", "value": "f70cb7c1a7b8ab30afcc8cb1b5f8b449", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155918, "uuid": "4b010585-97f3-4d66-8ed8-4d9fc7d22bca", "comment": "Malware payload (SnakeKeylogger)", "value": "1f4266192080bd75e3d6553b92693a02cdd10d3d5fd6945f1995f5563d57095b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155918, "uuid": "1f87fef9-e0af-4624-8c54-bc222f07573c", "comment": "Malware payload (SnakeKeylogger)", "value": "f8f6522dbbb807beef7259d4ff6607d2374a6df7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155918, "uuid": "3382aa83-8d5d-4dd8-b49a-567eefe48d83", "comment": "Malware payload (SnakeKeylogger)", "value": "c39c3bc68882247aff23528289631f7604bd045921ae27a9a37d10ed3cc9a974e3d2969c79cbbe61fbdbf02721faed5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155918, "uuid": "056d241b-2617-4dac-b154-fb9abb8acca3", "value": "T11EE4025D13788FE7CA6983F921F410192F302666B093E7481EDAA8D5CD573F08E27A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155918, "uuid": "0050ba34-5e90-488a-af91-d6b8784fdb46", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155918, "uuid": "b025e5d2-7fe6-48d3-9b7d-aa1c1ec9a192", "value": "12288:o1QoYjKxuxcdl3rW8EAadHoFwWRv5+8qKBAFd2s9zLWeh3ih9HGA:o+oYQuqdl3rWF6pI8qKAn9zLBYTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675155918, "uuid": "66f83618-5c67-43d3-9799-fa2d8c30cc67", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675155918, "uuid": "06f49231-a745-40db-862f-6c76073bc14e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155918, "uuid": "185fd708-81ba-4635-ad51-d3710af550ab", "value": "f70cb7c1a7b8ab30afcc8cb1b5f8b449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c73a4036-a149-11ed-88f6-42010a9c006e", "comment": "Malware payload (FormBook)", "timestamp": 1675157376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157376, "uuid": "4b4cc3ae-13ea-43b4-8ffc-3514d5fb7d3c", "comment": "Malware payload (FormBook)", "value": "bd207070755945e1b3aa5a0c4bfd0396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157376, "uuid": "8c3b0322-9cb2-4a1a-aa30-04a83e42ecdd", "comment": "Malware payload (FormBook)", "value": "20627fe2c7f7c1994e865d2e843cf056daabeb6eb1f2aeab2868a9d51dd03730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157376, "uuid": "8ded83f4-13e3-4606-a37f-73bb8a76fc08", "comment": "Malware payload (FormBook)", "value": "e3c572e25daddeafa12da0290ca56d12e39aaa89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157376, "uuid": "6f12368c-2721-488b-b4a8-e2459ac3787a", "comment": "Malware payload (FormBook)", "value": "451f8e106bed0d7983dfe4b458533efb4dea562749f5a2e486f13ecb6aa2dda734e9abab025b86a1d9713b558df15fce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157376, "uuid": "caa1f0d3-26c9-46a7-88d8-ffec86225984", "value": "T18054128072B0C4F3E8D2AAB14A389617B7CFDDA54878958F2314374B3DB7053992E366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157376, "uuid": "de1bee55-6354-4f09-9dc9-853a98c57a6e", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157376, "uuid": "10e5de04-a221-4e71-afbd-d6abff1c9ae0", "value": "6144:3Ya6xM+yxvDXgeOlfNF5/sOxR56Qcs5/p/qnmAg2gEr4AN1rZLzsp:3YU+ylDXLgfNF53qQca6mt23rHZLzi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675157376, "uuid": "ad2c9c8b-c0b7-433e-bf61-5eb11ed4c595", "value": 305118, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675157376, "uuid": "779fe721-7c1a-4e26-9885-786d3ba41e43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157376, "uuid": "346e5801-18b6-46ad-93a6-65ea1bd59a6d", "value": "Paperwork.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b65705-a142-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675154391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154391, "uuid": "26ffcafe-cad7-42de-8e3f-137a1d48d190", "comment": "Malware payload", "value": "f7261815577e1b89df42a81484361d3a", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "senseofswitzerland-ch", "colour": "#B73529", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154391, "uuid": "bfa57796-fa36-4063-b77c-2f1e0a2e0d99", "comment": "Malware payload", "value": "20e43c8a1b887fe250b3c29dea34fb449fd8a209dc625a264b385f8a00a78c04", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "senseofswitzerland-ch", "colour": "#B73529", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154391, "uuid": "9dede25a-75db-402a-8215-606ce2bd377b", "comment": "Malware payload", "value": "9763d45fff30d689a9805582e0c9a7391b708068", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "senseofswitzerland-ch", "colour": "#B73529", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154391, "uuid": "4039c7a6-0d5a-4d32-85a2-b9aa2b176aaa", "comment": "Malware payload", "value": "3fe254f64bacdc796b02b91b0efeb85df6cb539bd129630286dfb95060d57f40d3d74d718e4c709895123580dc7122e2", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "senseofswitzerland-ch", "colour": "#B73529", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154391, "uuid": "b04d1523-6a6c-4fcf-b3bb-fa49525b19fa", "value": "T10401207194BCA0C2C203B26294CB8600C179078382D5BD027930D821F5DE97485F88F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154391, "uuid": "1c7b6128-04a3-4993-b961-0bab4669bbe0", "value": "12:IXjjInAU5o1nA0Wqf6Fe+MJMd55n2im4YJg5uamApxDu9ixjjkOWQ/cOFdAsI9Ga:0Wlo1nA0WO6FrNIyIaTDuQjjipOFdAZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675154391, "uuid": "fc431181-6512-4ef2-8b26-67a3ea05c40b", "value": 723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675154391, "uuid": "b9b22e29-f009-4558-9918-875ef4c4c2af", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154391, "uuid": "5d0d7627-0648-4c5a-ac9c-478b92d9f97e", "value": "ps1.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc8c182-a110-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675132824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675132824, "uuid": "03fad3c9-6c62-47f3-9641-33baa9cc17b5", "comment": "Malware payload (RemcosRAT)", "value": "8a9cf57ec88016f4de736ae0fe44bf44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675132824, "uuid": "1bedcde8-b151-4762-97be-3256839c3cb1", "comment": "Malware payload (RemcosRAT)", "value": "217a39234802caa4d7cce0bfae3880db5c6b5c3004fddcd0b31298b586f54de5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675132824, "uuid": "384d4920-151a-43d9-8550-e166c03a6792", "comment": "Malware payload (RemcosRAT)", "value": "f59153b3a02513439531c2a2e79000e2167a794c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675132824, "uuid": "83885f5f-d7fc-44cb-b4a4-914790eaaed4", "comment": "Malware payload (RemcosRAT)", "value": "af105f091695a330ed14bc37ba46f5619ed604a60e415103c94427d18005f9caa867a42a12e23a35e92e2b3125a123dd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675132824, "uuid": "902fe5f3-8dd2-42dc-99e8-957009b4403a", "value": "T150252386C328CDEADB55027A21B46498DF312F8AF571DB0C25DB6219C8CB3131D676EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675132824, "uuid": "f1ab21d1-526d-4b7a-8847-9c8eef54d677", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675132824, "uuid": "23759384-e8d3-4dfa-946a-269d71f3d0f1", "value": "12288:XbDZ8BcZvufkY5C8B87dnhY3Q3ig3lJ7jW2H7M+P3lx3UKHHkqwY9mUBfzLquCz5:XfZ8B0Eutv1/HQKPEjh/UB4zBYTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675132824, "uuid": "ae525322-0fef-40fa-bd09-fa1892855d03", "value": 979968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675132824, "uuid": "236322af-a66c-4a27-93ff-86c800103b09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675132824, "uuid": "73908a70-d5f0-45cc-b16e-c5789253d510", "value": "8a9cf57ec88016f4de736ae0fe44bf44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba87ca54-a17c-11ed-88f6-42010a9c006e", "comment": "Malware payload (BumbleBee)", "timestamp": 1675179259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179259, "uuid": "d386e497-7692-463e-80d7-a63d790b2a22", "comment": "Malware payload (BumbleBee)", "value": "a6eb5da8a7d233b137c7214ad7704d80", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179259, "uuid": "034072a3-bb8c-4b38-94e4-a29be7bde10a", "comment": "Malware payload (BumbleBee)", "value": "220643466b3b056319813f6a504726baf236e866d32dace4290bab262f8f455f", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179259, "uuid": "0a02dbc5-8b19-4987-b5cd-6ca9ff0ed415", "comment": "Malware payload (BumbleBee)", "value": "bdc3992db4b6f346eb42df7ae8991ba26c4b528a", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179259, "uuid": "f1003c75-291b-4c49-93d2-6093bc8853b0", "comment": "Malware payload (BumbleBee)", "value": "c21ac4ae2b94cd0c3e470966f207378ae7aed3eac3f2550d1e1cc83d0cea480a79829850f426c7c94aa1d5d5c35399e0", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179259, "uuid": "390124ba-1f57-48b3-b3f7-83d3cd7eb0f3", "value": "T17CB50B342EEA502A7173FF6D8AE475DADA5FBBA33703585D10A2038A0723942EDD153D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179259, "uuid": "aad81d1a-79c2-434e-9780-34e0b107dab4", "value": "24576:dWbYatYxIQarFTuO/GeO+QgfAIAdQ3z/PEMfm96mwo4hWwVEqXrxwVe1pHCRGW6H:80AYsdyQDHEKxo/wVZ9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675179259, "uuid": "8ace1160-0915-4b2c-bc01-78520b2eec68", "value": 2355258, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675179259, "uuid": "b9116958-e157-49a5-be2b-11b81fd1cfaa", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179259, "uuid": "e3df6147-fb91-4625-b542-fd7808fb7a65", "value": "lg30.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708b5cff-a194-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675189443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675189443, "uuid": "8504f491-eeb0-4e45-8ab5-8b490b4db9a3", "comment": "Malware payload", "value": "6b55b7766f601d41ccc3b93b4d2e78e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675189443, "uuid": "9d49b240-97ac-4505-976b-5213cebe14e5", "comment": "Malware payload", "value": "223c2ac2b2221f9f02b5fe66f8cc52bd3b24c8026d3c0b02ec97c57604e9d606", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675189443, "uuid": "25f98730-5c8b-4135-be52-444f5e93e670", "comment": "Malware payload", "value": "58e52a9183d6236e5fd96c15ba082535c19bd062", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675189443, "uuid": "9460f48d-e8bd-4b07-9541-043f9812896e", "comment": "Malware payload", "value": "e8c743b29f521671b14ed7a01eef59ab844aa83a2c74cabebd570b9b37f5550e39fa7e19a24f92794f5abf2082a18aaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675189443, "uuid": "12db837b-983b-484d-9eaf-07ddf47ea9b5", "value": "T122549FE2B2F17C62E92687729E1FC6F8751EB9534E187366120B9BDF25B01A1C5E3301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675189443, "uuid": "509dcd70-91a2-4dd6-83aa-6e3065cd203c", "value": "9c039baca0968dd2f90042d865dd6c2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675189443, "uuid": "e98630a9-4248-43fc-8511-d3d5a68248ec", "value": "3072:CruIcoLr/RAgDbwA7vOiDRJxiLtyUHE28WEBmqPUx6WfQz86OCd3MMo:JIcoLr2gDSyRJx9KJ8WEBmqMoIE8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675189443, "uuid": "548bf07d-a59b-4dcc-9e5c-0fec313d8590", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675189443, "uuid": "5738b361-4b64-4c13-bbc2-8b50c919161a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675189443, "uuid": "d95ab853-3490-463b-ba5d-fd37bddb3155", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9906c60-a152-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675161299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161299, "uuid": "18b2c804-9cb5-4149-93f0-3e33d693f7f3", "comment": "Malware payload", "value": "7c6a84007e637a62e64bd342dc34e375", "object_relation": "md5", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161299, "uuid": "36437525-41c2-4ece-87c7-18ba1a7eae5b", "comment": "Malware payload", "value": "229d1cc3c61cb8f23b8aa1d08dacd186d85cdb4d78a02948f5cc867c8e43f49e", "object_relation": "sha256", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161299, "uuid": "c45ce5c1-0ed2-495e-91c2-430878864af5", "comment": "Malware payload", "value": "1c40cc5266451ca7253a9d9d8ef79d37a63d0470", "object_relation": "sha1", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161299, "uuid": "60fcc1fc-ebd5-46e6-8db9-64db496dc8bf", "comment": "Malware payload", "value": "8f1a57591381144b74b7353f170fbb411b6fdd04e10190948360176228daa1bae745dff0123a695eb24bc4726b1aa2ac", "object_relation": "sha3-384", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161299, "uuid": "cbd74245-cee2-4e2c-9fa5-ded38a52f1c0", "value": "T1F1B423AB1FAA8871AC879378F56336CD924D3A243CD5CD342B50A7D2D4CB9413ACB5D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161299, "uuid": "f615f92a-eb26-4c1b-81a8-7458db343f0e", "value": "12288:LJLsA9fk0ihLGNeJDK2jwoICSCw6kmbAC+FXgQ:b9fk0ihLOeNK8woRS56kmMPFX5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675161299, "uuid": "5b11f60e-f0a5-4332-9ce0-7e4ac5c89817", "value": 528677, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675161299, "uuid": "bf61fe09-8df7-4d9b-a646-7a891793e98e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161299, "uuid": "4aa575b9-1f92-47ee-a933-e156d894581f", "value": "DOCS.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c126d1-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140596, "uuid": "104d612f-bb65-4fb7-a165-b28ee5f29736", "comment": "Malware payload", "value": "eba00bb5ec3c35a4d68709f8914270ba", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140596, "uuid": "1df4d748-798e-4036-aa9e-d6aa009b836d", "comment": "Malware payload", "value": "248b3297c1630d151c079cb4c44995908e83c39f0a5574fb3bb3838a4557d831", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140596, "uuid": "d8a22d12-fff5-4b98-b5bf-08f79b5e3386", "comment": "Malware payload", "value": "b98aa1c9939457c3ae85e79d30e51c2f7daa5901", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140596, "uuid": "3d4ff8dd-c832-4201-bba4-f49eb9b40e3f", "comment": "Malware payload", "value": "412d2ef5131fb37735555d9dc7a1fdafed7edf99d8b67bb58353b64abe9b26298492cca7692c3adda0e7b77c9f803e1c", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140596, "uuid": "c795245e-61a6-46d3-8c3b-50f0a7f100f2", "value": "T161363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140596, "uuid": "d2d4d231-7f54-4f2c-8295-2ff1cf757dd0", "value": "98304:Ov4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXy:OvpvFa+g8RWLdPk/84tCEr0RtNiC5eSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140596, "uuid": "1eba2629-c6b4-4790-b5c3-efa22fd6e16e", "value": 4992000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140596, "uuid": "a1cf7654-6851-43b1-8274-0be03e5abe68", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140596, "uuid": "7fb91881-b5c4-4373-92b2-1865f5ac5038", "value": "248b3297c1630d151c079cb4c44995908e83c39f0a5574fb3bb3838a4557d831", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "231b3c90-a174-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675175569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675175569, "uuid": "59118575-2ec7-48be-8e7c-853bf0f74451", "comment": "Malware payload (GCleaner)", "value": "8cdbeda5db54cacbc0b67a37a1ab818a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675175569, "uuid": "973e3fae-b724-4c59-86ef-355c4bcccd35", "comment": "Malware payload (GCleaner)", "value": "252d7fa000c30fa97321bd840be43ecb2600b70462041fc5ad79a5f558734e21", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675175569, "uuid": "7322b9db-0539-403e-b8a6-d32fa38f5ef7", "comment": "Malware payload (GCleaner)", "value": "91f32aedb9d0da58ea61dc7445e49f557056ce62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675175569, "uuid": "e387023b-345d-4f3c-96cf-e8c4b2961fc0", "comment": "Malware payload (GCleaner)", "value": "9fbbfce74fb446f976274fed39c4e32194b62922b3b4196227239d4837b209d9996c358bd5453db13a714b4a9235dddb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675175569, "uuid": "02c2992e-85ea-4557-a43c-14c0e261435d", "value": "T1FBA5334E606B4076EEA21B7666552181FB9FFF583130631AB16D324E9EEF3A41010FDE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675175569, "uuid": "3b02035d-3463-4c40-83f1-a5f70a860f0c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675175569, "uuid": "17ca6acc-0a44-4a98-ae85-6b3f2acb2df0", "value": "49152:C2OYvioNk4IM78844H26UGFCeUEeXl1VJ/HCkI0KIsrJLCgv2MR:dO74IM75H2hK3UdVfJv3Izllv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675175569, "uuid": "3f75c7dc-a9ed-4e71-a57d-bbb726ec1527", "value": 2203019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675175569, "uuid": "55a2f65e-241b-4297-a940-cdbfb8851649", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675175569, "uuid": "5a990e07-29ae-471a-8963-970d6300fa85", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8accbba-a172-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675175042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675175042, "uuid": "162bc7e4-c4d7-484b-8f20-05c7c0f903b4", "comment": "Malware payload (Smoke Loader)", "value": "d2a58de5f2c35dd8beb458e7f7c7610b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675175042, "uuid": "c4704665-975f-4f34-a78c-8373e656606e", "comment": "Malware payload (Smoke Loader)", "value": "25d59bcfadd6ff8fbac504a21570cf6908bb4ace333afad8f854895d869fcb2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675175042, "uuid": "9dd46129-9ff4-4a2f-9cde-b0b2cbc4eb92", "comment": "Malware payload (Smoke Loader)", "value": "2fed996e8fd166ea9d43ca7855e3766dffe88ddf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675175042, "uuid": "a60c3005-4d61-454c-9002-4415e8d716fd", "comment": "Malware payload (Smoke Loader)", "value": "264e62661756eaa26466957db897700c22e546c6d0e9b1836224a9bc7885009a99a9b3e61355ce81d62b4191abfbb1e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675175042, "uuid": "f99c210d-12b1-47a9-9e79-91b71426a7c9", "value": "T12A548EC2B2B27C62E9228A719F1EC6F4761EF5424E197366121B9BDF26B01F1D1E3350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675175042, "uuid": "faf2f028-e372-446f-9848-0789cb778f08", "value": "e73db8d7bd9f9f6b2076d026a8fb8fc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675175042, "uuid": "437cc186-bffb-4bf7-9adc-ab7f101a5cbb", "value": "6144:Zmt2LzRHJbSyDvc1rp/ajVamqMoIp8Mu:wcvz+yDvc1F/OVlqMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675175042, "uuid": "99cc8030-b733-49fc-8271-a73f68d27a61", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675175042, "uuid": "db355aaf-19d3-4b36-8fbf-563828f5b3b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675175042, "uuid": "3e505dbb-baff-4cb1-979e-a6760a017fec", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77c99832-a146-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675155954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155954, "uuid": "6afc979f-2082-4729-8062-e288b8d3aa83", "comment": "Malware payload (Mirai)", "value": "ce83cfb9cdddd75ad38bd1d269d4acd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155954, "uuid": "1bb43053-0349-4d84-8f60-9a9f9acdd0f5", "comment": "Malware payload (Mirai)", "value": "26e8a59950019613f7055036c998934a403e8fb47f38c518393f1e0c2cb315e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155954, "uuid": "7371f53f-1c5e-495e-9cc7-e01eba6611b5", "comment": "Malware payload (Mirai)", "value": "76c2e202888f068720a0b8aecdae28370b1ff0da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155954, "uuid": "22e8b9b4-60fe-4653-b241-d8fbf2cbfd7a", "comment": "Malware payload (Mirai)", "value": "a75efd3b60c517997ef08f88d5ae17c3a4c298bab3e30e4a44e8cca9a0fa5680e182424b0d41a8b5a25afc656508a949", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155954, "uuid": "f2c51eef-98c2-4168-a3d6-d3753aa1740f", "value": "T10553E861BC825A2AC5E0537AB9AE568E332073E9D2CF3227CC201B547BD551F0DA7F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155954, "uuid": "6218d014-c361-4baf-84b3-448010309d9d", "value": "1536:UGpLnLCA9SWalfZacDeLtfTRd4S0jtHg6ZUoh+AV7YYY:NnLNW+x8E6ZNhvub", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675155954, "uuid": "d91ea4e5-8f7d-4905-bb0b-6ebeee42ab9d", "value": 61528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675155954, "uuid": "802d594d-9724-45d2-870a-dbfd0b925ae6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155954, "uuid": "55d1a108-eb7b-4bbf-abaa-7762bb5e4eb3", "value": "ce83cfb9cdddd75ad38bd1d269d4acd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd8355c-a1ad-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675200176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675200176, "uuid": "7b992885-aed1-4975-a9c3-a8fdea1bb34a", "comment": "Malware payload", "value": "049b7a8f84d8c8e7932bfc6e97362c30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675200176, "uuid": "c262a4e9-47e0-49bd-9924-094410cd98c2", "comment": "Malware payload", "value": "2716cfd0d3479d42e903bd0c835b91fd5918a02fb63bdc1b52f73921bf4b307a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675200176, "uuid": "b07c7fa2-e663-4f54-9cd1-6da7771a1ce6", "comment": "Malware payload", "value": "f3d85b5214062a92ecacd0a65e02593e44ab188a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675200176, "uuid": "848c9d49-2b70-404c-8054-db8b01b841ba", "comment": "Malware payload", "value": "ba868f16cc3f7b4fa59e0d25e2ede388599990f79abbf1da2b976569ff9a483cbe6a536a6b70768b1d829bc78380269d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675200176, "uuid": "e54f6618-aa2a-4641-aa54-16f36a7be39d", "value": "T1A375F1074AA8570EE82EB376D4914643F768F4DD942AE36F56901FEC1D733829B2037A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675200176, "uuid": "c1bc139a-9d16-4555-977b-f74b42d8c1aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675200176, "uuid": "5a95bfd4-33aa-43c0-ae52-f1031b719d5e", "value": "24576:bYO8wJFOtz7uuqEP+1MoIpgpgi2esTTPfQHSvMYdihbjct3sP8ZS3pdWMhLaw:koqAI4sTTP4smZ58wl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675200176, "uuid": "b9789a3b-7100-42fd-bbc0-eca148ab12cc", "value": 1652224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675200176, "uuid": "5cccde37-c077-4613-bf8f-5726391adb2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675200176, "uuid": "6ec899f4-f21d-489d-a884-30a46e1c108b", "value": "GxMBK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca206513-a179-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675177997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177997, "uuid": "407d4046-033b-43fd-abe7-71fea9970738", "comment": "Malware payload", "value": "45fcca0f4cc1250a1ed06fdd0a35c566", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177997, "uuid": "ed7e3107-0c95-4300-9c4c-9dd104c32ba5", "comment": "Malware payload", "value": "285febf3df0193ab2f228a5d50152d40ae1f958a49b6a00a58b1390b62240c20", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177997, "uuid": "51ba6e9e-1c7b-442a-b8cf-30ca1c7f77a1", "comment": "Malware payload", "value": "81d8879343caa21bf4d48101b65fb8a9ac0c5bb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177997, "uuid": "943576f9-8633-400c-b045-6c69f4fef59d", "comment": "Malware payload", "value": "f7bfe62b4ee1bbdebe39c0edb87694c5c5070d677f6ce485cc7de5a77fc0b6be3d800c5529ed174e714306c255578d5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177997, "uuid": "e0ec2629-ee34-4cc3-9741-9ec64b8c9bec", "value": "T1F4456C407BE8EA27D15E5772F4A241244BF0D806B753FB4F26A8A5AD1C53740BC892FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177997, "uuid": "d0e46ef5-9564-4c99-966a-f9663fa9245a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177997, "uuid": "1185dfd5-8a9d-4044-9410-e95beceb748e", "value": "24576:RPyMNgDvgqz27bovjgUpf7yJ1rga/v7f3suwB:RPyYqke7Srf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675177997, "uuid": "f4a05063-3a86-47ff-a36a-ebe087dcc05e", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675177997, "uuid": "e0ab1540-eaa3-4114-abb5-0522f4e10f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177997, "uuid": "1e77e068-21d7-45d0-82e2-f548d65b8537", "value": "285febf3df0193ab2f228a5d50152d40ae1f958a49b6a00a58b1390b62240c20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f804b698-a152-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675161323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161323, "uuid": "4598e1b3-92b3-4763-b566-9e120932d829", "comment": "Malware payload (njrat)", "value": "bd5406135db5d453824f96005dcb69f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161323, "uuid": "8c5d5fe5-3068-4d45-88be-ecaa2048c8d7", "comment": "Malware payload (njrat)", "value": "28f51ae44cf7b1faf2e5350e24e9596672b99df9a8dc0d4dcf279dcbe0eaf121", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161323, "uuid": "349857df-d6c3-45ae-a36d-65d77551a5d6", "comment": "Malware payload (njrat)", "value": "cb81dc2dfe832dbf9088a15e7bf751488838ee15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161323, "uuid": "209b2698-691b-47f7-8eee-88f03fad361a", "comment": "Malware payload (njrat)", "value": "2c2a134ab9573206535450d27986ff31da60bbf634bf850a340c0a1e6a17092e03e084549480b20f70d2724799b38f9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161323, "uuid": "68fb3388-2f47-4891-9b1c-d9f85da0c6f7", "value": "T106834A01BBD99A76D2BC4B3468B249550AB0BD13EA32DB1F49D178DF97327C18C40FA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161323, "uuid": "067cea89-10ef-4007-8bf3-128e07019ad3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161323, "uuid": "2d371561-2423-4e3d-a717-7fd40a2a0c01", "value": "1536:bMv4Dnpe/NoTcwiDESPDywsNMDzXExI3pm9mrALpeOlwT:c4Dn8ymDRPDywsNMDzXExI3pmrpDlwT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675161323, "uuid": "539a4a73-971e-48c7-beb1-23a6b407c273", "value": 81920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675161323, "uuid": "5695bf29-ba16-43b9-ae04-7391d2602b36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161323, "uuid": "a723cdcc-073e-4255-8dbc-b9812ca8f1e8", "value": "bd5406135db5d453824f96005dcb69f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d01860c-a113-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675133898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675133898, "uuid": "5b71715a-5b63-4940-8b23-f13c85bf20da", "comment": "Malware payload (Smoke Loader)", "value": "c575a949091590f5335fabb520038285", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675133898, "uuid": "6cf2dd75-723e-45fb-a0d2-febce6dab6e5", "comment": "Malware payload (Smoke Loader)", "value": "28fde10773e0fc673c49c3748641e491658e87b06d3982573038502f4f3d6421", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675133898, "uuid": "005b5097-6de0-428b-95e1-a28644e1ea8d", "comment": "Malware payload (Smoke Loader)", "value": "ac53a05669b5131657d63eb0db7ae6934775fec8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675133898, "uuid": "05b47817-736c-4832-a855-c8cea0ab1b31", "comment": "Malware payload (Smoke Loader)", "value": "33c37a2a7e2e6695ec7731230d4bc31774a42fbefac39fbe7138db7dd6497a5fc91d2a555df066e3fcf0924a8600fee9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675133898, "uuid": "95eafaa3-a930-4b77-a1aa-c40ba684871e", "value": "T17AF3E125B590E033C01684741938C6D5AF3EBD321A76E947BB492BED1F722D1AB2E317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675133898, "uuid": "8d431752-c48c-41b2-898b-b2d78795ecdd", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675133898, "uuid": "af85e6dd-628d-4364-be9f-94fe8cd2ed6a", "value": "3072:MjtRXyLNfo+sU5FxAAJ0CAMt1qeLmY8EfSTGsF/0yr:vLdo+sqxDJt1rzkvF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675133898, "uuid": "f55f01e9-cd36-4198-bc04-4b2557f735eb", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675133898, "uuid": "5a102dee-d9d8-4ed1-8eb2-e42d7855bd27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675133898, "uuid": "bc50c57e-d305-4c52-a7ea-e93da8c47084", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "213f75a7-a1b9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675205201, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675205201, "uuid": "b6c43ede-25ce-47ef-aef2-901070404acf", "comment": "Malware payload", "value": "8e46c1d71c51e7ac5cf48c39be097cf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675205201, "uuid": "bf44b77c-8f2a-467a-8742-9e56dc87736b", "comment": "Malware payload", "value": "2a08fb8f9376bc15b30c4d1f5b645d814cc6f09fffe7a40d6aed5fd044f6a1cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675205201, "uuid": "958619ca-9cc9-4a15-ad6b-3e2a71598385", "comment": "Malware payload", "value": "e9ec1946cd0a09694e06e43aba25c1fbd25f73b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675205201, "uuid": "bcce678a-ebfd-4ea7-8fc3-d213f428ff42", "comment": "Malware payload", "value": "43eba54fbbc26ebcfff2afa377fb60c91466a3a5a769fd9c8b4f42fa6d912eb46f3a97207790f0b3cbcb2a3753af6401", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675205201, "uuid": "c8d7a2ae-c059-47dd-b069-5edb51f9932e", "value": "T19BA5339A68614239C145DBBA6D709180FDABB3B1666CF13437CEB18F3F3FA527805129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675205201, "uuid": "2bea9caf-bfad-4f63-a528-bd6c39f1d6e7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675205201, "uuid": "433dd52d-1a94-43a4-b255-93f1349a7077", "value": "49152:C23sTDE5cJvBscOfISuRPi/Y+B7L7o3Goo2vX5g9W0+9EweZsx4LCgv2MR:dmG2CTfgWBbFEI4XeZsiv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675205201, "uuid": "f003b3e9-342a-4c53-b7b5-60638fe3f175", "value": 2204781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675205201, "uuid": "527181b7-29f9-4f46-9629-287fd9a8f241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675205201, "uuid": "8f0d2317-a947-430c-91a6-cdd760262a9e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd52242-a17b-11ed-88f6-42010a9c006e", "comment": "Malware payload (VectorStealer)", "timestamp": 1675178592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178592, "uuid": "ffaeb16e-7bb4-4907-9a9f-6a7b736aa2b9", "comment": "Malware payload (VectorStealer)", "value": "095483794408fd8f2479ace6c73cabe7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178592, "uuid": "c027433a-1a08-4e88-bfdc-75b9c0afeab5", "comment": "Malware payload (VectorStealer)", "value": "2a6cf187bcb946e0c4834517ce0b969cbd75aa413cd5925f550984b9e660b866", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178592, "uuid": "133584e4-d515-40f8-9d0a-210828bf6826", "comment": "Malware payload (VectorStealer)", "value": "b38868eff8933d60043ed58d0994deb049795436", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178592, "uuid": "554f878a-a8bb-48dc-9081-127d8af7a612", "comment": "Malware payload (VectorStealer)", "value": "050020e30e2a2ea1afb0a4db62d56fd80afa4156cdb44224cfe7bbcf3eb5f27e6cd8be0f25facd217cb23ad544f223f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178592, "uuid": "61c97947-e74b-4d4b-8740-f82fc284c294", "value": "T14C25331DDAE4C04FE2B16DB19FBAC16A6AE6D83D2230954A27D0AF4E3177381C80D757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178592, "uuid": "ed7d2846-c208-45bf-87bf-09f73f9220e8", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178592, "uuid": "7836f800-b57e-477e-a372-6fede8a70330", "value": "24576:/Y9UJRSwF02rg71YIWmZ20/5obbJ1SnVQtJ:AvQM7+3E2J1SnVa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675178592, "uuid": "bf21759a-97b6-498d-9030-3a11aac53590", "value": 976330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675178592, "uuid": "7b7ce20d-f504-4582-846c-8e4fa4a17700", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178592, "uuid": "b6c793c6-57e2-4430-9160-2a083dd163d3", "value": "PDA Query - 180397-31-01-23 Port Agency Appointment_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9332525-a142-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675154427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154427, "uuid": "a6ecba7b-4ff1-4b92-9c29-08bb6449df34", "comment": "Malware payload (njrat)", "value": "abef5960fcda8c82d1fdbb291e7a9012", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154427, "uuid": "f6347d23-9b34-4d47-b4a9-3647972e327b", "comment": "Malware payload (njrat)", "value": "2ab90c3a95b4caa67473c8ac945ce0b69ae3b7d5778bd431214900812ab6fb3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154427, "uuid": "e6b88c7d-7992-42d9-b5c8-200a26f0ace5", "comment": "Malware payload (njrat)", "value": "84e03cd48d7fec40753fc1226c88013f39bedcc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154427, "uuid": "15edba7d-bc08-46d6-ad40-ac05d840c21c", "comment": "Malware payload (njrat)", "value": "ba0975b9b433bbe0519f1971fedf0afb3293f221781282660141d2b33eee6d1c4902a362ba533fcb35071b29a9b9f797", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154427, "uuid": "97f4ff9c-76cf-4b5d-a1fa-1e69036c46d5", "value": "T1EFA4BF066F566E1BD99D67340EE0F3BD12609EC2B722DA264CF49DFF7625B851C80AC0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154427, "uuid": "d4626e1f-84cc-4fb6-abbe-1aba9288ef2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154427, "uuid": "39ec7245-288e-401e-b99e-8b77942cabe5", "value": "12288:u/N73EBM32LTQ9/hFou9SoUEZkmNlYX07i:u/N463oKrou/vZkmv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675154427, "uuid": "3f64fb9b-2d89-415e-911b-919b55e620db", "value": 483328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675154427, "uuid": "c4ec67aa-11ca-4753-96d6-ea2af1f2c4f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154427, "uuid": "ad50adc6-a1da-480f-bf19-10bfe2a2b537", "value": "abef5960fcda8c82d1fdbb291e7a9012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ba3492-a111-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675133114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675133114, "uuid": "2f044da8-17f0-4768-bc91-ce9f79a9ec9c", "comment": "Malware payload (GCleaner)", "value": "ee17820bedd008af4b32ba60ec013cc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675133114, "uuid": "1769b2f8-e9df-4f96-a318-56baf70d8fbc", "comment": "Malware payload (GCleaner)", "value": "2b873624bc029cd218760e5b17d1c334c942168472994cbaa92f735bd75180b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675133114, "uuid": "622d785d-265f-46ef-a658-f75d78fc3d77", "comment": "Malware payload (GCleaner)", "value": "385a06d1cc95e387525f7670d6a7eb906d037051", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675133114, "uuid": "a71e63f2-6e95-44cb-bcf6-a7eaa16b523c", "comment": "Malware payload (GCleaner)", "value": "6f725abc4e658ce486cea853a35e5e61844d15fc244a418347a8d77d9c0c1bf0578c3e8f7c3d833df687b93d89aea068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675133114, "uuid": "58084772-27e2-43af-b4bd-908d50580e15", "value": "T116A5331B8111D87AC4D6E7B0DC1480844E7B7F82333C5A16355FB2CFAE6A7B05A969F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675133114, "uuid": "b4400853-2db8-42b6-b078-e3bbcaf78485", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675133114, "uuid": "27ea9895-7d80-47ee-a316-de3fcd35a947", "value": "49152:2cf5q8j9JSCzOF3E6otpXfZxmBuWSrEs2iqyd5LCgv2MR:DfQ8jvSCqF31o3fZQulsynv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675133114, "uuid": "249a67a0-e948-406b-8574-5964bdef56b0", "value": 2218016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675133114, "uuid": "336a9a9d-09b1-4010-b44e-bf2df0eb8b1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675133114, "uuid": "7cc1831d-7df4-459b-95cb-1315a365015c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0763463b-a136-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675148894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148894, "uuid": "930882f1-f2ed-4a12-aca4-1ec999662967", "comment": "Malware payload (AgentTesla)", "value": "904d0463f4434e9ae841f352c1dfb184", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148894, "uuid": "35133d40-0e7a-49b6-9875-4829eb6e36c2", "comment": "Malware payload (AgentTesla)", "value": "2c1f5ca354a4db94991a98c1a8b8a4f0d545338a743d6dc47efddd87547f3f5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148894, "uuid": "67f566da-9973-4471-8767-10450caa6a5a", "comment": "Malware payload (AgentTesla)", "value": "e5ceaf8233cbdcd6a9d51a17c9480cb24183944b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148894, "uuid": "96f50b75-4c51-4516-9a9a-ffdc5d92499c", "comment": "Malware payload (AgentTesla)", "value": "9c8116e3f90ce11e3bef47357ba4944b4039d1bac979e9dc6187b162c669c74569953fdbb8fece21701ab8ee2e1246ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148894, "uuid": "019d949d-27bc-4940-bef3-98819aa6d92f", "value": "T17E55026A43788FE6C55843F571E410292B3026AAB093E7046D9DE8D5CF4B3F18E3766B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148894, "uuid": "a40bdf2a-2c27-4a1d-924b-e141d6a2a7e2", "value": "12288:2DHoGX6jXLi6dMg0CI01cNMPb2E/do5Weh3ih9HUA:2ToGKK6c30bABYTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675148894, "uuid": "c268f3da-f554-417a-abf3-7eea30131f55", "value": 1310720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675148894, "uuid": "413bac7a-0761-4f4f-bde5-1b945da41209", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148894, "uuid": "368b6bc1-cb1b-48ea-854b-9bc026d08e7f", "value": "Purchase Order No-1243.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2dc3520-a1b2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675202439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675202439, "uuid": "e481132c-4b38-4ac1-b57f-1db65f941e2b", "comment": "Malware payload", "value": "ec2507163cc595cc6f0ac7e916740f61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675202439, "uuid": "f7254956-a467-4909-adfa-a8cea0209e3b", "comment": "Malware payload", "value": "2c2c9e345f7fd5c55d41916ba9f72cf8d7dcccfd6d9616082c81b37967a3d523", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675202439, "uuid": "0e68fb13-9060-4538-8276-beca38670baf", "comment": "Malware payload", "value": "472a2f697d5f5a923368b1641e4510e3b4191ede", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675202439, "uuid": "c2f5919e-59b1-4d00-806b-0ee757396555", "comment": "Malware payload", "value": "afae21e690557082e3fa5ad6e30e09b51224b883744c7db5c2f1e3e4a3721d6db4c04ac32d615c14eb096b51c3d997d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675202439, "uuid": "b4b7a8f7-bf2e-48e5-beb1-b79d4fca3ab4", "value": "T14684BFC1A6B2FC62E92686329E0FC6F8761EF5424E187376121B9BDF15B01E1C5B3271", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675202439, "uuid": "d3589bf6-fe46-42b6-b314-54ab88a86988", "value": "d84aba910fd98bff40c3867e1dd713e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675202439, "uuid": "5eea9d6d-32fb-4a6d-bf5e-9f6ca4c60344", "value": "6144:/a0OaLQLU+7Atp9JiMX69HC81cnuQA550/1COmqMoIy3/8MV:zzMp7AL2MX6pL5QA7vRqMw/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675202439, "uuid": "f81cfa60-308e-4707-a030-464dbb4f850a", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675202439, "uuid": "6bb92654-b70b-4116-a4d9-305190273447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675202439, "uuid": "e8bb34bc-8e55-4e84-b03d-55ede4abaa32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6305d27-a176-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675176648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176648, "uuid": "e811bced-9278-4a7a-bac8-23b9025eb3fd", "comment": "Malware payload (Quakbot)", "value": "5169703804a6fc464bb94df8b871c78c", "object_relation": "md5", "Tag": [ { "name": "1675161160", "colour": "#029B8A", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176648, "uuid": "161d2f36-bbc9-44f2-b99c-4a627efe02c8", "comment": "Malware payload (Quakbot)", "value": "2c997fb96e73dc737fef19fbaba8b1cbc1eb71d4d550f3ac9c623e75800f02af", "object_relation": "sha256", "Tag": [ { "name": "1675161160", "colour": "#029B8A", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176648, "uuid": "5026a0b6-68d1-45ab-816e-5e62a8b1176d", "comment": "Malware payload (Quakbot)", "value": "1562ccda92be44810b4f7158a44f161f9313d7bc", "object_relation": "sha1", "Tag": [ { "name": "1675161160", "colour": "#029B8A", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176648, "uuid": "4e2650fc-2f40-47c3-94e8-ed166171ba2b", "comment": "Malware payload (Quakbot)", "value": "5c802454d19a11ddb93e55e9cdf126f686f93fce4f4417774ea9ff5c93ebc8c916f0187510fc945eab0ee33488ab71fe", "object_relation": "sha3-384", "Tag": [ { "name": "1675161160", "colour": "#029B8A", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176648, "uuid": "814c2665-a77e-49b0-a7ac-a54c94c8179f", "value": "T182518ACCAB6AECDA09A9414C619FD9A44265CC1023F2F3A42D4D34F3E990BB4F95D31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176648, "uuid": "fa660465-8f26-4672-b89a-00c22d1a9d1b", "value": "48:srcHRJ+qHS+3pNxHKol70h+uSLayZqASMP0h+kIEZ39XME7T0uMaE9V/y6n95ppl:soHRJJHSaHHKode87Pkv7T0mEq6Lpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675176648, "uuid": "efb515e3-f074-4673-a8cf-06e7c1e030fd", "value": 2641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675176648, "uuid": "3bafc230-b7be-4dee-9b02-581c2b83d625", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176648, "uuid": "9e881b5b-b31c-4ca7-b376-8073491e54ff", "value": "attachment.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49833fc7-a1ab-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675199256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199256, "uuid": "e3c1b7b7-1be5-49de-824d-60ebaea241d6", "comment": "Malware payload", "value": "573241336c4b94a72fbce6aaa484a30e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199256, "uuid": "fd5faaf4-07e9-441f-b03e-31079b760cab", "comment": "Malware payload", "value": "2ce7891884274f9749df0faf46bca81cb0bb8e120ef5367053689c7438ea54dc", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199256, "uuid": "d13f3258-4ffa-422a-b364-cb9f51cbe218", "comment": "Malware payload", "value": "6324cd79e099023ec6b9e677f694340ec47357b7", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199256, "uuid": "9c8be165-a0a3-426c-8b61-abd5c0e4d08f", "comment": "Malware payload", "value": "7f995ee8adba067b541597af3a8e49faef5647ee499f16242a00710966a4e26bf6dfb0b41375878c5e29058441d62b33", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199256, "uuid": "aa2a94fd-f691-4b16-8d6d-7b9e002a35a6", "value": "T11F2596342EEA5029F177AF7D8AE07596DA6EB6A33707995D00B103C60723B02DDD193E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199256, "uuid": "15d3315e-5efa-4d36-96ab-7baecaff7efe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199256, "uuid": "ca7ed531-7891-487c-a0b0-a68eb7c1aa9c", "value": "24576:u+O7F9smBDJwWmIezBLwsHuWbxR4AK5ZJXX:p8/KfRTK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675199256, "uuid": "8f50fa0d-d371-4c96-8b32-04d75e604536", "value": 974848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675199256, "uuid": "ee8a14ab-b110-4b00-b811-ef6f0562fea9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199256, "uuid": "bd782e2b-a5cb-454c-ad97-391059a166c7", "value": "8w.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60587985-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140453, "uuid": "19ef4ce7-adc4-4452-8286-640e067a0fec", "comment": "Malware payload", "value": "feb2520f08de01370dd6075e59a2930b", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140453, "uuid": "882187a4-9d2b-4039-b247-9adcefad97bb", "comment": "Malware payload", "value": "2d1fcf14c85e2ad41ab67c74ec3aa8084d8bf8b07d36390195fd364c5699e4d6", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140453, "uuid": "8287de7a-64f0-46a5-b9c4-154ff3c63538", "comment": "Malware payload", "value": "8e195abf4c82c1bc7405bd86be7d85933d00b458", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140453, "uuid": "71e1d016-53ba-4497-b969-dde2c2040234", "comment": "Malware payload", "value": "25dab1120381d49614ffeb5db7bea9e33c16b5d1b495c6d2ce6e2945cc50f95760744b812a99cf722517f412a6d4800b", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140453, "uuid": "a93cfaff-5e0a-4897-bcbc-8e880577059b", "value": "T14C363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140453, "uuid": "c178b888-ebb1-40e3-9ddf-d151072e3045", "value": "98304:Ov4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXX0:OvpvFa+g8RWLdPk/84tCEr0RtNiC5eSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140453, "uuid": "3c6fc3f6-31cb-436a-81a1-d1fa6733974f", "value": 4993024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140453, "uuid": "f36871aa-5cb8-4a2a-a565-e94ed17068aa", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140453, "uuid": "7f242a0b-d7cb-421e-9673-4da26378501e", "value": "2d1fcf14c85e2ad41ab67c74ec3aa8084d8bf8b07d36390195fd364c5699e4d6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b71c4e-a197-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675190772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675190772, "uuid": "caa8b776-5881-47aa-a028-dfcabddceb0a", "comment": "Malware payload", "value": "67c0387577ac10382543046198ddc314", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675190772, "uuid": "f281e6c2-3524-4966-ad04-77ec77b6cd1b", "comment": "Malware payload", "value": "2d69f60f42c6078f13f843852a58d396972364968c3672d17ad7b99546ca7eb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675190772, "uuid": "00a414bf-43c2-4e04-8c1d-537ded6506fc", "comment": "Malware payload", "value": "80d1339f40280c7311a0b50a832ffd07cb938845", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675190772, "uuid": "55612cbf-d736-48d6-abc8-2df50c649f75", "comment": "Malware payload", "value": "aa489298664b688e5937cf61bda81c1aae2aa6120d40f6d66113177e5b51b5755d94a57658009b61584c054762d19aa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675190772, "uuid": "4fa98e4e-8dec-43a2-b235-b1d6e499ed1e", "value": "T1B0A53341F134817BC481EE71EB756B42FDF0BEAB2861E16570EE618F3957160782AA33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675190772, "uuid": "7379731d-bf64-4702-a78b-2bc2a96980d0", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675190772, "uuid": "1b52b15d-2a8c-413e-89c7-9041c5aebaf3", "value": "49152:C2EnIQNTQ/+me4NgJ1DkVj6GBpkONLXYtk2/MZ7G1wLCgv2MR:dEn3NTQ/m4KLkVjdpDCD1Yv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675190772, "uuid": "cc60765f-d7c4-4175-8948-59d02da1bcd3", "value": 2171345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675190772, "uuid": "11071fd6-57ef-4228-a663-13eaaad8296a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675190772, "uuid": "aeb115d6-dcbe-4a56-9dd1-4669a91ef6f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c40d71-a140-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675153485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153485, "uuid": "39025c51-29c3-4cdf-beeb-01a4e7861374", "comment": "Malware payload", "value": "4cff506e12b41628cfeb69e3a7c19766", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153485, "uuid": "78a5a7e3-a12c-4128-b0b9-69dc2406c6f8", "comment": "Malware payload", "value": "2deffa226ef14a720f9966f85f9b336dfc99be668eba6d12fe8eddfa4692f1b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153485, "uuid": "192b7f50-3468-4698-84fe-2265435a54cf", "comment": "Malware payload", "value": "4f5324ff21489a6e40a25236ebec9469d24becba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153485, "uuid": "e3c4c579-53ab-43e3-b3b7-5a1a75ce5b14", "comment": "Malware payload", "value": "58e94407d83056e4f3ac9265d9ed7b96e29054ae104a010d9d72303d88348a7e7ded28ba3592516580608859ead4abc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153485, "uuid": "65a42665-da37-411f-96bb-1e1c28f8f998", "value": "T1DDC63354B39004C4EDA7973BB4D390379999B42A5B74F38F0B94E6540D2F2E16DEEB20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153485, "uuid": "b204ab5c-fb74-4196-8f8a-fe9e2ce79a02", "value": "1e92fd54d65284238a0e3b74b2715062", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153485, "uuid": "0a9d1220-2167-48c3-8e9f-49139a70ef0f", "value": "196608:gpl4XkYUXHpQL2Vmd6+DKMTNfwZHYYa/1q3+dgS+Y0W8/La8ytfQOeqs0P+Q1uab:g0XUXJQL2Vmd6mKMBkkq3+d9+PW82fQw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675153485, "uuid": "e22f8ae5-8536-4a51-b2b3-c94a9294291a", "value": 11809369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675153485, "uuid": "38fbe1b1-6c24-4806-8620-31a9c30b821e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153485, "uuid": "e5b925e2-f1c4-4a47-ba42-573b790a5090", "value": "Experian.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26ca9c06-a13f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675152812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152812, "uuid": "4e8066d8-b121-4f7f-99e7-c3fdaccda9cd", "comment": "Malware payload (Mirai)", "value": "41352d31aa97621a6122d9dfabf2d1fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152812, "uuid": "9f99a225-90d5-4f28-a69f-c974e6789319", "comment": "Malware payload (Mirai)", "value": "2e05a36a735e2137582fc5e77ca3d9b25a81d703757583a1d6a4b73932e0dc68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152812, "uuid": "bf871e56-2c01-4f83-9aa0-85c81eaa49b2", "comment": "Malware payload (Mirai)", "value": "c4ee5b1a7e06b25d37cf879fb19d41246abd615b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152812, "uuid": "d136a274-d18a-4a59-99cf-de8bd56867a0", "comment": "Malware payload (Mirai)", "value": "344c4697ffe50869145583241675cb799f8f37f41575538fcd5c4ba06a94a956af4fae008562118fff48e6d9160569a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152812, "uuid": "b804bb90-5e9c-4606-91d5-a803ea5b3b9b", "value": "T1FB230271890A9DB524303C76DA95D3937AF12AB2C6673023963D0A3C2FB57231E57E4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152812, "uuid": "afd37fad-119f-4080-b4ad-7352b73d166f", "value": "768:D/TYCoIxdEk+AxoTZAZHFeq8b3xX9q3UELbUXfi6nVMQHI4vcGpvo:DECFd+A6YHAxQLRQZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675152812, "uuid": "ba69fe99-9772-4230-80bf-34d469a34ec2", "value": 46624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675152812, "uuid": "c6e4a35b-2681-48a1-b1b9-33d65d89d6b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152812, "uuid": "6a1b038d-653b-45f2-9281-d09faa8c56ef", "value": "41352d31aa97621a6122d9dfabf2d1fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5bb69d5-a1c2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675209343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675209343, "uuid": "c2fc8a8d-2fb2-47a7-b19b-02939ca6c5a7", "comment": "Malware payload", "value": "f27dd39c53b0c4350c4f233b4b94e5ea", "object_relation": "md5", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675209343, "uuid": "48d616a9-d53e-4f49-8e46-a4b714d44460", "comment": "Malware payload", "value": "2e0d85be5e2ef024f3d4b8b5920929fb7532375f69bbd3a32577d08983da89ef", "object_relation": "sha256", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675209343, "uuid": "9b207ecb-b558-43f6-b5a7-e1722d19d0bf", "comment": "Malware payload", "value": "704552c7accf56de97534843d2ae213fa989577f", "object_relation": "sha1", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675209343, "uuid": "375d33ff-9981-41ad-8d6c-6a5643e9c7ca", "comment": "Malware payload", "value": "c47cbd367ea4aa3bdba43828590ee77dbdf6eaf97c924deda3c6f8a6cb0834b4c6aa31d4f3087d08314cc5b6559cb226", "object_relation": "sha3-384", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675209343, "uuid": "6065c24a-64bf-494b-8dcb-e9089ded226a", "value": "T17CA312AE711A289A1F3B8EB026455B73E0C38CD9CDD5817C567462F14C0367BA47707B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675209343, "uuid": "59d683f1-508a-4107-bfe0-de8de4498eb2", "value": "3072:FePAam64OSZtbnJBKx6djLCeB9WRcqVAsIrhpYFiKC:FeYqXSZtbfKijmeXWRcAAsIrh2Fix", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675209343, "uuid": "d92ca264-fea2-4554-8970-693cc9481879", "value": 100129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675209343, "uuid": "effe656e-9a78-4004-a6a2-b0c1c699aeff", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675209343, "uuid": "5db7a497-2b32-4f97-bc94-09e0e14e5872", "value": "sample.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d29f5a6-a130-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675146434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675146434, "uuid": "05b8f52d-0d79-4774-968c-6b93db032e98", "comment": "Malware payload (Smoke Loader)", "value": "fba19b5967bdb332c68fb442ee55be9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675146434, "uuid": "f4a4422c-e4bc-4a73-9235-349d517e1deb", "comment": "Malware payload (Smoke Loader)", "value": "2e41956de8b5d2206f62166b556afec73d6c1f4a4cd4011c5fa9f5112436af5a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675146434, "uuid": "87e33493-9838-4ff1-b4d9-10723b866e48", "comment": "Malware payload (Smoke Loader)", "value": "5fb8c5823602e19858d070a4f220a816c7e49e2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675146434, "uuid": "c35cf0f8-4901-4dde-b028-f9442021ce01", "comment": "Malware payload (Smoke Loader)", "value": "6a7ee4f4813a302294c7fe1bd0417e44fc5b3c4844662b6378ba56d0d96040baa2a2de6e09b17c0e0da78ddda30845ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675146434, "uuid": "baaf3a6e-0a60-48b1-a0e2-b02f171e9a15", "value": "T103548E02F2D1BC40F9665A378E1FC6ECF51EB696CE08A72523189B5F25B31B3D762211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675146434, "uuid": "d2597505-de2a-46bd-a202-a6551ab9bd95", "value": "a2c8bd590ac12702f85d4107db46f8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675146434, "uuid": "948606f5-ec81-49c4-8f88-316f8d6ea591", "value": "3072:vvuSUsLLz+7R4rwjZRAo6tCAC9wNcOnBra4g7K7f43H7BFJabRGRCDR1:uDsLLz3r0RAtGZOBG44K7f4VPEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675146434, "uuid": "9c5bff11-fed3-45f3-bc3b-d7b14fb69cae", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675146434, "uuid": "3bd4daf6-c34e-47e4-ba7c-80d95353d777", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675146434, "uuid": "5bf17365-2396-4061-b57b-8920f7435c6d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b099ad4c-a140-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675153473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153473, "uuid": "33f3cdf4-1e27-40fa-92f3-f4edea6c2e4d", "comment": "Malware payload (Gozi)", "value": "009820c5ebc50b2c6c142c43b76d50ea", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153473, "uuid": "093acf30-115c-47dc-97d0-7074c93c783d", "comment": "Malware payload (Gozi)", "value": "2e8c953cf0ad1a1833baf1aa0c15e9173d6fa5a3815a08a7602b2bb3a58f5d28", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153473, "uuid": "ea0fdb99-9d09-4619-a6a2-178be1132505", "comment": "Malware payload (Gozi)", "value": "23e4b0ed9b813fde06d363a9bd2203c51d861bdf", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153473, "uuid": "571fa0ac-4fef-4cac-ba48-7c5189192ae8", "comment": "Malware payload (Gozi)", "value": "aaeeac7aae1a5b569ad0e0f3538d92d052e3d0e7c865285186f1248eb6b216dc84011a2ccb12cb97770da7ae475b24fe", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153473, "uuid": "3981ff9b-99b9-48d0-8256-ed29baa2421d", "value": "T1BA733A19B786D886D65A1B3A5CE2C6E97332FC406E9783073284F77F5EB1690CA03647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153473, "uuid": "a30257f2-ada0-45ca-a0ec-e99bce6feaac", "value": "1536:qblYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0vViWr41M8YQDokp0UARi3dBG5F:qblYkEIuPm3fNRZmbaoFhZhR0cixIHm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675153473, "uuid": "1a8bf724-2428-4872-956e-c166fd4ae910", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675153473, "uuid": "c64949d8-071f-49e0-8880-d136e55c627e", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153473, "uuid": "e480f139-6439-403f-b978-0a97fecf71a1", "value": "comunicazione.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0cc6943-a168-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675170680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170680, "uuid": "14abd2ea-38bb-4bd8-b864-76154dd25536", "comment": "Malware payload (Formbook)", "value": "e3a576fda3253b1f5e57734e1d1d30ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170680, "uuid": "355ad9d1-d4fb-493b-b0ae-315768868b4a", "comment": "Malware payload (Formbook)", "value": "2e919dbaca46898116a0aa387553a54f4711aea584ea9931e6ea49d89e8986b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170680, "uuid": "ea6fbb54-0a71-44ef-b729-b1038b154bfd", "comment": "Malware payload (Formbook)", "value": "4da98990e681a5c9ea026960ca0150582088173d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170680, "uuid": "baec0e60-d857-468f-b742-e5e5c84234ea", "comment": "Malware payload (Formbook)", "value": "1a136996945f4f71d221f87fe41d023275991bead0bd4e778a490e18ca4f9f1999b5eba3b998c4482ebf775a583c442f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170680, "uuid": "a820c9df-7d3a-4929-89fc-139de8763136", "value": "T18044120833D4D437EDB35E708DB9BA5BA9EEDD112861AB5713200E24B9227429F5F393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170680, "uuid": "61871782-3aba-4462-9d24-53f9d36b6bae", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170680, "uuid": "7b501497-27da-480f-ae67-cc9f7c446c43", "value": "6144:/Ya6x5gt3OupNIRztp3FXl50iIj74HtMJh9plSNqw7mPONATWEsbSDYv:/YDSt3OX95l5uj8NMJZlSz7mPOO4SDE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675170680, "uuid": "07ea554f-4f20-4811-adf0-e5752755afdc", "value": 278154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675170680, "uuid": "9166db3f-35af-456b-83dd-50eba0c24257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170680, "uuid": "196c3254-c1f5-42fc-9002-ecddaab8e7fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ea74f0f-a132-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675147268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675147268, "uuid": "e2954281-c04a-4333-8c46-16738d269d80", "comment": "Malware payload (Smoke Loader)", "value": "5c095d99822890ba51f747d64fd03a26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675147268, "uuid": "8c8d93f4-eae4-4546-b643-54624125ec9a", "comment": "Malware payload (Smoke Loader)", "value": "2ebed089e601af314fa1df1f5b12aef8cc8a3c2ab2a8ba39ceacdf5435a90c04", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675147268, "uuid": "0ef5200c-92f5-4206-8246-0bad6276fc12", "comment": "Malware payload (Smoke Loader)", "value": "981ccd1f14162bd578baa6708ce0fdfd16dce707", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675147268, "uuid": "44c94dd1-18ea-41d4-a272-94253f290b23", "comment": "Malware payload (Smoke Loader)", "value": "b0f07625c72423bfe9111c975b4b653b3873eeb627d8a4755e1c4f2c39e8c46763331ba840aaf1d0af7101bb3333fd5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675147268, "uuid": "ed9bce46-ec6e-4cb5-a44f-18738c6a59c8", "value": "T163547D02B2B1BC41F5668A758E1EC6E4F51FB592CE08B7663318AB1F25B31B3D762311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675147268, "uuid": "3c11d7f6-3db8-41e1-bd7d-c9ee59195b30", "value": "a2c8bd590ac12702f85d4107db46f8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675147268, "uuid": "aef410f7-5ff4-46e3-a9ee-72eb24ec4be2", "value": "3072:L8uY7QWLNl7R4dEiRQStnOoN+dTS9BvYhoXqIOqHTeyx87f43H7BFVa+1zZdRCDf:vyQWLN8qiRQSkDdG9WZue7f4Vf5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675147268, "uuid": "009aa6a5-8fd9-4c5d-89f7-4d6e960d4465", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675147268, "uuid": "79f34da7-f97f-4fe5-ae21-4ea8e575eed0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675147268, "uuid": "2d265259-6c25-4da5-b986-083394b1ce24", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb7d5ea-a142-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675154432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154432, "uuid": "6f724365-ace1-40ce-8f07-3a4429b3edf7", "comment": "Malware payload (AgentTesla)", "value": "29d46a03016d82cd3288d643e59abc16", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154432, "uuid": "b839c770-436b-4684-9189-2fc709814256", "comment": "Malware payload (AgentTesla)", "value": "2f435d439d6eaabd1f242ddeaa728300b6ed61d3c8955ca69464d69d88a2e2f9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154432, "uuid": "4908bfe4-20e6-46a6-b840-81cdafb6485a", "comment": "Malware payload (AgentTesla)", "value": "dc4c303a1d09f71d0a7e165fdac5a7787108bd7d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154432, "uuid": "94681638-4a7c-4b37-bb37-cb66bd51300c", "comment": "Malware payload (AgentTesla)", "value": "9ec78008f67f4e5e8bf6889c2c07d66cb08742a9bf813e3201e769398240918dcf9acaaf1d04a0efbc059bba0bceccf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154432, "uuid": "43e59889-9162-480c-a7fa-b0813fe36d93", "value": "T14C642390C42E4A70BC8AE7DF2C55FB184769D39AE561E0DAC21C00652727C929BCDFBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154432, "uuid": "ac676693-ec69-4a95-8d18-8f940e453038", "value": "6144:N0J+TrEPMdaYEQZ9wRwy5iHaJp2egO9l7WyRGkPWx3p:NMp08oWjooAelZWyRGkPIZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675154432, "uuid": "a4307052-bb64-4b9a-9c14-73bc9aaeffeb", "value": 311804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675154432, "uuid": "dba9ea2c-7a2d-4d0d-8a43-0af0aa541f3c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154432, "uuid": "de8eb950-7494-403c-abc8-2199a9cdd309", "value": "DOCUMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f3a716-a151-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675160654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160654, "uuid": "3e7d3596-794e-410c-bd13-06a489e0bafe", "comment": "Malware payload (Mirai)", "value": "89ea7f271b1082d3887060d8c5815714", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160654, "uuid": "ab27db82-2eff-488b-8dcc-60e5c4bf9650", "comment": "Malware payload (Mirai)", "value": "2f720646a61af0add770c29e74d9d04435be01db03a371bfbe9807fc1a4f8069", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160654, "uuid": "bd0f027f-c016-49d7-8a97-ce13dc49a8bd", "comment": "Malware payload (Mirai)", "value": "ae815f429b5c31c3930ff39566344160833a7a74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160654, "uuid": "1030a171-9412-4e04-9c1d-cbf368b238e5", "comment": "Malware payload (Mirai)", "value": "56e6826ac337ab47f32787aa20b08b650982c73cd1aba3cbb22417ab33d675537b8c4209e6c146cd0f88169bb4637452", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160654, "uuid": "4a6b04eb-5e30-4377-ad5e-cdf63a0bbd1a", "value": "T117634AC2A442CCB7F96382F0106BDB35BB77E0776026DA57E3951A3AE875AC0C58136D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160654, "uuid": "0713ef7f-581a-4d09-bc88-d13b73c31c20", "value": "1536:tWigC4P/9LrCzPNofS+LIT93jrcbeuJIdvOvi8O8Y5VE5zQzJ0WatyLgaSwX9:0igC40xzv8N3IE5KiWU8gEX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675160654, "uuid": "49d8ea39-b4b3-4314-bfc0-1a9ac7a3cb2d", "value": 71036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675160654, "uuid": "af7217a2-38e3-4e01-8f09-69a6e034304a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160654, "uuid": "249198cb-97b2-4ad5-97ae-acd7ae8b4fb8", "value": "89ea7f271b1082d3887060d8c5815714", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50dc0a0c-a126-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675142145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675142145, "uuid": "242c59e5-166c-4009-a333-e47b3e4e5a07", "comment": "Malware payload (GCleaner)", "value": "8c9b554b4b8cea3b247d3fb32bf4ff31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675142145, "uuid": "f471e5b5-0f41-474a-adcc-af841878505d", "comment": "Malware payload (GCleaner)", "value": "2f9d8ea00d9467bb858c63604fbb63e01b0d34e2cf57b3d5dae3fccce7aee7dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675142145, "uuid": "5de21924-084e-4a61-800c-34eb0e2ec6eb", "comment": "Malware payload (GCleaner)", "value": "a48b9844f213f8be47cd7898f35f282ad9b66551", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675142145, "uuid": "0583a46b-4d15-4ab6-9a6c-a85fedc625d9", "comment": "Malware payload (GCleaner)", "value": "8cea7675c791dd72c4d6a2293b808546866f9e9bbee090a551c85e93afef95717b07a24a29c5882ce9fa57cdccd0a967", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675142145, "uuid": "f86b732f-1d5b-4d79-a64d-db197a89f606", "value": "T113A53320E7B184B3C193C3747A2A5D04B7AB2A5E5069049076BFB2CE0F77468D97DB1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675142145, "uuid": "0b5127ca-cb9d-42f6-8e27-b04848f26e7c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675142145, "uuid": "429d56a2-0e38-4577-888d-41c0245fcbd7", "value": "49152:C2ymmpkITBkXBpoHRuhjIXeRhbN2NLVENM47Vy0NTl+wIuLCgv2MR:d9IqXBp6cH2NLVkM8s0llXIOv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675142145, "uuid": "81001096-0f3b-4d94-95a6-57a4292be2ab", "value": 2164346, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675142145, "uuid": "070b175c-cd64-460b-936e-02014a6d7050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675142145, "uuid": "16177898-5798-403f-b037-707f8d9600c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05644a7-a157-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675163377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675163377, "uuid": "a2d3d303-63e2-47f7-a14d-1aa9bb78f701", "comment": "Malware payload (Gozi)", "value": "b45fc9a9f0a445f61b365fd5b68b3244", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675163377, "uuid": "6cefb353-73f8-45b1-92a0-e52775274926", "comment": "Malware payload (Gozi)", "value": "3132cdfb9b2e643ac4e4b51e5d42fe96ddf65cd00e18ca96a0d081cdc5e6de8f", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675163377, "uuid": "41fac83e-4992-40ec-a3ec-893833897dea", "comment": "Malware payload (Gozi)", "value": "1367dae0f4af4a5766bc35f6dc7367c326a5265e", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675163377, "uuid": "971c8d20-ed69-4376-b631-ec76b40de478", "comment": "Malware payload (Gozi)", "value": "433de46c4f06b3bebe31190939ae116368c8ebc8218ea10bc81d5cdfc21e7480e2a920223b85296514ea50f92251d079", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675163377, "uuid": "dc4a41ee-d93b-4d51-a9de-5850600c7f63", "value": "T1E3734A19B786D886D65A2B3A5CD2C6E9B332FC416E9783073284F77F5EB1690C903607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675163377, "uuid": "e8665ff8-3561-47da-8553-cbd74d08e547", "value": "1536:VSlYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0DViWr41M8YQDokp0UARiCpBG5x:VSlYkEIuPm3fNRZmbaoFhZhR0cixIHmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675163377, "uuid": "a143f8fa-2057-455c-a156-14aec77d0c6d", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675163377, "uuid": "15073ab4-8a7a-43ab-83b1-db474fc6cf92", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675163377, "uuid": "619a8746-b5f2-41fb-805f-4159e6886616", "value": "comunicazione(1)(1).xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76feccb5-a191-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675188165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188165, "uuid": "01444659-4460-429d-b0c8-ad1bf056407a", "comment": "Malware payload", "value": "ae5334d3d5b27bfeeff9054c0999a5e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188165, "uuid": "a413442d-7222-4b45-8c12-caeeca7e234b", "comment": "Malware payload", "value": "313805f57c2690bb96518881122c2e90c1fa7a2acd7ffc1d2417ca0723e3ca28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188165, "uuid": "ed9ee235-bea2-4313-96bf-c322302f2607", "comment": "Malware payload", "value": "2360bd6e920e4f9bd0935efef2eaf7d10ad508c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188165, "uuid": "ba2ca5d8-9ca3-4df9-9580-60cb57394a7a", "comment": "Malware payload", "value": "2a0cbbbd062a4b82eea329735933da5607cfd9f6855854eee33bc1497863fd7f647dfefcf2fdc53983496c195d16a1dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188165, "uuid": "8ef857a6-3b05-412c-8a08-d4e705ca0fd6", "value": "T18C95332760C76BD8E40EC57914F62CBE44558C446395F8CBEAF57BCE80D09844BEABA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188165, "uuid": "efb658ca-92cc-44db-bf35-919a3560abdf", "value": "24576:Hpbp+ew84Fixbifxgeta+6gYtNRfXVHLkXSU6IXeu/fO5/:F28BxbiZP8+6tRvtcSSOu/+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675188165, "uuid": "45f84267-2bcf-4719-b62f-c6f6772691b3", "value": 1877001, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675188165, "uuid": "f6bae998-dacd-493d-96ea-cb30883590cf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188165, "uuid": "abbe61c0-471c-48d4-8611-564193fad85e", "value": "MicrosoftOfficeCrack.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7559eeb-a13e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675152652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152652, "uuid": "43f8a20f-6528-4dc6-b78b-9b5fe2c05012", "comment": "Malware payload (Mirai)", "value": "b74058f3dae64d3f91fe8506e87b762f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152652, "uuid": "8c7743c7-51c4-47dc-9ed4-6c940893ad22", "comment": "Malware payload (Mirai)", "value": "321b9e4a92f01cbdb3173e3454a9a7d685ee0a0c2975d9cc76316f22c5d14eb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152652, "uuid": "875a6290-cf6b-41fb-b5de-1135d083689d", "comment": "Malware payload (Mirai)", "value": "565321adc2d04eddb1143e516d1ab3d992bf6ea5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152652, "uuid": "f0e21eed-9358-4851-86b8-3982e5633916", "comment": "Malware payload (Mirai)", "value": "a4d7656e36336694eb1b92af013b3511a71bdb9a81b973343ef73efb444a785c85d09b868309d4ede636c466c37185f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152652, "uuid": "07a8a9f7-4b28-4595-833c-de016e278e19", "value": "T18B432921B63A1F13D0E0A47D21FB4B59B1A15ADE26A4C64E7D720F4FFF11680A943DB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152652, "uuid": "bc24f0a9-8d8b-4499-9729-c7c6fa235146", "value": "768:RqowmZPu9wtnfbltWgC6BSJsBcfDSTFIuQKqgESnmC/xO+KpAwg:RqtmZPuutfbltZFBSJsBcfDSTFI+BEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675152652, "uuid": "b2185ea0-67d9-49ae-8f4f-38f9b5e9ae08", "value": 58376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675152652, "uuid": "4536d730-9fcc-4d65-85fb-44a8e5af9348", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152652, "uuid": "22d77ce3-9c08-43eb-8a6a-d635421fdf01", "value": "b74058f3dae64d3f91fe8506e87b762f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "803c058e-a151-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675160693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160693, "uuid": "cac6c501-7abd-4ea1-bab1-6bfd623d6ada", "comment": "Malware payload (Mirai)", "value": "fbcf60c006a8cad5d9f85347c459b0db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160693, "uuid": "1fc933b6-fd6d-4b80-8840-6c62833f6166", "comment": "Malware payload (Mirai)", "value": "3276542c9536bb7a095e28146ad104b86d682035a9cc2fc3f685824107ec8ba4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160693, "uuid": "e8f90b2c-fa2a-4454-ab9f-7abf1f8c0681", "comment": "Malware payload (Mirai)", "value": "c531c3ededa09453ee2bfe6ef8c32c7c866ff1e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160693, "uuid": "2bd933d2-5482-4096-9f41-b684d329d63a", "comment": "Malware payload (Mirai)", "value": "cef3291c7be947e584e4f896bde7c6cd16a2eaff6dc72a5da66ff9846adb95c8e8f05d6a5ed29e7d0bbeb7c69e680970", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160693, "uuid": "e9e595ca-8043-4086-9a7c-2f8a458de4a4", "value": "T185836B86F9829612C6D91B7FFA4F128C331157E8E2EE7613CE295F6237DB55A0E93010", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160693, "uuid": "c2a9b1e3-1a8a-4d77-b5c6-de06ec96e97f", "value": "1536:HVoXIZ3HHKffO8x0g7prc2EsPiw85wYG9Kp9oeYv3vV3dNxtTI:yIJj8xv+xwEwYIKfoes/5dRTI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675160693, "uuid": "4be7a377-96fc-4fee-9c8f-d3a925d93203", "value": 83472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675160693, "uuid": "573dcd7e-f156-4de9-9840-24f37369fc67", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160693, "uuid": "75a4a3bd-7a49-421d-83bc-9408c1051d3e", "value": "fbcf60c006a8cad5d9f85347c459b0db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e95ce6a-a184-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675182648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675182648, "uuid": "f2afe12a-1758-466f-a3fd-6b774ecbb89b", "comment": "Malware payload (GCleaner)", "value": "4b4e57342c0d4b882ddbdd8be615d37e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675182648, "uuid": "897871d2-2417-44a0-b880-c47ffdbb8b31", "comment": "Malware payload (GCleaner)", "value": "3361b1f2e6fc7051548512068ea2f21f9b15009ea298cd3540395671d3e82bba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675182648, "uuid": "0d7c43ae-be68-4426-aeb4-6d4c6491b289", "comment": "Malware payload (GCleaner)", "value": "0b5fb47b179b2b192f3aee3126029433300dd9f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675182648, "uuid": "01aa76d0-a362-496d-ba2e-44cda6911b88", "comment": "Malware payload (GCleaner)", "value": "07787751844aed4b0d2e3acd2f070712fc998f1616d739eac10be58872c23eea6d3fdc951efa0fb8ac9b54e0ab7208bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675182648, "uuid": "5f421231-f0e6-4b82-8564-186eb274a0c3", "value": "T1AEA53347D27A42B3D253C7777C285A11B8F3BEA882B4205D729DB58E8F73164780639E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675182648, "uuid": "580db82c-1a61-4f9b-9953-2d312dacdb98", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675182648, "uuid": "1f85d2c1-25de-4e0c-ad95-36c92b7763c9", "value": "49152:C2uVtoigV2okdExgAyHJAPbdXYkCuDhHFXLCgv2MR:duVrh/dUMYhokCuVFjv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675182648, "uuid": "7462d724-3b75-4b1f-bf5a-687f6a286e87", "value": 2169332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675182648, "uuid": "376bb717-6781-484d-b4ac-322af53c1ee1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675182648, "uuid": "64ac672a-d283-4620-88dc-f3d871bc77da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f241884-a128-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675143055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675143055, "uuid": "a2e18794-b77a-47a6-9226-727ff37cad7c", "comment": "Malware payload (GCleaner)", "value": "20bbb47fbde4c3409092f2d4171c14a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675143055, "uuid": "a8e75c8b-31ae-4da4-9777-f737a00f4bff", "comment": "Malware payload (GCleaner)", "value": "33cfc5bbeb7048dea2b77d55c1f6020a7ad7def9533ac8776a9ae7cf84dc44e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675143055, "uuid": "7f3e6088-9314-4a14-8566-86b94f13601a", "comment": "Malware payload (GCleaner)", "value": "82d9ed747a5c51cd621833e71f1f38725075c89d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675143055, "uuid": "1d924a90-6727-415a-8128-bad2039705cc", "comment": "Malware payload (GCleaner)", "value": "8460199c49e79f0d0743180064734c362c3f226ddf4acf4f87161144a8e706df33c15e629fa9c8aa40d64043734e80b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675143055, "uuid": "71f6f7b1-b4fc-4206-b5a8-7ce97e586990", "value": "T103A533432C928133D522DB746E294609FED27F4620786037399CA22D7E773A1B15EBF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675143055, "uuid": "19744efd-c5e3-411d-ba48-9535ed3db18f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675143055, "uuid": "6e323fde-762b-4d53-bbe5-9ffa1d6995bb", "value": "49152:C2g6jtPgE/qSn3JdB2z2FQtLZYyl/DBw2Yw8of+VLCgv2MR:dgsVg2v7tFQtVTle2YJv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675143055, "uuid": "a2aa304f-647e-455a-9c31-fbd4d6054901", "value": 2183018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675143055, "uuid": "e92e6c78-75bd-4521-9da1-509aff313769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675143055, "uuid": "354e26fe-edb0-4b28-bfda-284f7ea5d21c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab68e6fb-a16c-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675172362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172362, "uuid": "4161b5fb-f655-44f7-a6ea-1edc44ad326b", "comment": "Malware payload (Smoke Loader)", "value": "fbb885adfb302179b813dec5b689623f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172362, "uuid": "e7037301-961b-4130-8faa-c2e73ebc143d", "comment": "Malware payload (Smoke Loader)", "value": "34cf3b4636819c748aee4c391410f325d52439ce8861573822158ab5b05270c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172362, "uuid": "f4674ab2-44f1-4bab-a9e8-171194035569", "comment": "Malware payload (Smoke Loader)", "value": "82fd2d1a4f00a687de7cfaa39dda0fc1ce7940e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172362, "uuid": "01d8b2de-ffed-4461-aa89-dbb899ed274f", "comment": "Malware payload (Smoke Loader)", "value": "edaa3e6534c9b2aa7b4e7a6b1d4c87d2adfe49f58ff632762566a8476c1fb01bd00b49ac4f65af3c85c8b5f982217e88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172362, "uuid": "44cf6ba8-90cf-404e-b490-4c9d8335b216", "value": "T130548F02B2D1BC40F5668A76DE1EC7E4F51EBD92CE08A7661318BA1F25B31B7C762311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172362, "uuid": "12d4871d-907a-4c60-97fa-f2c915ff3642", "value": "78339dc1c5de0e493ea2b28607ce356e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172362, "uuid": "c3a04725-cac9-4d13-884c-4e2197255753", "value": "6144:EGLsL4wqGyhXpzcOPD0A+MD3DeF7f4Vsik:fIs8yht+AYzOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675172362, "uuid": "88b4caa6-b67a-4aca-a966-0d1962888142", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675172362, "uuid": "8ab9696d-9a7a-4603-a1fa-d5441d523ebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172362, "uuid": "8e9b96ed-d711-4d26-9663-d65c3a933561", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97299abe-a10e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675131955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675131955, "uuid": "d75b07e0-d860-4c0b-a480-abb405a81dab", "comment": "Malware payload", "value": "a06b4fbe3cdcf7888aaf523ab1841198", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675131955, "uuid": "5df85244-85e1-402f-808d-1a403841db61", "comment": "Malware payload", "value": "35a3364e5e8a24fbd9706415c462a9dbd855e0ae5a1eab2e94e3a9265cc5c269", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675131955, "uuid": "93d86f54-a342-4a27-a7ed-e963728ef068", "comment": "Malware payload", "value": "24c6667cc84b5a4d64e6a61c9a1e18acf3305f59", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675131955, "uuid": "1ac6cc03-0d7d-4ea7-a4aa-0556cb738c05", "comment": "Malware payload", "value": "36275fddb0dc347b13bb10e6aca1555a7b693b2849a531ce41fb414079a47b461d8c6f98f98f5adaee8d592bdf30fd35", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "stalkerware", "colour": "#D7AE0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675131955, "uuid": "61332371-8e5b-41ae-829d-fc36208195ac", "value": "T13C2733A3180698DAC031A439447F2345B875CA693AE27B521458EFB7C5F39B58ACDFCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675131955, "uuid": "5eaa2f7a-e756-4339-9a01-802e18cc8194", "value": "393216:zUH1sJA35z7A79L+VeJ1mbgafiubcGZPb3T9i/zVN2I+TX/F8KpPbNiRSKcsHJj:zUH2JA35z7c5d/mbBffcUPVi/zVN2Iko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675131955, "uuid": "02afe489-23dd-4004-b685-f0d6e1fad46e", "value": 21502656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675131955, "uuid": "43aba754-7ad3-49ba-8d8f-66e599deb70a", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675131955, "uuid": "ef0f4f4f-2333-403f-beab-4f053b9dd5e7", "value": "prog.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3d5baae-a185-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675183221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675183221, "uuid": "0c88d818-9537-4767-9b59-865822015065", "comment": "Malware payload (Loki)", "value": "a088dcb9ad5349ef886336c6ebfd85e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675183221, "uuid": "cde912f8-b671-4915-8854-3412efe1693c", "comment": "Malware payload (Loki)", "value": "365ee9ffdc4bf18f837088cb56943a90a5da4f1bd86f431abf2994e218b60e0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675183221, "uuid": "b8ce7ade-d056-4c19-903f-5e5686b0684b", "comment": "Malware payload (Loki)", "value": "91b430e9640c43b684d9ca98944c5b191b94c57e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675183221, "uuid": "ef7a5e1b-4305-499f-ad88-eeaf697fb148", "comment": "Malware payload (Loki)", "value": "0cf62997d66131ee71ce089617d00c5d544c5cb96548b54df2160329b8133b4a37620eff8e8cb4aeb8ad7a25f23a631a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675183221, "uuid": "9f7565ea-c35f-4924-95a1-b54913d7a812", "value": "T17EE439813BB19872F5DB09B91118778C2F3C644767D6E2779BF279C092026B7F298D22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675183221, "uuid": "a86d3f4f-c68a-45c9-9695-fbdfe93dad35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675183221, "uuid": "27306761-275a-454e-9ba1-499e8c0a8355", "value": "12288:GVfHc4SeSMdN+zORpcoxr8z9i7+pvrc4N34:GVHc/ebIORpjr8zw6Rrc4N34", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675183221, "uuid": "110dc028-6ad2-4d25-b2f0-6b29c8b76794", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675183221, "uuid": "72e1f9a2-e6c0-491d-948e-aa8308e996cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675183221, "uuid": "360d40d0-76bc-4d27-831d-a0ac394f0e0f", "value": "SalesJan2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bf22e0a-a142-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675154190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154190, "uuid": "85804c92-65a6-40b2-8121-4ab31289f025", "comment": "Malware payload (AgentTesla)", "value": "0b72d76e6e5a292857072b4f8fe80f3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154190, "uuid": "2fb9f453-c32b-4b8a-93b3-87bf72fe3481", "comment": "Malware payload (AgentTesla)", "value": "36c481e028948d2d6798610aefe9dc54d99652263e2c58d2f872393e2ed86465", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154190, "uuid": "9c57144c-f1c3-4626-b6e0-3cab753ecefd", "comment": "Malware payload (AgentTesla)", "value": "c183b7f17d9dee49f0506fa00cbdb9694cd72451", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154190, "uuid": "a464a9fa-bace-4bc6-9784-9a59896bf31c", "comment": "Malware payload (AgentTesla)", "value": "bb414dddb6bf80534a865c1f343f7593710921be1e6b220fccc2fb68faf15915ee938e4d43284ef007f5b1049b05d64b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154190, "uuid": "bc78324d-25de-4304-8cd4-b1f2e8cca24a", "value": "T1A4A2E09212BF2A96E3BE00D051420DA1B73837F580125E48077CF6E6351DAE63ED88EF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154190, "uuid": "7d7eb447-b8e2-4969-ad5f-d8b6bee963ba", "value": "384:GJcZ7ncoREABE7jhxED//JoqW+0HRH6K3Q/91dzygK34jJWIbgq2tdaeNp:GJcZBEAOoXpW+056KA/tzdK3+gq2uOp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675154190, "uuid": "d6a923c5-e8c0-4754-b708-eabc8264cca8", "value": 22598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675154190, "uuid": "397dca32-875c-4873-b13d-385627968c82", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154190, "uuid": "0c711aa1-3733-4d10-befb-e9fb6bbadba3", "value": "TT PAYMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7732980d-a17b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675178717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178717, "uuid": "a21d5963-2898-4400-ae6f-d545007e1317", "comment": "Malware payload (AgentTesla)", "value": "51ff1dda770acf3947252cbecfe11182", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178717, "uuid": "4ccff926-8171-400d-9624-5f3e7e51cce6", "comment": "Malware payload (AgentTesla)", "value": "36ce3b9ec0b50fcc219b1f1272363b8d3542b4afc3229e0251f58d9b27fb74e1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178717, "uuid": "c4fdac91-3c01-4ec6-956f-b2d2115ec35a", "comment": "Malware payload (AgentTesla)", "value": "d68b1cbe4f4a0c68e729c7aee90e8277822c1a68", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178717, "uuid": "fff3a76a-40d2-422b-818e-0032f7bcc26a", "comment": "Malware payload (AgentTesla)", "value": "08209fb73dbd5348ffc8d922df7eccc2ad7dca6bbe5efb54f2d686af3346a24c8757960cbe6f3807ad9c383110112692", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178717, "uuid": "8e9449aa-3ed5-4db0-814f-e111ed1f3d5a", "value": "T17A032A94A6AC8733EBAF4B7D58F9558257BC5533A409EB0D388C50DD34D279303A235B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178717, "uuid": "4ccf0e17-61d8-4196-b9ac-9ca04868e2e2", "value": "768:oaPM5P55FWQDAYsAYBWKMViQDx09VCBJif3ji/30NZXggkX:oaEAI3s3BBMViMx0zgJifu3CZwZX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675178717, "uuid": "1253671d-f95a-42f8-8d19-6d3c58403a5a", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675178717, "uuid": "4c30c635-90ad-4b52-a022-119f9ef21328", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178717, "uuid": "e9c8f81c-8f92-4c91-9a22-9789b0cd9845", "value": "URGENT REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "102d5a24-a17c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675178973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178973, "uuid": "8ac97a1d-8499-4b25-9b40-618e0a3a981f", "comment": "Malware payload", "value": "dd87ecd1cc587d9c4be84bb813563ddd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178973, "uuid": "b84a99f9-9df0-4157-bd99-0b4107c518b1", "comment": "Malware payload", "value": "36e9de4b348ccc05548edec09493ecc19074c8e2bebcf0b54a209aadcca13dc3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178973, "uuid": "a6a9f975-777f-4a2a-81a7-3c73d944cca6", "comment": "Malware payload", "value": "d0b94c96d4c23b1110559f0c0542dacae731b410", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178973, "uuid": "d2789ff7-1a7a-489a-bd73-d2ee3cfc82ea", "comment": "Malware payload", "value": "53be55c618283f4d4fa8c04b776bdeb8694146381a8f8621511745c20a93a23a107c1e9ece8db3f2fc679841915b0375", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178973, "uuid": "80afa5bf-5e28-45d3-aeed-0b189ab0535d", "value": "T15213F1099F21EF529F0008B32D5CA66DC9BBB75A0B7B356198E5AD4FC3560976C9F300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178973, "uuid": "373093ef-3dc2-4d68-a3ae-c573280edf60", "value": "768:pwkyTc9pHiGJ7bLxlpuYPW55oXnOsUkAtkgP1NjSfLL5UZmVed:pxpJNlEYvXndUt/afLuZmVed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675178973, "uuid": "408a88f6-ec90-4521-b2f0-eb1fddc0ef21", "value": 41760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675178973, "uuid": "fd6b300b-52b2-4d7d-b1a9-0282c6b1cb88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178973, "uuid": "47a82980-a506-48cf-8c3b-4d7fc464169a", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.50294160.22605.24440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f7dda7-a173-11ed-88f6-42010a9c006e", "comment": "Malware payload (VectorStealer)", "timestamp": 1675175431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675175431, "uuid": "2b4e4c74-86cb-47ad-9517-b6f4b0223171", "comment": "Malware payload (VectorStealer)", "value": "c8069511b8c5bbebe2dd922d088d3d0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675175431, "uuid": "50cd5535-e45d-43f1-ab08-350df7bf00bf", "comment": "Malware payload (VectorStealer)", "value": "38f3bf6bf6dd6791d0598448bca8ecce052c47934b652d59d017a840971e6730", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675175431, "uuid": "0e2e0d57-f583-47e0-95c4-60f27ba98b7f", "comment": "Malware payload (VectorStealer)", "value": "263f7593bc33c3d3e4fc669b9fb9f432cb0f81bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675175431, "uuid": "dcfddbeb-c48b-421e-a7c8-5d5babbba13f", "comment": "Malware payload (VectorStealer)", "value": "86b05473d70ade6df532fef0fc80227b64aca287dbde3c8c906a4e3a60c677909c49e0b8bb418c9a3fca2778a2a1ad10", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675175431, "uuid": "5dd19fc2-8f5c-4971-97f9-bd9837c46967", "value": "T1B925231859D4C12AE90EDB737F7A5052BE8AE43B6401429F63744E3AFDE0E96940DBC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675175431, "uuid": "3903822d-a937-4e73-b11e-5c153153f5ac", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675175431, "uuid": "b84204bd-1a6e-41b2-a61a-27541eca59ba", "value": "24576:vYe5+W6JWE33pOeuBSVJMbCYwPBuKTPt8aQrYlj:QW+W6ZHpOeYSVyGYgBu6o+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675175431, "uuid": "62b689b4-017a-4196-9dbc-de9d2bedb03f", "value": 995784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675175431, "uuid": "eedac3f9-8652-4408-80bc-fba52b29100c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675175431, "uuid": "5a683c1c-e32f-47d7-af4e-bffbe24e388f", "value": "MV TBN CALL PORT FOR LOADING COAL_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df71ac1e-a1c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675208527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208527, "uuid": "e2da3360-b2a1-455b-96ee-2f4e7d240e81", "comment": "Malware payload", "value": "1e8c0247db258035822bba444764903e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208527, "uuid": "eafee6fb-e76d-40a7-a077-31b3ac7ea090", "comment": "Malware payload", "value": "3a6402d2f05de18c0ee58a52c96d97842c410046f2604b4a1e929ccceba57884", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208527, "uuid": "4818a9f2-7c18-48ef-b9b9-58811443f43b", "comment": "Malware payload", "value": "e1ca3f038a308800e7254300688ebd3c88c9642c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208527, "uuid": "e1458192-a4ec-496c-9fb9-887479b2a572", "comment": "Malware payload", "value": "b04df3c4971cc87b565a8bcf97fbbc8615d10542fed88199fab79936fd4392396c3ebd33037faa4bd6824c0655d5d695", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675208527, "uuid": "7e9b2dfa-80a9-4508-87a7-1ab5896b6d2a", "value": "T17682CF040E71765DFF2CB13DF4712FEF03A258B46966ABA5F07063D42B18AE46A0A385", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675208527, "uuid": "7604256c-a3b1-4554-be0f-95d8a0053efb", "value": "384:HTvkQb5PsTwpLdPDe3XF2auGiKh2jIhzxOLeZzWLBHkd8mQ:zvTb5PsT6S3DSKhzzOQzk9kdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675208527, "uuid": "cb49c0e8-7c29-4201-baad-d0a35d246ada", "value": 18142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675208527, "uuid": "034235dd-cf22-4780-9a9f-e0afacf80efb", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675208527, "uuid": "072d5133-c616-4a1a-8f77-efcc325b5bb0", "value": "5d84ff17e26d5af0efde25962f29500d7690414f3d35a79006a16a3055a71e7d.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a85a6e-a180-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675180915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675180915, "uuid": "73b86440-173a-48d9-90b3-7971cf7e3d96", "comment": "Malware payload (GCleaner)", "value": "c5e55acf36382d5fe283d133e0a165aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675180915, "uuid": "633dea5c-927b-43fd-952a-8e3cd4a814f5", "comment": "Malware payload (GCleaner)", "value": "3b164096efec61e294b896f7b2fee77ba3aaa48e4b1d89548dc20fe0da2c70cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675180915, "uuid": "6527810e-271b-4d42-8b73-2bb68239f406", "comment": "Malware payload (GCleaner)", "value": "cbbe278616e4db2e43d403075307e95b3a89545f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675180915, "uuid": "5852de0f-f61c-4cbc-b0e2-eca969d19e22", "comment": "Malware payload (GCleaner)", "value": "5ffce0b5fc1b8af9059a182a72146dc7687b0d1b6874675cda02a4a9e1558fbebbd0ea4561513c0b2b8098e67efaa810", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675180915, "uuid": "e3fb65a9-ece1-4042-b995-c06b7e602998", "value": "T103B53321D9D2B93FC253CA3D2D149105DBA77ED9B43D0322329EC095BA73188BA79787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675180915, "uuid": "1aa06e42-7fc0-4631-bc9a-9312173dc0f6", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675180915, "uuid": "54561faa-943b-446b-958e-3cfa25c6e435", "value": "49152:C2OLOmGysAfkOKngJzFWzIDmBS/ilBQcjaeR4YTiwTPaCLCgv2MR:d18sAtggJzkzWmzbQcNNDP9v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675180915, "uuid": "eebc7af5-432c-4080-aa31-f6854c1c56a9", "value": 2305457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675180915, "uuid": "f142099a-3388-4583-8e00-cf81329c0880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675180915, "uuid": "7e7d57ee-6ebc-4ef5-8e0b-c9cfb826b97f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a4a1f9c-a151-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675160683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160683, "uuid": "d3ded4c8-c0aa-464e-ad1f-c92ab9d22fdc", "comment": "Malware payload (Mirai)", "value": "1fa6c61f14fd1d9104f52883ce7b4fdb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160683, "uuid": "897d7c1d-0348-4756-9aae-6e811aeec449", "comment": "Malware payload (Mirai)", "value": "3caa3ea7ca5a0d62b64f1db696871ad6531ca8089712fa7d83bf7c4a94f5ebfc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160683, "uuid": "dd30a590-f234-4996-a3f6-91b75bc9a204", "comment": "Malware payload (Mirai)", "value": "d297c25c2c03278c1f92c01f86e66c57348233c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160683, "uuid": "fdef4d80-547b-40fe-86d4-29dfbfb60fa0", "comment": "Malware payload (Mirai)", "value": "641a1a3ea5bca070eb1b0bb6c53dd03752f790383e685877668cfd292fec47b9b476b2fb26cecb1478f53aef43e30fe1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160683, "uuid": "8e9d4456-e4d9-4fdf-ab45-071283269d81", "value": "T17D832A97B400ED7CFC1EE73A80230A05B531F26585821F36BA96FA63ED761991D26FC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160683, "uuid": "d2780256-7018-43bd-bf02-7342ac78ae88", "value": "1536:ZbKaPnFe8HSeMi+2Jx7hxravGIlc7v8tlFzy031efF8cQbGUrncrD8:ZbKav1HSeMH2j7hxMlc7K+0leKtcrD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675160683, "uuid": "ac32461c-b566-4182-8525-df636a3fcd65", "value": 81300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675160683, "uuid": "de8702f6-b3e5-4952-ac5d-7548011eb8c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160683, "uuid": "19997b37-4af1-467f-a4b8-07ac7a9bd24d", "value": "1fa6c61f14fd1d9104f52883ce7b4fdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de473db4-a18c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675186191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186191, "uuid": "848f8f0b-c020-4c44-a690-59345c249b02", "comment": "Malware payload", "value": "8fc6dfcb3f59c7a7bc3778aa1f7712d8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186191, "uuid": "c806bdaa-7bbd-425e-b32a-7421ec92a6b4", "comment": "Malware payload", "value": "3e2a85b7f4568afe7eb0be68a9ee8677c671da34704733fa3e30162eaf7733df", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186191, "uuid": "ef4734fc-68f0-4e79-893d-bb4976b42ea0", "comment": "Malware payload", "value": "c4ef983668098039ffc39ca9909cc7daf1e65a74", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186191, "uuid": "55908bd3-ece4-4252-a886-85e2f065648e", "comment": "Malware payload", "value": "d4cae0c5c0020e04fe6645af9a0fdb17b064fc564ae00d125e433d988c9414d2545e2de7b54d6f3fe106c22e0dd3bf19", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186191, "uuid": "818c030b-b55c-4993-bff8-9a526a5441b1", "value": "T15FE44CE4FECBE1D1F4071CBC02AA253B59BB13185838BB3AD4117E19D821286AD67F75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186191, "uuid": "734b24a8-1a77-4dbb-b268-d3279ee99746", "value": "48ee4c9fac8d1206bb74064becdbc1dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186191, "uuid": "0f610bfb-fae0-479c-afb7-8da2572c1c46", "value": "12288:4qwFxm3G6H4RyuHbR1MxnuTV/iV1Sd/NzQNfy:lwFxm3G6H4IuHbR1MxnuTV/iV1QmNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675186191, "uuid": "26f5dac8-ec81-4657-8782-be8fdccc4338", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675186191, "uuid": "9cc9bcc2-8373-4d05-83c3-27d82be9818a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186191, "uuid": "53a88aee-afc0-4860-bac4-95b64b94aaeb", "value": "50530.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f96ab17-a10d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675131432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675131432, "uuid": "1cfc87eb-d435-40a0-ae40-33cbf4af0c68", "comment": "Malware payload (Smoke Loader)", "value": "40b2d5c197d23bccc7c1afab4581e4d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675131432, "uuid": "1ae93a68-969f-42b1-8ede-5e023c93513a", "comment": "Malware payload (Smoke Loader)", "value": "3e4d1abc4bff9f54c318ea7d8a525c529182928ebe1ca21374510a122ec90fb1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675131432, "uuid": "c639fa69-928b-47cc-add1-03f78eb152c7", "comment": "Malware payload (Smoke Loader)", "value": "fdba150f80916dd5e464ed0d2483680f0d5f445d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675131432, "uuid": "17ec5bcc-07b7-4f80-bf27-f384f4bf98a5", "comment": "Malware payload (Smoke Loader)", "value": "2a5769ec278cddc79f18ba4aaad41ebddc7d65452341f12ceb1649449244f3c3bdd51a5955c1ad25b9f1d35087ea003a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675131432, "uuid": "098e85fc-e73a-4ab6-b982-1e81a18b8500", "value": "T110F3E120BA50D033C01550BD1868D6AEAF6EBD310E799447BB480FFE5F612D3A66E35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675131432, "uuid": "dc25f54b-02de-4135-bf8d-092987f1a949", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675131432, "uuid": "68d66f6c-e48f-4c70-8bf7-7c9546df5692", "value": "3072:pjB+PeLQaGYh5YVW1WOM6EqszkXskqlddxp5VbH:RLtGYM81W4q5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675131432, "uuid": "665a38e7-c4d0-4f5e-aa74-3fa866a0c3cd", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675131432, "uuid": "ad454341-bb19-49ed-a0b4-2a2aa8bc891d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675131432, "uuid": "4cd58468-e723-4866-b63d-26b4d98e22f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03aea5f3-a1ab-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675199139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199139, "uuid": "ec63e648-413f-4731-b93d-34398e433b05", "comment": "Malware payload", "value": "0a1c34d04e1a8659462ee2be3681013c", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199139, "uuid": "e8e581e3-1894-4751-8e3d-53c3b21ddd2a", "comment": "Malware payload", "value": "3e5b2f7b0b3f73ced2e5aef3f1828f46aaf450cd3da9e30fb7bdef54bcd87902", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199139, "uuid": "d497084e-8435-40e0-aec6-64e221fafc33", "comment": "Malware payload", "value": "02aa8ef034c38b042ea4e0de031559fa6e1ddfb1", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199139, "uuid": "33a571fc-f627-456c-8249-8fd0d3167457", "comment": "Malware payload", "value": "2a3255305c02198eab76f0419fa45e5ea8b033df82fcffcd99b9fb181decdeb4cf362a68c088b0a086650fe7da52256c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199139, "uuid": "678d4d69-14f3-462f-8cab-93230883d8d8", "value": "T171B69E01FAA4C166E07AA1F7D4A106F496B0BE69EB219BBB21403FA83DF37417C15357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199139, "uuid": "8fc7bfc8-43b9-4178-b8a8-b2d5b2b4da5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199139, "uuid": "b50e525d-7fa1-4b52-b3d4-9800309e9b57", "value": "196608:y9/xsOFCNtG22XsNNNNdAvN8rNNNNNVO7aIXM1B7Z0/qW:4RCNtG227T81Bd+q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675199139, "uuid": "b5292a99-2095-4a9c-b155-8a3b5b399b8a", "value": 10676224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675199139, "uuid": "c090dec9-cdc0-4ee4-937e-3dba5d6fc065", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199139, "uuid": "9eecfa63-5cfc-44c4-9cb5-6e16f43e59b8", "value": "DcRat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ed3dd2-a126-11ed-88f6-42010a9c006e", "comment": "Malware payload (Dharma)", "timestamp": 1675142387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675142387, "uuid": "e39f0996-6c7f-47f2-9f88-704ecd6e6913", "comment": "Malware payload (Dharma)", "value": "67ce18845fd67549dd470a10662decae", "object_relation": "md5", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675142387, "uuid": "b2ce5c74-621d-4c10-8a0e-c01714ee15fc", "comment": "Malware payload (Dharma)", "value": "3e84def5eeae88ab28d21de08581e68e46fd9a94b5fee35d609d6f73a92a9e96", "object_relation": "sha256", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675142387, "uuid": "35f05805-131b-4b85-be33-908212212e27", "comment": "Malware payload (Dharma)", "value": "e3f3adc21fcd172edba23fac6ad528a6b0bb4daf", "object_relation": "sha1", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675142387, "uuid": "afb86ba3-2168-495b-b2a6-9824bb197326", "comment": "Malware payload (Dharma)", "value": "81f23b612416de3138e8d3788ff29267e3261e44863bb228e87470213bb54fddcab678493bf05e4023ac160e4ffe271a", "object_relation": "sha3-384", "Tag": [ { "name": "Dharma", "colour": "#3ABEAF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675142387, "uuid": "1bb76f88-0780-48d4-b149-673e36891ca0", "value": "T189939D28C920D03AE4A254FFCBFA96FD5D644B211307D4DB87C11E49AB865E6F932633", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675142387, "uuid": "41e6bccb-94ac-4ded-accf-32a4dacc1eec", "value": "f86dec4a80961955a89e7ed62046cc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675142387, "uuid": "9c9346ce-7d16-4618-955f-f968f7d29ad0", "value": "1536:tBwl+KXpsqN5vlwWYyhY9S4A6RQmnQHs28YNMA8m0kQED86T:Hw+asqN5aW/hLjJs2HMAwkQe86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675142387, "uuid": "122540b3-12d5-4207-879c-6116a73fcc06", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675142387, "uuid": "1879f80b-205a-48e5-b3f2-98158b3d90a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675142387, "uuid": "d3220bbc-1b09-4d30-91db-af9e524c431b", "value": "2023-01-30_67ce18845fd67549dd470a10662decae_crysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5e61e5f-a151-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675160863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160863, "uuid": "3b85df51-c528-43b0-be70-757e70f4d27f", "comment": "Malware payload (AgentTesla)", "value": "a835fb6a9195ccc1f50c67a4afcfbd00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160863, "uuid": "1c2f440c-ab63-4cc8-b3eb-5c21755701b5", "comment": "Malware payload (AgentTesla)", "value": "3ed10930b8b59f0fbbd15e54c0538334f1405fe8a87cb4c3ae667f6dc2fd8fc1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160863, "uuid": "37ea7514-c7da-4a84-849d-c85eeb759cfc", "comment": "Malware payload (AgentTesla)", "value": "9d8be20a25839fa8ea19b20d7cd79cc5013fd770", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160863, "uuid": "06cc90df-964d-4e2d-982d-d06fedf398f3", "comment": "Malware payload (AgentTesla)", "value": "8c1d351fc992a0ed8a46e233584547b79e84d9f2a3aef5b743d7a0826f1f2e822ce8a75a5b152e5f6eb400bcc621b16d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160863, "uuid": "36137536-7057-4337-b1b7-c043d0051feb", "value": "T13862D048F35E7CC4E9422B3B4FA632A47CC9998955253D78CA033B5C0C6CBD1537DA65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160863, "uuid": "087061bc-f32a-415c-802e-e8db5ab08d52", "value": "384:mKhUaLxd/Fjr8Jno5rpvtku6PKJFaNh94IoxfG0mB3yRaDW88Xa3BZGkr:LhNPtf8JnMrVCzko39+tmBTi88XWfJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675160863, "uuid": "c857f86b-5e75-4491-b915-87c32c5e8acb", "value": 15540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675160863, "uuid": "d7c624e6-086b-446d-9122-534a59f8686a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160863, "uuid": "45cc9894-0684-47ae-b411-5fa9686361d4", "value": "PROFORMA INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b94bc60-a112-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675133519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675133519, "uuid": "ddbc9db9-300d-41db-8d09-78911fc351b8", "comment": "Malware payload (RemcosRAT)", "value": "2d09367330c054e632b22f209a465567", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675133519, "uuid": "15d74749-864b-4da4-9e7b-3983a1eb74c4", "comment": "Malware payload (RemcosRAT)", "value": "3ed1bebb7391002ffe104a9ffc9b0bf7fde5b42e3b5f798a6b02597775ebbf84", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675133519, "uuid": "63f53ee6-3d2b-49ac-bc2d-695e2cd4e5c4", "comment": "Malware payload (RemcosRAT)", "value": "0bb2f3d0b66d86c1348a7a7aacc4241058e4f1e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675133519, "uuid": "3a12aaea-1259-4873-8e0d-805faefb4e48", "comment": "Malware payload (RemcosRAT)", "value": "1a4d010575bd35a890d194ea02b16010d712ba8b800433dcf55db85e51082827bbcee5426217fb4822f7c56d99558423", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675133519, "uuid": "0de01034-481e-4224-a5d5-b44f6d5d83b2", "value": "T101251284926DCBBBD56603FF58F010446FB2056BF0A1D7491EDEF4E5804BB802666BBB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675133519, "uuid": "0b094896-9968-43b2-ab3f-ed4a2b00dc81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675133519, "uuid": "8f52bb90-1432-4a82-b150-9e8a5ce0fd9d", "value": "24576:BZo0PdB9JeMgq0YEKSX0p75xtFwJ9YeNvIossiBYTQ:BZeM09KSX0p/EUeNvEM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675133519, "uuid": "a2b95138-b179-4796-a303-68b9b9d3101d", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675133519, "uuid": "637a29d6-7e96-49d3-b336-5ffd4a94b80d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675133519, "uuid": "89d71469-4c4b-4c98-8387-ddf98a38af80", "value": "2d09367330c054e632b22f209a465567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ae88420-a135-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675148497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148497, "uuid": "b7919579-c892-492f-b265-0d548ca94e48", "comment": "Malware payload (AgentTesla)", "value": "908ec54d4bda35d8b4d80908672a8e53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148497, "uuid": "55d5d0b4-efbe-40ed-80de-08744de2b76e", "comment": "Malware payload (AgentTesla)", "value": "3f4be4719aab94a85e3837756cb58fad8a71e1f1525f82ed513dca26164c6430", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148497, "uuid": "0a492fd3-c2b1-478f-b512-59f22cb47e34", "comment": "Malware payload (AgentTesla)", "value": "d45a720a3478122393615c92e547cd2fa0c1583e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148497, "uuid": "0a267411-a7be-4b39-ab21-0a002ecc9b53", "comment": "Malware payload (AgentTesla)", "value": "75f040fabf7c6dbc44150ebd920189c9d1d2619b8e8a8c52a75a4ec8f113dd9fa1fb93adcdd817bcfb6c0b596e25574e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148497, "uuid": "c4d85b78-effe-4bf0-982a-a3d67fb4a143", "value": "T168055A3A08B81AD2D1BDF67E2788ED14FFE05842F3428D6EDAD60886D51368321DBD5D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148497, "uuid": "7fb64b58-4873-48b1-8576-8e3437a69da3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148497, "uuid": "a29bd92c-e2f8-47af-bf08-d15b45dc8d70", "value": "12288:sZeUFQCe5a2Nhqkxp/1SAywKlN71obN/0ZWv2x2SFkjB1ZPUcNYNCgVUkMyS:SeUFqceFNkRS+EM2SFQZiIkMyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675148497, "uuid": "b4ddc91f-c51f-4bbf-9c69-31fd9b99d36a", "value": 860160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675148497, "uuid": "509e9e6b-d971-47fb-8a12-b2b96a593654", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148497, "uuid": "6ca155ee-8102-4ba6-b32f-bcff0b88f1a5", "value": "683348001 PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb84242d-a14f-11ed-88f6-42010a9c006e", "comment": "Malware payload (YellowCockatoo)", "timestamp": 1675159960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675159960, "uuid": "a9c8d324-27c5-4ab7-80b2-fe54dc695546", "comment": "Malware payload (YellowCockatoo)", "value": "70c28460f5371c0b763e553f26dcb5d6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675159960, "uuid": "70083fa9-a961-4f2e-81f7-cd18f87592e0", "comment": "Malware payload (YellowCockatoo)", "value": "41b0c54f3fb6668a2af2fb29fb1e13ce75c94737d85b70aebd37d334d0c0c0aa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675159960, "uuid": "8df8006d-d4ae-4ec2-ad4f-9f3569c49dee", "comment": "Malware payload (YellowCockatoo)", "value": "8e5aadc86ee5c6e799e176924bc0bf1632d38c56", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675159960, "uuid": "c11f28ea-e07b-4c76-9e75-24416bc7da4f", "comment": "Malware payload (YellowCockatoo)", "value": "8c6cdebc13d4de815fc4794e6b22d15ebedd8d9b62ccafe6064fe3e4bf97c1c7405dee7838aff43c93e1a3396b577114", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Jupyter", "colour": "#301341", "exportable": true, "hide_tag": false }, { "name": "Polazert", "colour": "#2F56A4", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "YellowCockatoo", "colour": "#C3007C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675159960, "uuid": "448a4179-fd95-4919-986e-0f7a720fe71c", "value": "T1F4E49B1C3BB5C85C9B6C66E878AB93178B246BF7D6C29F0F0B9381711A5A9314C510FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675159960, "uuid": "e4d333cb-e9cc-4f14-b464-4155627444af", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675159960, "uuid": "57d18abc-ece4-493b-97e1-d0a5e9087e2f", "value": "12288:mIbEDzg43EcbIkNoJ162paFyvKJ7uoE1eMP6s4o1hG:cesSW/haeu10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675159960, "uuid": "9cb3ad98-13a3-4718-bba1-c088fad5731b", "value": 713728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675159960, "uuid": "22a50afb-a81e-4d9f-9d53-d762deb7cf60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675159960, "uuid": "5128c2fb-370c-474c-9c6f-c4a23571100c", "value": "nABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZTxYMWmnEe3NKYVIWEeFGTWIEbOvLLBMjATTR2TCXV0_SA9NHTNoMhiKVNiAZDVuSDVERAaKXqEscG50i5fHIoj.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ea543e-a0fa-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675123311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675123311, "uuid": "47c7103e-ed7d-4b74-b7f3-03da6df415b8", "comment": "Malware payload (GCleaner)", "value": "4e06139800bb91a5309e060846489bd7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675123311, "uuid": "83e0f7cf-1813-46ea-8cb5-2c2e57c3370f", "comment": "Malware payload (GCleaner)", "value": "42364b51a8206337980534ca2bc4e92da013a6db0203dabee4ad9aae37b13100", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675123311, "uuid": "a1706b11-2939-41c6-b84d-1e6d57617f16", "comment": "Malware payload (GCleaner)", "value": "1abaadcf51d41933207626467e659893465c49d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675123311, "uuid": "c7ac2278-f03c-4cd3-9761-a3f62c3ae3dd", "comment": "Malware payload (GCleaner)", "value": "e1833e8aac8008e5537647ad6a6fa0efc6e7e926a42ba8f20538e5378b0a65921be5b3e0c6c7b14ea9d42ae82f2dbef5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675123311, "uuid": "245e715c-e7d9-40e7-8bec-5132d78423d2", "value": "T128A53383DB95E471C54697342E3A4B01C6A27D2DA5E96702708E4E4F6F376F8181EBC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675123311, "uuid": "28ab70e4-c230-4801-ae3b-2cecd7fa3700", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675123311, "uuid": "62388596-e8ae-4c4e-9b39-c31f3122d491", "value": "49152:2cjtPozo/TPEj/INuOF5d24GUaQeJW80Ehyc5fq6YmWdI8aab82pKGqLCgv2MR:D8obPEjM77AF0Y9k6n8jb8UtCv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675123311, "uuid": "2f017073-63a7-4a4e-9ea6-3c153d65fd59", "value": 2182848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675123311, "uuid": "58483f71-9481-4bdf-a6bd-d9ee9cd72ff7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675123311, "uuid": "15a6a307-34c7-4c29-8d31-8565bc8a215e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d30a084-a1a6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675197141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675197141, "uuid": "daa8f305-7583-4da9-833f-27080555ea71", "comment": "Malware payload", "value": "4a6f2f63405412d4d7af45c915ec7944", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675197141, "uuid": "1f8194a1-c872-4dda-ad0b-58100345ce89", "comment": "Malware payload", "value": "42d644689d96a2260490233452bb80f3ba23c7428e29e12adee18891242d45bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675197141, "uuid": "3aee9932-db9b-47f2-8be4-2b049ff75cb1", "comment": "Malware payload", "value": "076a06d42adfe9098f23dfb524e5df638e05a5cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675197141, "uuid": "821e18eb-4659-4d0f-abee-2b98acb4b298", "comment": "Malware payload", "value": "f2323f0bb0b89a34d77195c27b9cf2d94f83e0c547e4e26373932cb6d4a64a0499f2722325dbcf9b15ab6cf644d97288", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675197141, "uuid": "15d1d124-3ab9-4191-9204-b0bc08a49a80", "value": "T1F084B0E276B27C22E9228A718E1EC6F47D1EF5534E087766220B6BEF15B01B1C1E3355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675197141, "uuid": "8a7e5745-3a82-45af-ae06-406e9fdd3c04", "value": "e2474d94404febb68b5af309915f543b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675197141, "uuid": "8d2e82c1-8af8-4cec-b1ba-b2157f5b869d", "value": "6144:v/tYLOnM6QEdqd1evCls36e3ad6tdgmDhyfsIZ6hfmqMoIo8M:nOy/QEsfFA6JOdgmDhbph+qMu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675197141, "uuid": "fbc023c5-69fe-4be9-9ccf-bb9792f4f0e8", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675197141, "uuid": "4d5eaa8e-27a9-4382-842e-9563697336c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675197141, "uuid": "cb65e478-f234-462f-a52c-55e3f3690fe8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2a6fd9-a11b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675137629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675137629, "uuid": "9c13d178-e496-4d94-84ff-06dfb825592d", "comment": "Malware payload (RedLineStealer)", "value": "7cbf7cc9cdb4ae044989a9aaf3593c01", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675137629, "uuid": "1c6eca14-fb2c-4c85-8859-ae8b00ae597e", "comment": "Malware payload (RedLineStealer)", "value": "4329686743aeeac9b7ac9862ca7b7cc478765671995a76dae90d08aa10355c85", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675137629, "uuid": "a2af6d9c-907a-48e6-a28e-755f5f33a5d5", "comment": "Malware payload (RedLineStealer)", "value": "65a12fa0417e397da3cf662dbb14109fd5649dd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675137629, "uuid": "a694e2c4-2156-456b-8dea-22a3e760ba1b", "comment": "Malware payload (RedLineStealer)", "value": "43e5518b9dc0827d3731048c7796e6294f9799173498783ad86c4b0cff16c895bb9cdb3a5b3e8ffc8cf32be07c09fe09", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675137629, "uuid": "fb4b085f-16f3-4b28-ae68-8882dc748458", "value": "T13F540221B790D233C129C4B6646DC190AA6A3D720BB8DD43BB541BFE4F332E16F5A356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675137629, "uuid": "bcc5ea2f-21d5-41b2-af91-191147272285", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675137629, "uuid": "a757904e-5270-4fdb-b610-c98176d312b1", "value": "6144:8LI4GMNftngF4kBCe5i2QTK9KDyS7yeF/fd9:8M4GMNij5ihTW+yA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675137629, "uuid": "156087a7-474c-475b-bba5-2600e6c0ebef", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675137629, "uuid": "03bc9bb7-039d-4fb1-84be-980a2656cf74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675137629, "uuid": "d41b81cb-2cf6-439b-8567-235b20a7fcdb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b16e728-a15d-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675165704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675165704, "uuid": "49814edf-9ca2-437b-ac72-b8b7047e2eaa", "comment": "Malware payload (AgentTesla)", "value": "54df3e1861bccc0cfc3d4177ccf0c79b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675165704, "uuid": "b4b873b6-b690-44ac-a180-e9d1ef7564ca", "comment": "Malware payload (AgentTesla)", "value": "44fa7d7acff457187ab539d03fc1a088e134446366bbba3c6f65ca7423b1e469", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675165704, "uuid": "4cd4ee1e-fea6-43a1-b9e8-9630561d41ff", "comment": "Malware payload (AgentTesla)", "value": "3674437feb7c5e0e3f381d38c634c22e1df27c99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675165704, "uuid": "728cf514-a6b7-4658-a277-84fceb9d38d3", "comment": "Malware payload (AgentTesla)", "value": "489c1d4042f7362f378cc25f10c5e52f8df9bf64d8693106dfd9128fbc9258670163e742adec0f25aba7577d1db333e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675165704, "uuid": "8eb658bb-c082-4e66-8f12-22f173803dbf", "value": "T10674CF597250B68EC82B9432C8DE0C2097A57EA76337C25BB997379C890D3E7CF052D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675165704, "uuid": "ae5ee381-acd6-4896-b69a-bc20584786f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675165704, "uuid": "733b2f44-77c7-46bc-a719-27ce33d782f2", "value": "6144:LtU0ICeu3HvqsHky2O/WIblWOvPCmXV2z/zBl2jW32NQ+uv2s:KCeoHvqsHwqWI0OvaSAnK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675165704, "uuid": "15ac2032-f338-4c05-9135-b3cce8a2fadb", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675165704, "uuid": "8c27fd66-e8c4-4778-b246-2e42b4ac8102", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675165704, "uuid": "f2dabea6-0906-4555-b88e-614d77077101", "value": "PO-00036KIT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59102d69-a1aa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675198852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198852, "uuid": "884b97ef-c8a7-4dec-b51a-1e7e0f6e99dd", "comment": "Malware payload", "value": "ebe6223ee67d014c6031243bbfd80947", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198852, "uuid": "d612285f-2f24-4468-a53c-325e0755004c", "comment": "Malware payload", "value": "450f8efeb0088512580a8e9bcf2b8fb724d3527cd07d21f10c59c57e86574524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198852, "uuid": "86a39ac0-16f3-4c65-a156-4660ff2d74c2", "comment": "Malware payload", "value": "2015c7d918e91e7007036138d85eea3f6ee7d18c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198852, "uuid": "c4e60bf5-bc3e-4367-893d-98ea2412d2de", "comment": "Malware payload", "value": "50fc8992c48256538987c11f740b98553012b9418d7f64d5bc13ece762e03eacdeac6ef80d7176788fecdc4d9314c760", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198852, "uuid": "7a7578fe-a7ad-47f0-9032-9839d0d499e9", "value": "T1B9A5330AA5A3C57BD123EB7C5B1E52106EEABD7671765308211D320A3B373E5884F73A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198852, "uuid": "f448f390-062e-4223-b320-e560f25a4876", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198852, "uuid": "0cf08326-cdb6-4a00-9dc1-8aafb272f900", "value": "49152:C25kumCK1qdEhS4QmCvHyZ6oYrlU5/U5EReLCgv2MR:dPmCIMvSEoaaR+v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675198852, "uuid": "6d56de92-4b83-4a68-a4f5-0bdc3fd730fc", "value": 2183958, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675198852, "uuid": "43f062eb-8df7-4997-a06b-d75e082a4bb7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198852, "uuid": "409ad8d7-3d72-437c-8e15-aa29f20b6106", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37c8057-a156-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675162900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162900, "uuid": "93bcef07-abf2-432d-b24b-041eeaea08bf", "comment": "Malware payload (AgentTesla)", "value": "3640814d5c19a27ba5a38a7b9476f863", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162900, "uuid": "b427202c-876e-4206-9b21-056e7367b200", "comment": "Malware payload (AgentTesla)", "value": "45685698db153603b2a3bbf791ae42252a322268e9e977717aabc39226a7a6fb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162900, "uuid": "1c558ad3-bea8-440f-bfea-30c4c6a438fa", "comment": "Malware payload (AgentTesla)", "value": "8a6ad03521f36a04aa3db176323156f9d75d1bc1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162900, "uuid": "c1d57bfb-0b15-4c6e-9d43-a0508abd7734", "comment": "Malware payload (AgentTesla)", "value": "c8697758ae266e24e17d9ba621aa0b36bc89b2168b989246d38b58ec6367cad53463d30fa43f7f53df459a4427b1e7cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162900, "uuid": "ef60a61b-4d13-43bc-b852-b9d6615af484", "value": "T17672D1FD06C3A63DB8BBAD2B57287A0909C621BDD3240BD57664180A5E1F5371BAD0C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162900, "uuid": "0dbbf5b3-1bd6-4c71-816b-0b1da4e1134e", "value": "384:cNn/O0zx2Xn8qSsL78Z3s4aAMpYP9FH1kXAD1WPG:cd/QSsL78Z3sHAM21FH1kQRWPG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675162900, "uuid": "fbb4ac2c-1172-454c-bc27-844cb92995d2", "value": 16007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675162900, "uuid": "25240373-7ddd-49cc-a395-b58a09f8f3ae", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162900, "uuid": "ffd74fc7-7876-4cd1-a533-1f3c4f168016", "value": "PAYMENT SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbca95c8-a135-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675148767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148767, "uuid": "99421f35-1580-4db7-be40-4eeb34077dac", "comment": "Malware payload", "value": "e44e34b7e2f823c02ead0e6bd53dd8ad", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148767, "uuid": "1efed8d3-9245-4c96-975e-72e816dd2865", "comment": "Malware payload", "value": "4585ff293235bd250c69a9270d4b63ea08bded3f2c6f54b55ccc331bbf4c4cd4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148767, "uuid": "88949398-747c-4cf8-b18d-20103d382201", "comment": "Malware payload", "value": "d4d5e6a64edf89819eda0a649e4960f6586b670f", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148767, "uuid": "1654d357-c0a9-4cc5-ac1d-583ce8db6c07", "comment": "Malware payload", "value": "678ae20c612762e81f9b22d3c2aad86c4d44eee767d52723a1a1b5ce05692a571448950473aa8598f074c7f0249725bb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148767, "uuid": "cb85a4e5-9246-4400-9251-0cb55599175e", "value": "T1B5C6330E81FA2285C5E921B65DC7421CAE633DE4B9D9D556327033AC0D8AB58F8F391F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148767, "uuid": "99be22dd-0224-49ae-aedb-24e421936d37", "value": "196608:hC7jD4bnWQ8CIOrDc7TcsIficXPr6U/9nqdntKaJWv05VxC46fCUbeP:hC7jsbWQ8r7Awyzl/9ItKabVxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675148767, "uuid": "da6b0686-96da-436d-9134-070f5df099f8", "value": 11775494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675148767, "uuid": "6a1d94e1-7287-4984-b293-9cbe1a11dde4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148767, "uuid": "2341edb0-b1cf-4d87-8286-65dab7ba5f68", "value": "setupsoftapp19.0.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a0ee8f2-a154-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675161837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161837, "uuid": "91fee54d-d472-4b8d-acdc-8fff94dd3c74", "comment": "Malware payload (Smoke Loader)", "value": "f54668f73260b8d5bc7a873da7f613d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161837, "uuid": "20941ae6-86bd-42ea-8ddb-2e576618b4dd", "comment": "Malware payload (Smoke Loader)", "value": "466a7e904ed8c3a3e6714d96e2c27e48a079988a74f067038acfc83af5a87d7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161837, "uuid": "8d0d700a-96be-4ff0-9937-5c5539e150e9", "comment": "Malware payload (Smoke Loader)", "value": "9ad97282f14b79aedb3d61d010cf5d71dc3d479f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161837, "uuid": "caade90b-f8f2-4686-af1d-e4d58a0103ba", "comment": "Malware payload (Smoke Loader)", "value": "fc4dd191dc278598ae5081947ab616fa019846d1b34a32ef3e3acb4e4c22bd85f31b50b39c0cf0416da8142205ef968d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161837, "uuid": "c982bfca-5b86-4c39-9d25-d771e3954d2c", "value": "T12C548E12B2A0BC40F5678A31BE1EC6E4F51EB592CF08776523186A1F24F31B7D7A2715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161837, "uuid": "aab55d9d-3393-438e-bf69-f46f181ab929", "value": "a2c8bd590ac12702f85d4107db46f8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161837, "uuid": "c4ab982a-7946-4f2f-a0ea-cd6e1b292e6d", "value": "6144:8nlbfLOXQJhIbC0lw7uveJzdOkB7f4VRXTxrs:+FSAJhcE7uYFzOFTxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675161837, "uuid": "8e281976-5d91-4588-8fa4-2fa891c9e3b9", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675161837, "uuid": "1b07a802-2966-45c7-b6b6-943db8a1157c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161837, "uuid": "6dec71ad-9189-4d72-af36-a55df7842ad5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "439fe32e-a112-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675133533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675133533, "uuid": "a383a4c7-5b36-4f2c-86f1-97c23894663e", "comment": "Malware payload (RemcosRAT)", "value": "cf32de5694cceeecbd40087c6716762f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675133533, "uuid": "91b52130-a772-4653-8336-a16682fa8a6d", "comment": "Malware payload (RemcosRAT)", "value": "482e5f0c7a1f79e82e3a8031809178709617e7dd1fceaf8074bcc88d65deb3ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675133533, "uuid": "65b00743-8158-4347-a0f4-d3e3228913c9", "comment": "Malware payload (RemcosRAT)", "value": "48bd8f7fbf487607776997fdacfa637386fb7235", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675133533, "uuid": "270a0c9c-3448-49b3-bb26-3c3dcda8500e", "comment": "Malware payload (RemcosRAT)", "value": "dba92021776ccfb86d811616b3721513a206a42674bd137d872a23b745762ae609122b9f521480c806bf42cd7ebd8415", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675133533, "uuid": "53cc6372-6d5e-43a8-bcdc-ff8b672e3cd5", "value": "T1542523A6473ACDFACB65017623B084589F311BFDF19ADB0D12AEA315C89F30127723A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675133533, "uuid": "c5ea1a66-f5d9-46b2-a65d-8dc8f22f8e80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675133533, "uuid": "05fa01fb-0db4-4c00-ba1c-6b15f026ee41", "value": "24576:JRBYTPqZw5s5wY0NfbZa+DEE1ZVqeVTJTrxzqnQtXRO:J4j8w5s5wY0Da9cScdxvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675133533, "uuid": "763f5629-9d8c-46ac-bab6-adea24734900", "value": 975872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675133533, "uuid": "4ab27c26-0b0d-43c8-9dc7-027a988a1de5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675133533, "uuid": "bdc9bf69-2433-4095-8c0f-8c904369f3e7", "value": "cf32de5694cceeecbd40087c6716762f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac15b32a-a176-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675176658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176658, "uuid": "055f1d30-54cf-416f-aa8b-f52657219768", "comment": "Malware payload (Quakbot)", "value": "af9177a9842ebb006bcce95446e82e95", "object_relation": "md5", "Tag": [ { "name": "1675161160", "colour": "#029B8A", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176658, "uuid": "f1f38857-062f-46b9-93e0-de1fdea4e758", "comment": "Malware payload (Quakbot)", "value": "487ab4ef431390163568f0a89f4e8279d14717d7a9ced1ba45e34ad280b6b0de", "object_relation": "sha256", "Tag": [ { "name": "1675161160", "colour": "#029B8A", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176658, "uuid": "783aacb2-dc23-4d37-8771-443021c421bd", "comment": "Malware payload (Quakbot)", "value": "fddf8787c83f1eba44f564a3cf044b2cd4ba33a7", "object_relation": "sha1", "Tag": [ { "name": "1675161160", "colour": "#029B8A", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176658, "uuid": "50454f51-82db-4d9f-8c0e-6e147a7bf6dd", "comment": "Malware payload (Quakbot)", "value": "d9b27812fa63428ef4f569f41bd5f6f9dbca07a1a0c68c0f80656f2315f712513df5c1b47a8fb3dfdacb26f5adcd164e", "object_relation": "sha3-384", "Tag": [ { "name": "1675161160", "colour": "#029B8A", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176658, "uuid": "f6608c9a-0fbe-4226-8a89-e321d6ad3ce6", "value": "T14005AF62F2B14C37C1B3263E9C1B5768A939BE1169389D473BF41E4C8F356903B252A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176658, "uuid": "cbf23923-f243-4e2e-a739-44aa6bc2f7d0", "value": "bd00562f54da988c5e30d91b85fe5d10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176658, "uuid": "21856789-d0b7-47c0-ba76-7cf995ee639e", "value": "24576:sikjPg+4QceLhb6fMYaq4RPaOFm0jAjX:Bk0YBq6tjqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675176658, "uuid": "8e2e9fd8-d109-4ee0-b2dd-410dcb24eac0", "value": 842699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675176658, "uuid": "a2b8f8f7-bf81-4a24-b12e-d3b1062b63a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176658, "uuid": "0fffc31d-81c8-4a2d-b190-f0ffe05770e9", "value": "300123.gif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9719200f-a13e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675152571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152571, "uuid": "89191947-851a-497f-a949-15d6077e8ac4", "comment": "Malware payload (Mirai)", "value": "85b8986f2649689b539bda54b6ea6356", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152571, "uuid": "ab289371-44d0-44b3-bd95-d57d1b1bd9d9", "comment": "Malware payload (Mirai)", "value": "48801797a6016fa7d36b7a6fe3008b94bb04212e37d1891ef3365b14c79c8b75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152571, "uuid": "dbe39c03-880e-4d25-a221-951f37b610af", "comment": "Malware payload (Mirai)", "value": "9f77fa924c8ed9416ebac29adce1fbe5af9abce8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152571, "uuid": "426bd017-3f26-4549-bd28-219c3236d3d9", "comment": "Malware payload (Mirai)", "value": "77d5e5738b2dca69e42840cd8eb0365bfd34c23387113981b2835e2f349b5caad93c7a9a6f4e5abe0bc1fbe22d621d54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152571, "uuid": "a9889f29-4799-43af-9946-f886cbc554eb", "value": "T16CA2D025E345AEF4DFAF9D9092C1C2C3B6F547C6278AC8E240EEAF016516046BB48D59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152571, "uuid": "dd52cc35-f266-41ba-8afd-b30dec8c3182", "value": "384:m/JywWc84Tp2YshxqlDeAkSqjGJLeCE5zRW6C5ejM4uVcqgw05VxJO:mRxsSVsMD6xiJJE5zRWN0g4uVcqgw098", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675152571, "uuid": "48e78136-1698-4232-a51d-70ad5bc592a0", "value": 21884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675152571, "uuid": "4868f8b8-bb2b-490d-b537-0b4d753e765d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152571, "uuid": "bcbd9871-b55b-400b-8959-c272b6f44d7d", "value": "85b8986f2649689b539bda54b6ea6356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ed560a-a190-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675187871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675187871, "uuid": "247fc094-ece5-4aea-a261-d71410caffe7", "comment": "Malware payload (Mirai)", "value": "8ba158b7de8a4600af98ea2673131438", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675187871, "uuid": "8a76d48a-c7d7-4338-9182-cb2a58951f92", "comment": "Malware payload (Mirai)", "value": "4910d5bcf0ecdc58f71b02f88e1b9cad203b1b3ac995c034970e8ae744143c60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675187871, "uuid": "74e7713d-e953-44d1-82a2-bc2ffd5fca72", "comment": "Malware payload (Mirai)", "value": "9aeec94a5c4536cf8d8a19732651e5bc57226faf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675187871, "uuid": "6eafcd7a-59d2-4d9d-9bfd-55ae6da1542d", "comment": "Malware payload (Mirai)", "value": "1aef4ba0801d0bc4b3e3321c4c0c4b23a71ac758fea681593a682bbe1ada2353627fea96a8039f85c68e95f2c583e88d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675187871, "uuid": "6ebd7e54-340b-45bf-a675-21b97805cede", "value": "T1FB638EC5A943D4FAFD1605791073FBB296B6E43A111ADBC2E35899B2FC45B01A30B38C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675187871, "uuid": "d563b1e4-7046-4bba-a166-a4755de1f7d4", "value": "1536:R5M9IuDXUZ4kNEfkuKDQBOvVcRpMwxL543m6Qz7QySm9x:R5MeUkZ4kqKcBsVU2w15empfQS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675187871, "uuid": "745444ba-2e98-4468-a9ae-b42b698440b1", "value": 70940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675187871, "uuid": "c0cfefea-d5dd-41ed-bfd3-7ec8223b50bc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675187871, "uuid": "8fa15c6e-ce10-428a-867c-bacc2153fb4f", "value": "8ba158b7de8a4600af98ea2673131438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c97893-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140601, "uuid": "82c1d5d6-13bb-495f-a087-0535262a3cdb", "comment": "Malware payload", "value": "14d590573690a6e6de99ddf96540946c", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140601, "uuid": "7103ead7-1fa4-4d8e-ae72-0ef133d8ed67", "comment": "Malware payload", "value": "49344c0b0d8e6e0a0fe162fb0a4ce37110369ceec937b17bb2436865ab37fd9e", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140601, "uuid": "82ee46a9-3930-4480-901d-8dbda6204685", "comment": "Malware payload", "value": "82eef2b86f48d0adadd6839b41356da87fbcc84d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140601, "uuid": "66d5c6de-c8fb-46cb-9d9f-2c0a110ede55", "comment": "Malware payload", "value": "f8e6cbfa772305ecb155fb0d3b084858b714550d84d6cab9a86b4e318d999877941b5e59897399a087cf1ae2017a754e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140601, "uuid": "d118a900-e906-4707-ad88-0d5e535de2e4", "value": "T1F3363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140601, "uuid": "6d64db65-1139-4b87-9ce2-6b35719682df", "value": "98304:kv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXM:kvpvFa+g8RWLdPk/84tCEr0RtNiC5eS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140601, "uuid": "4395b860-f594-4cc8-ac02-96a174dbea87", "value": 4992512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140601, "uuid": "0016faff-3dd3-4e59-a448-1ec7d4b01284", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140601, "uuid": "6eb95a36-fe06-4708-95d8-21ec99a746f8", "value": "49344c0b0d8e6e0a0fe162fb0a4ce37110369ceec937b17bb2436865ab37fd9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee45f242-a188-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675184500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675184500, "uuid": "13660097-a8a5-4aa8-859f-8d540982317b", "comment": "Malware payload (RedLineStealer)", "value": "e36f0dc59594d35fbec896966579fba0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675184500, "uuid": "450943d5-28d2-4872-9d9d-de8fb094a444", "comment": "Malware payload (RedLineStealer)", "value": "49d194281c086f1c38423a4f96747a87bc06854185658015dc8378d40f940907", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675184500, "uuid": "9cc2a673-884c-4eae-94c3-e21f704ffe5e", "comment": "Malware payload (RedLineStealer)", "value": "da013ad9eb8f2e1eaa4c4017667dda2280719c02", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675184500, "uuid": "8345acb1-5095-459e-a971-d1bae306e1a9", "comment": "Malware payload (RedLineStealer)", "value": "3d81b554ba1b0dc1c0a1baea00e797d10e57b13c0f4514db3728a5864ec779bae6cb175f747c2a818cd700d47afae0aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675184500, "uuid": "f0af87f1-ccf0-44e6-96c1-a670e7ed1180", "value": "T19284CFC2B2B17C62E9228B719E1EC6F4751EF5528E197766120BEBCF19B01E1C5E3341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675184500, "uuid": "9f44eeab-6714-4834-8c61-c6158997c7e7", "value": "9c039baca0968dd2f90042d865dd6c2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675184500, "uuid": "3376c5b6-5a11-4afb-97a1-698c92a186a1", "value": "6144:D4/bLDgXu7J8yGeL6gPLlJDkN6iAk0hbX3VruJ1ybgmqMoIx8M:cDvQQJ5tlJ46imnVaJ1yjqM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675184500, "uuid": "be528331-c11c-4315-b11b-17a38c1641a6", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675184500, "uuid": "70616724-8ef0-44b6-8677-ff211363572f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675184500, "uuid": "8a483888-19dd-49e1-bfc4-ae9ef35cc579", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "071cd43f-a1a2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675195279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675195279, "uuid": "92737567-3cc0-4158-9015-d3088496ae27", "comment": "Malware payload", "value": "7acd7bd18b7df945eb4959cc161458f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675195279, "uuid": "30d8d532-b4a6-4195-ba61-0ab99dd4e7fb", "comment": "Malware payload", "value": "4b295516c2c7f2e757e3e57248e3b3d8af4722b8cda9f815baffde4274fbd910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675195279, "uuid": "d8cde948-e7be-488d-ab8e-2a3f303fdc0b", "comment": "Malware payload", "value": "67728c49a6e03850d2a67c87d224bdbf6c486cf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675195279, "uuid": "5be73330-57a8-4555-b525-752b693ca19f", "comment": "Malware payload", "value": "a0750ee5b47b1a1bbd1a93d7b32f669ee0650dc7218c0be762272179cfc3c55dcf8db499bd688cc5fd9a5fa259921730", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675195279, "uuid": "cc2a022d-5339-498d-b8ff-a20efa9e70d6", "value": "T175A533199957D137D252CF302E0A6051EDB1FFAD35B5428CB4EC2FCA2EA72B17819392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675195279, "uuid": "101f8a33-4892-40db-b867-b348e58f3f9c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675195279, "uuid": "d98cc9f0-04e6-4b98-881d-4a30ea8b6f2c", "value": "49152:C2pjJT22aR8k/WsErm3IUq5G6FIoLCgv2MR:dj22KP/jSCIPFIgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675195279, "uuid": "0e2a5be8-5c29-45ff-86e8-b0c152a9078c", "value": 2192614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675195279, "uuid": "9d9f1d90-2551-45f1-9c67-819c32015725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675195279, "uuid": "4e43eb21-699a-4685-9ad5-3cec8afb087e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c52e8daf-a17f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675180565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675180565, "uuid": "06134fdc-ea49-42c4-95be-e9bb862293c1", "comment": "Malware payload", "value": "9207b7ad22298c07557047dbc9631c59", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675180565, "uuid": "164d6c68-2b00-4e04-b031-3cfc3afb8ad9", "comment": "Malware payload", "value": "4bc3f4731059b4f4c05f875a1724a4b2f3824a6b35349b2e9088cbd6d93a70f0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675180565, "uuid": "874d7944-58cb-4976-b34f-9059d60c6920", "comment": "Malware payload", "value": "376e98e1b5f39581317bcbf23f0b9886ae562f09", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675180565, "uuid": "0c3351ad-aff9-4799-a109-6f3a9d087ca9", "comment": "Malware payload", "value": "6117b6c48f5ff25863d23d4de08418f72cf73125eb33f3362582151a9125e48bac64df022087756b21f812a988ebf237", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675180565, "uuid": "b89c29f4-07ef-483d-b661-91fb38ff0141", "value": "T1BDF44CE4FECBE1D1F4071CBC02A9263F59BB23185838BB2AD5113E19D821285AD67F75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675180565, "uuid": "6642c8e4-358e-4e4e-9d62-365cb2fb4eb8", "value": "48ee4c9fac8d1206bb74064becdbc1dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675180565, "uuid": "deb558b0-4b95-429a-af25-346df897e232", "value": "12288:9qwFxm3G6H4RyuHbR1MxnuTV/iV1SdURA8s2Q5Qp:QwFxm3G6H4IuHbR1MxnuTV/iV1QTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675180565, "uuid": "38663dab-51a0-4a82-a350-5f5d96f504e7", "value": 739984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675180565, "uuid": "89263a11-f64f-415b-88b3-dd21081bde0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675180565, "uuid": "8443fd67-ba53-497a-84c6-cc56d596b259", "value": "300123.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd24364c-a168-11ed-88f6-42010a9c006e", "comment": "Malware payload (ManusCrypt)", "timestamp": 1675170700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170700, "uuid": "343a9136-2e74-4540-8b72-4d76f7df5dd2", "comment": "Malware payload (ManusCrypt)", "value": "9905fbc44d31dcac233e5c6bebc27035", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170700, "uuid": "11873145-a7fa-4c0b-bf67-a66dfa520f21", "comment": "Malware payload (ManusCrypt)", "value": "4bff4b7f8db1497c00f3a666cfcbec6b1bad407a1d5f7ad6909e115c3f98ba55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170700, "uuid": "eab1c948-0b85-4e2d-986b-688605be348c", "comment": "Malware payload (ManusCrypt)", "value": "824c546905f046702eeeb9405c4b4d7cb03eb8ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170700, "uuid": "4aaae342-a336-4541-a23c-47f48fbf6fa9", "comment": "Malware payload (ManusCrypt)", "value": "2b9bcdded71f0221a6e6c4248844dc705f00c163967b7bdf1216b67633817548b2b04d13aac86ce8422dc6a94cb9091a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ManusCrypt", "colour": "#3BAA55", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170700, "uuid": "ffbc8879-4a21-4aab-aa95-d4989ac12255", "value": "T170739D23B5D1C473C847417558A5CA16A7ABF93147A9C5837BEE0B8E6E303E02B3B356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170700, "uuid": "6717d3f9-0b5d-4e6b-aea2-537e3f41a861", "value": "78347e8ca7a80658201c5366a8b9706e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170700, "uuid": "a240311b-521c-4f2e-91de-bed2b17b927a", "value": "1536:3vAkGoo+bH/J027ZKxyafwhHCC/mq1ktG:3vuWbaRgaYtX1ktG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675170700, "uuid": "be7e944e-9040-40e1-b7d6-5cbcef4191eb", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675170700, "uuid": "540aea86-a2a8-4af7-ac9e-d32b0b198d55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170700, "uuid": "599c04a0-9e26-4d27-a6d1-1677bbf0c577", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f46a492d-a18c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675186228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186228, "uuid": "d52f155a-8c11-4031-b5db-05a46ea1de09", "comment": "Malware payload", "value": "6bf6dc94a39704b003916fbe45164a10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186228, "uuid": "93693a52-09e0-4847-9120-15d143ef39c5", "comment": "Malware payload", "value": "4c0823751b4b3643977aa95638be44cf60ecef7a5086e0650409fddeea6a25e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186228, "uuid": "8aac5724-0bfb-41df-bdfe-58573aa5b7ef", "comment": "Malware payload", "value": "ff1faf839679739b66a4badcf53ad08a500f241c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186228, "uuid": "798b1f15-6069-447b-96bf-b88b3035e986", "comment": "Malware payload", "value": "e1721679ba54d2166c28988163769bcef12e65046a68d28f4ad53b8d72b4e20ab71d7259267a1bdaac531559b6467376", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186228, "uuid": "9960abb6-c560-4768-bb51-be3085e8dcfe", "value": "T16684B0C2B6F17C62E9258A319E1EC6F8751EF8934E487766121B9BDF16B01F1C2A3341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186228, "uuid": "505f32e6-672f-4373-9fbe-c3e2b3c0e28d", "value": "9c039baca0968dd2f90042d865dd6c2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186228, "uuid": "df70ba75-3ff0-441d-b83f-538687bdffd0", "value": "6144:Hm+m7Lhu6wKWn9uSvd0pV9woU922RSR9hEC38lS0qaGhmqMoIFm8MN:G+iNwKi9uS0LWo8nSRBslS0zDqMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675186228, "uuid": "35ad8dd7-9a72-49d7-aa1a-4068e2c2af7f", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675186228, "uuid": "498ac888-6b0e-4067-ba76-bedb08df9088", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186228, "uuid": "b7406128-8f2b-4ad8-8c50-3f6b8c87975c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fcec31a-a1aa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675198837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198837, "uuid": "465138e9-f8b4-4b43-a62b-75d355f36ccb", "comment": "Malware payload", "value": "f58167d0e2b3692dbac5b35b8907e414", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198837, "uuid": "342e0a73-5db1-4a9e-b5ec-65fda5c821c3", "comment": "Malware payload", "value": "4cba59fde5a74d8e86638c65299b51adacc0ce2af56c1f17cb27c13bf5bb2263", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198837, "uuid": "74c1a286-6640-49f8-ad5a-98668c4b192f", "comment": "Malware payload", "value": "5cfaae6b595f0140ea0afa0f4e76ee23474edaae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198837, "uuid": "3d25f042-f875-4ca2-8fbd-c86cd551cff5", "comment": "Malware payload", "value": "21a4d28a99edb99cbceb20c5591bfa4bde5c1f4ad3639ac32113e8e1e41b0c4bd848ce9d8655c032797b73ae4c20d29f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198837, "uuid": "aafe4342-ec6d-458d-bec1-018ae73b5a50", "value": "T12782F8A842DC9323FF6D1BBD94B562C357B2B6376801FA4C784CB09928D634581A571F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198837, "uuid": "5ba2f531-6fe3-4629-89e3-9f20d78eeed3", "value": "384:X2YZbVxZ4gddXpj3fIQS3l1Hok0NGHISSNZfTQL3:meowdN3sMpGKc7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675198837, "uuid": "98c7d6aa-cd19-4af1-9df3-d96230792447", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675198837, "uuid": "40aa6ab5-9b23-460c-9972-72149d46ba77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198837, "uuid": "aa108b12-1ffb-4eaf-a92e-b50f689ebfaa", "value": "Shipping Docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1bcc2e5-a15e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675166467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166467, "uuid": "d884f3fc-f5eb-4c6d-a269-75cb53641892", "comment": "Malware payload (AgentTesla)", "value": "105440257e16a65080333b54e694291e", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166467, "uuid": "2dec394a-0bfa-4270-9ddd-1df14dc03a8f", "comment": "Malware payload (AgentTesla)", "value": "4cfd253cd141f72a6f635fbb2aad28f92308b8ff6892169a4456b350446211a1", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166467, "uuid": "c8fbcb79-d5a5-4e66-96c1-f21b1f464f43", "comment": "Malware payload (AgentTesla)", "value": "84db2f168ec3b9036593c82f8e78c10fdf308ca9", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166467, "uuid": "84da5d73-73e0-4255-8de0-595ddb408637", "comment": "Malware payload (AgentTesla)", "value": "3b2150ac42524900575c28f07dad2c4c52d2912f1501461d782f1ceb293d15ef87e98ac9b104d59b09877f67a6813f10", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166467, "uuid": "2049ffcf-a59a-47cc-9084-a2779dc9ea07", "value": "T155E433168A18900F8F8D1FE3B5D10A1B5558BCD2D84E5BAB3C7AF5E6F4FA43C2125368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166467, "uuid": "3170c5e8-6a9c-48fa-a63b-bc7c7cb94236", "value": "12288:ajsEOGfHLMXX207QRCkCkODyew01xh7+ia1jzZzgemVGNxKm:bJyYXXV7QRCkriyC1S0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675166467, "uuid": "5041a696-f72e-44b7-8685-51673952755d", "value": 678794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675166467, "uuid": "e2d9205d-413e-4997-897c-3ae1e95ad1b4", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166467, "uuid": "19dd7772-c0d7-46ff-a74a-aea4a538386b", "value": "swift copy.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd8e9359-a119-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675136798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675136798, "uuid": "55ca78ac-eb03-4245-b951-1f1668508f4a", "comment": "Malware payload (GCleaner)", "value": "b5b2c3c59cb7659233b0b413cc3f3a1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675136798, "uuid": "08c74960-5b54-4786-aff0-b54c17015b66", "comment": "Malware payload (GCleaner)", "value": "4d676a7138edbc5021f59051cb50217a7e5481e35c29a6f12ea5e4bc19651413", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675136798, "uuid": "4e120064-cce8-43d9-bae5-7291771be28b", "comment": "Malware payload (GCleaner)", "value": "0a0949294ea805357d398c115953bc2c55a54c86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675136798, "uuid": "21410dc8-cebc-479e-9d58-405868da63d5", "comment": "Malware payload (GCleaner)", "value": "afb012e7cf847fad98b28e0cac0a9ba2fff5d56b94f5eeb5eb11a702f2be76a2230ad2e6251b65e641e1d185ce07bcd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675136798, "uuid": "bb756cfc-2c49-4cce-8455-527843318b1b", "value": "T108A53351B69193B9F0438E700279071B6AA7BCBB60B13A59724E379D3F27B409D8F702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675136798, "uuid": "ef772c31-58d3-435b-a292-51f557c66c89", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675136798, "uuid": "fc5ba63a-953d-49bf-a55a-328a63fa8d08", "value": "49152:ufN/bzxKp1lVP4rwabE+BOd5dMNgJAYLCgv2MR:AlyP5AED5mSJ5v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675136798, "uuid": "8057ec7b-e648-4f11-8e7f-d031ca2c671b", "value": 2174570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675136798, "uuid": "8163d2ca-ec75-4953-b383-337ffe571ab5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675136798, "uuid": "f99b7358-54cd-416c-b950-7687979de635", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b73404-a151-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675160672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160672, "uuid": "5f74b16d-ef98-4596-90be-893450c6aa5c", "comment": "Malware payload (Mirai)", "value": "02816021aca1a2407597eee78a2cae88", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160672, "uuid": "d40149d5-50be-4c7e-9f13-ed67921f4f2f", "comment": "Malware payload (Mirai)", "value": "4e2c44876eb6c29982b2712016d7663034fedcabb3339ac2d313cad735185658", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160672, "uuid": "54d830ef-2253-40f6-a31c-258e10b0b316", "comment": "Malware payload (Mirai)", "value": "45b6b4194b176dd537bfe921a7dce49a659b18e8", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160672, "uuid": "b1c29009-f5de-4142-b11f-22fee8caa477", "comment": "Malware payload (Mirai)", "value": "d25f9ff8c3ed4d76fa1ee2dfea4ce40d977e5cbd02c37a73b61afbf25750eac405e6e497651be5a6ddf0c26914ae19b1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160672, "uuid": "4e7709b9-d4bd-497b-a8e0-7a9d0505132f", "value": "T157736C421180C1FEC9AAC2385E7FF563D527726C1138B62B77F4AF962D46D703AAB084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160672, "uuid": "f960186b-3374-4990-9543-77b66adbd307", "value": "1536:xNS6kDSHP0fJzM9/Wp+9acLks6fzuMPJE7JLKjNDkuggY5dFkiCftpK1u:xLY6PMJzM9/u+QAkhzHPgJQNRgz5dAfp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675160672, "uuid": "d3801c93-104e-4a8c-8ba9-0b9484faf0cf", "value": 73816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675160672, "uuid": "3b123db2-bedf-4177-a746-8de800b4472b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160672, "uuid": "abd7d5ff-bd48-4f1f-a722-92b371d6bea6", "value": "02816021aca1a2407597eee78a2cae88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1a7247-a152-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675161142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161142, "uuid": "0c0c3668-50d7-4f89-a5d8-0cf2e2122774", "comment": "Malware payload (AgentTesla)", "value": "4cb2bf7bd24bfb0d932d99f402e2d79f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161142, "uuid": "0c807fbd-dce9-4ad3-988b-579c4e8180c6", "comment": "Malware payload (AgentTesla)", "value": "4ecb378d85647a7ec5f20b08b469ea2031a358d203475087bf46fd117c751cea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161142, "uuid": "678bb91a-ec84-4423-9155-129b33c20462", "comment": "Malware payload (AgentTesla)", "value": "bae68b53678ba265c0b02d14a53131c894722839", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161142, "uuid": "a7783e96-cda9-45b3-aa8e-e80abe8c2928", "comment": "Malware payload (AgentTesla)", "value": "e323e38fd364a82ee63a90dc52a8b611eb6b6b2d43cd2ed24592290605c82e8509a757f2c2447cdc2a9fd4b3c51f1ccb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161142, "uuid": "29f87903-8d9a-4c4c-9e68-d3528ae3d6c7", "value": "T1B092F0788A1506A1F946342CEC3552E2F428A208EAD068CE748D7F211C2FE55C71BC4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161142, "uuid": "42307e36-75dd-4f1a-9ca1-712cb6696a0a", "value": "384:NCdsEuGA/XLXwmiGrlp3qhz+YoCRYecJB7MFXy4i//cW50W0x7NUcfrTt:NmsEuNbXndrbqxjrOtB7MFH7Werx7NUY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675161142, "uuid": "cf0204b1-f4ac-4615-880b-8c96a67f1935", "value": 20491, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675161142, "uuid": "1834f876-d92e-4d47-a671-f116741ed019", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161142, "uuid": "869342fa-f76d-479c-a1b4-1d714afeaa1e", "value": "ORPO-INVOCE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6272d69a-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140457, "uuid": "7b4614ea-de52-4ee9-bb76-5b15e09cd187", "comment": "Malware payload", "value": "41cab462b5cc1927f53d355cf04225e3", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140457, "uuid": "9317ebca-a5ec-4617-8828-f34dcfaf9b27", "comment": "Malware payload", "value": "4eecfb56215fdcad2fdb58a1b2e5589edc0c7ce13bd838fcdacfe900c5fc8ed6", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140457, "uuid": "e68982ba-319f-41ed-9264-6c949e3b36a2", "comment": "Malware payload", "value": "21e485a205b85b0941f5f710c0b9ab669a2e7558", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140457, "uuid": "38909cee-79e9-4db6-9d0b-e96ba002ea15", "comment": "Malware payload", "value": "4b190dd87d83d8c6942d34658e0b771aa3e588003b1cd81557c755ad45ff1013d0f0198613e483a878008ef5bd490235", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140457, "uuid": "2f6621fa-9293-4594-8f03-a7597054a0dc", "value": "T119363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140457, "uuid": "6e8d1d48-a6aa-428e-8e93-cb1637d61125", "value": "98304:Ov4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXQ:OvpvFa+g8RWLdPk/84tCEr0RtNiC5eSd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140457, "uuid": "9d6a21c1-eb5a-4220-ac69-90fe2bfa76c0", "value": 4993024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140457, "uuid": "53d19d2e-192a-4958-ae5d-10f11eba2943", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140457, "uuid": "858a52ff-9fb6-491b-b715-2a305c94def9", "value": "4eecfb56215fdcad2fdb58a1b2e5589edc0c7ce13bd838fcdacfe900c5fc8ed6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3180d827-a15d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675165715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675165715, "uuid": "4075cac2-c328-4c88-bd32-e97aaf5b7f60", "comment": "Malware payload (Formbook)", "value": "a90a93287cb1ad3db7959af768f57969", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675165715, "uuid": "9529fc1b-1c8b-477d-b757-f1b964e7a39a", "comment": "Malware payload (Formbook)", "value": "4ef4eed826dab18fbe3595b31ead256962bda13217893d6143943662265e593c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675165715, "uuid": "c067f8bc-53df-4b38-8bbf-ea05b6ecf386", "comment": "Malware payload (Formbook)", "value": "1954a762ec5903cf0f5d610f9ab57b0e9659d48a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675165715, "uuid": "0c3fef82-7bad-4ec4-8831-f58118b438f4", "comment": "Malware payload (Formbook)", "value": "b41c30ad83b553a42dd3a20a14d6d330ceaa0c38043433915d4ceb34e0875d2966e7c5a0f0f473e346acecd6a21adb24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675165715, "uuid": "e2e86786-bb56-449b-9625-4abec8f3d8ad", "value": "T17764CF9A7254BA8FC42B9476C9CF0C2047957EA72B33D2077887739C4A0D797CE056EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675165715, "uuid": "f4bbc434-fe0f-4cfd-aadf-5bc877391218", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675165715, "uuid": "b84f0fc2-f3d7-4d8b-8ecd-c8a3f39eae4d", "value": "6144:fyNIgtLwHnoBZ65HwgJg+qBOCnmAn2zuaXBEhKwkF2CTh0:IIIwHnoBZ6yrXBHnvtaXehLkAUh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675165715, "uuid": "0b74c139-0626-4b67-be57-771ebe31780d", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675165715, "uuid": "7f275edb-f138-4db2-8822-0cf3dfab243a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675165715, "uuid": "a7e9d92e-ddbe-42e5-93b3-b0461bd8614f", "value": "SAMPLE-KIT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c41f602-a150-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675160096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160096, "uuid": "b7143d0f-5d2d-44e8-9195-85c9e0d4e2f6", "comment": "Malware payload", "value": "a71806f89b9bba55ac93ebc15c47f0cb", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160096, "uuid": "f1941f76-b5c9-4885-bc6a-a222d25691c0", "comment": "Malware payload", "value": "51b3cdc34fc3da8b7eaedd43d46664a2e07e08386d03a157c51c27cff00cf7fe", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160096, "uuid": "2ee642ae-4917-4952-9263-dfca2dc4f761", "comment": "Malware payload", "value": "a5220c2d754f48168050dab408e42f6182837482", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160096, "uuid": "53fefcc3-03b0-4583-a694-8ff2e378a3e5", "comment": "Malware payload", "value": "e957854c853a80dd85763d3efee18c609e3faa04b15381ddb5dde0f7a85fbc605678c62816e15e95d13e26ed482b8eb3", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160096, "uuid": "89b48fff-35f2-4b9d-9a77-f456e5fae495", "value": "T19B0533244667CEC49B9E242C780B7D5A01CAC5FD6699BB67D63072C689F0370B543FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160096, "uuid": "e7d7cd05-5cfc-4495-bbc6-5323ea09f107", "value": "24576:s3cYpBShg6MbjzZaBWqYCpuxAuMnkQcVmmKD:sMYOFczZxH2zcVm5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675160096, "uuid": "5b17e7ff-4e14-4c26-a314-a76cb798c3e6", "value": 811019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675160096, "uuid": "9eed782b-6cdd-40cb-aab4-d73805ff8bfe", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160096, "uuid": "6cd24aca-ac2b-4d52-ae5a-749e18ce8902", "value": "STATEMENT OF ACCOUNT (SOA).PDF.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3241734-a132-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675147544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675147544, "uuid": "50d05ee2-5d6a-40b3-b08b-c879de53b55f", "comment": "Malware payload (GCleaner)", "value": "a1f41d63c51b2635154dd23d287dd846", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675147544, "uuid": "ad2532fc-0825-4c68-8c2e-4c2206285a27", "comment": "Malware payload (GCleaner)", "value": "53532f4c6bb4dd077523352085f43fdc7628b039e215fd2e93638a0769531ce6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675147544, "uuid": "a842f631-5021-4ffc-8682-f6bca4e66314", "comment": "Malware payload (GCleaner)", "value": "0425e0b66028378736ed37ccc2db970d35f7ec75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675147544, "uuid": "a688597a-3e94-4400-8377-b30aa7fa54fa", "comment": "Malware payload (GCleaner)", "value": "b40f456dbf260e528c255cb964392ccf87b203a37954cafe991769cc4b46e01b997fc11cab904d1ee6747a2087715233", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675147544, "uuid": "0338f2a2-11bb-4fbc-a6aa-59fcd6fb6dd9", "value": "T12FB533EE65A1D035E4130BB90A365A91FD373CA12264A354615DE32F1B7B2C9BC4FB32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675147544, "uuid": "34026554-99c5-4ef7-8410-e41d797d4aaa", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675147544, "uuid": "09bd8a4b-acb4-427e-9a3a-d54dadee4b6c", "value": "49152:C2zPYosq4mNHxe8KEY0lxwfibf3a+e3+Y5m7BuTHDoOKMD5mLCgv2MR:dTYfq4mNHx2sMibk3+6m7BuoOsv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675147544, "uuid": "39022714-213e-4733-b1cf-bb44f53eb206", "value": 2271724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675147544, "uuid": "c27e30b0-997b-4225-9daf-75e779b857e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675147544, "uuid": "e69e0d69-8ab5-42ca-8aec-07a2cf9fc175", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c195051a-a104-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675127731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675127731, "uuid": "fa5eb363-d9bf-4741-9cb2-78828418a30b", "comment": "Malware payload (Amadey)", "value": "912c4757da183f0a09a67c75ecfe193d", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675127731, "uuid": "b30151a1-5d10-4ff4-91c2-c0142047ed88", "comment": "Malware payload (Amadey)", "value": "537670bfc6428758b2d4d20b729e6ac08433f8320f23152a342770722a5b045d", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675127731, "uuid": "8a501892-83a0-4c13-b96f-13d72795232d", "comment": "Malware payload (Amadey)", "value": "0ebed2b156cbe9450ce540450a06fe8b9971eca2", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675127731, "uuid": "2530bd95-c6cf-42f3-be11-6d701e58ae8d", "comment": "Malware payload (Amadey)", "value": "581996de09078810a3f97b17ce4b579f01bff420f8c9ccdc1cbb3f3447b7457be763434690660579fcd13f8fff8a6a01", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675127731, "uuid": "e94a8919-30e6-4566-983a-b21b333e6427", "value": "T1B304E010BA40D433C46751712534D290AF66B9311EBAE977BB990BEE1F723E0772A31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675127731, "uuid": "597bc14c-328f-469b-bcd9-093098a74412", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675127731, "uuid": "b8aa583c-dd9e-4bb3-a944-daedb95aaa04", "value": "3072:YjaHH5Lrv0sWYh5TemT+KuXelC0tVQOFEDqRpTmvTFHSJW5:nLr0sfW9KIIllFsQmvTFHau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675127731, "uuid": "7e9e55bc-cfa4-44a0-a459-be50245b1eac", "value": 173056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675127731, "uuid": "0d4e5a83-bc04-4270-be9f-0655bd6c9eb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675127731, "uuid": "3e137116-0fcb-4631-8dbb-63d147ab92a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "618cad7d-a1bf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675207886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207886, "uuid": "7a0ab0c7-8410-42d0-b0cc-335f192490d1", "comment": "Malware payload", "value": "5764e8ec773786dfdd7a0d3590798554", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207886, "uuid": "d5e82af7-a31d-44ea-8f73-1f3713cde79e", "comment": "Malware payload", "value": "53807aa4868765872f9b5b344e27163fba18a4be4f4c347564384db298d78f7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207886, "uuid": "ff1e9467-f809-4473-a112-12109789f19e", "comment": "Malware payload", "value": "7f912bd3f8d156d90d6458949dc733f456cfa014", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207886, "uuid": "d8bc4c59-a9e8-48fd-b32a-a529c0206393", "comment": "Malware payload", "value": "5d3a16e6347a489591516c9bb5ef2174a194e8cfb0cc3ddd7f85df98c89b225b2aadc3b8489a4dc950fe0842f87a676e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207886, "uuid": "f4929abd-3e82-4f6a-b5a5-9721c6cbb16c", "value": "T1C684BFC2A2F27C62E9258B329E0EC6F8771EF5534E497765220B9B9F15F01E1C5E3A40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207886, "uuid": "b358e58a-41a0-49aa-be90-efc9bfa87001", "value": "d84aba910fd98bff40c3867e1dd713e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207886, "uuid": "207364e2-328b-46be-99b3-604fa4433a8f", "value": "6144:q+aY3LsvZkqqFvzMFEJd9YLxFf6oq0oKFy02thmqMoIO4d8M:yYYxzqFIFEJavnE05qM84d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675207886, "uuid": "029df662-4e4d-45a5-8b9d-2bd792a6db04", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675207886, "uuid": "dc9e4351-5a02-4426-a126-ca060b3d223b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207886, "uuid": "a0fe3d83-d932-49ad-a886-a87bae301ecb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f52ef7-a190-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675187752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675187752, "uuid": "0e6ca803-57a4-4d67-a0ea-05076339676f", "comment": "Malware payload", "value": "4453b84610b1acd1acfa681cb77b744e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama234", "colour": "#59AA11", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675187752, "uuid": "d1d931f6-871e-4583-a12a-093fecd596c9", "comment": "Malware payload", "value": "541fc32b79d9f144db3d670967676bafaf306f25067ceb98ed2a3c7ef48bc7f4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama234", "colour": "#59AA11", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675187752, "uuid": "ef77deeb-d1cb-4ae0-a854-5ec04f4a5657", "comment": "Malware payload", "value": "d703ecc2319d6b01f369ac727b9db2d2dd16a857", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama234", "colour": "#59AA11", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675187752, "uuid": "4c4ef318-5c39-470b-b9c7-8496746f668d", "comment": "Malware payload", "value": "4ac75616c681bc578bcc20128c35886959deab6dfafc99b08872726c61afe728424c9ed86ce54bdf57dc6496ba85df5c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama234", "colour": "#59AA11", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675187752, "uuid": "7862b008-545e-40a1-98d2-4a034d5f2d69", "value": "T1CBE44CE4FECBE1D1F4071CBC02AA253B59BB13185838BB3AD4117E19D821286AD67F75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675187752, "uuid": "457d4454-1b58-4409-9e08-7b057ca0ab74", "value": "48ee4c9fac8d1206bb74064becdbc1dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675187752, "uuid": "d75c6dd0-7d29-49d9-b111-012acf6ed835", "value": "12288:4qwFxm3G6H4RyuHbR1MxnuTV/iV1Sd/NzQNfy:lwFxm3G6H4IuHbR1MxnuTV/iV1QmNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675187752, "uuid": "9a839f34-6205-42c6-b9d7-8b435bdfa9e7", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675187752, "uuid": "f38dfd49-f205-4b90-af24-70a8711fc7d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675187752, "uuid": "025dd524-f074-430e-8cf1-496da914eb6c", "value": "14449.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fdc4c18-a152-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675161149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161149, "uuid": "6bd71f2b-27a4-41ed-a2fc-36bb063e27eb", "comment": "Malware payload (AgentTesla)", "value": "95302613f43fe6b83c9528f88479d388", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161149, "uuid": "dfd64bb0-a78a-4597-83b5-3399bc7a6c48", "comment": "Malware payload (AgentTesla)", "value": "543c66a984ff2998cfe281a88114aa5e84ef386f4207d9ab6145425e6063b4a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161149, "uuid": "9d969f7e-d044-4daf-8876-69659015bc1a", "comment": "Malware payload (AgentTesla)", "value": "9a96bc2c57bb825b3376136482dc6fcb0db3cd03", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161149, "uuid": "3b850a0f-336b-4e84-9935-9096032927ab", "comment": "Malware payload (AgentTesla)", "value": "2dcfe013dae5877a5525453394d69933b43b0b7046c1cf56c8e3d3ab23e281f617ee12c3ee2c0d75722d9398f264491e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161149, "uuid": "e5305e68-66aa-4edc-9a91-4bf384037914", "value": "T1A9134BD47A6C8733EAAB0B7D95F995824BBC5173B405E70D389C60DD38C279203A176B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161149, "uuid": "49b0560a-3e44-4ff6-b3b1-be11ecf27d35", "value": "768:Fa705P515WkDAYsAYNWaEsViragj09VCBJifMBi/30NZXggIiJ5yiRF:FaYYM3s3NBfVimgj0zgJifMQ3CZwlibB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675161149, "uuid": "63fdf93d-14e1-4b11-8c1d-a0292feca2d5", "value": 43928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675161149, "uuid": "4a534a45-8ca8-4e4f-a07f-447bebdcf84a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161149, "uuid": "769eea07-0a80-4fe2-a485-700423eba0c3", "value": "ORPO-INVOCE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e779fdf-a107-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675128719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675128719, "uuid": "3d3a6f85-7947-496b-b946-f60a16db35f3", "comment": "Malware payload (Formbook)", "value": "ed26cd1368b2110bdd7cd9621abaecd8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675128719, "uuid": "f3bbe4a0-4af4-4321-a4b0-05b7ef3c0820", "comment": "Malware payload (Formbook)", "value": "550d710de80bc48622dab82bf9f26b405866ff5d463bd06748c3419ad5ac7de6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675128719, "uuid": "ae7b7d8a-4ef9-4f7d-afc6-2c7b1004b4dc", "comment": "Malware payload (Formbook)", "value": "ddf635235b02e34f355216d18eca028017c80765", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675128719, "uuid": "bbfecae6-542c-444e-8d22-3aec8cb5cdc1", "comment": "Malware payload (Formbook)", "value": "7db7020b1fdf70e0db05cee71cd08a6da91c003a812d95228a17f7cf021edfe3e3cbbc13def2c8677137dee17c26f0a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675128719, "uuid": "e006b0f5-63cc-40cf-bb01-9714ce6a6d8f", "value": "T150E4F1821D68C628F2F61EBD0F3C96298FB44D8D13D3D2B51BE674D5A923B83C815876", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675128719, "uuid": "7a3ee95f-c344-41b6-ab36-f6eb1518cd74", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675128719, "uuid": "5fb19aa6-2570-4beb-ad32-59a4a16d0ed0", "value": "12288:DC66Bm2iNNwLf+7mXgk8H8VZHW0ZV7xv3glN4myKOQ044oHoffMpW66B:WVM1rwT+CXgk5VZT7GlNHyKO7eIcpWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675128719, "uuid": "d11207c1-077d-422b-ab23-f72b6c0265ed", "value": 681472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675128719, "uuid": "fb8eda7e-0e53-4e4f-9e7d-04901d53068d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675128719, "uuid": "02192a93-b294-47fa-ba25-4235a1012318", "value": "ed26cd1368b2110bdd7cd9621abaecd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611b20dd-a136-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675149044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149044, "uuid": "5827c76f-90bf-4531-aa8e-18928c102246", "comment": "Malware payload (AgentTesla)", "value": "be96e03c70f4d6fd3267bc945b84748b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149044, "uuid": "ce824c80-289d-4b9d-a239-023897d7fe10", "comment": "Malware payload (AgentTesla)", "value": "5656dce9e30c9d3706cd3b18364f82b5e34349daad50cf5d7598f72cfc59d169", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149044, "uuid": "89afdfc8-0583-45bb-aa4f-5714d2067007", "comment": "Malware payload (AgentTesla)", "value": "008718f09e718190b76d8449b3cf8b1a1ab04f93", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149044, "uuid": "ebed795f-87c3-4b93-bfc2-5b0f866495cc", "comment": "Malware payload (AgentTesla)", "value": "b3cd2872cc524019a5a05cfd0c61957b86b12ca7ce24690dfa52d20ae98395a97e32d7239cd7cb410708e5cdeed50770", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149044, "uuid": "636370da-40b7-4a44-a4bd-dd2c36b08a4e", "value": "T1B0D42354BEE92042F7448ABC71B626D20B6947E535DA774EDCF5C2A2031E04ADB7C683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149044, "uuid": "6639e511-0508-459c-9caa-233c1af17784", "value": "12288:9rXpvXGLuYN5GRPrRJHP2/cCLmEf8tBiUYjR3E37ExO7kItrS:1pvGSLFukkEiU4lK7MckItG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675149044, "uuid": "d92613cc-a1a0-4bc5-8034-4db5ef66405d", "value": 622973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675149044, "uuid": "475c48d9-661d-41a4-85d4-8d135b7a6f8e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149044, "uuid": "e6b60fbf-ad72-4ac0-9889-15545d6a1e07", "value": "DHL Receipt_AWB#200458298922.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2284ade-a102-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675126873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675126873, "uuid": "4e3c2e2a-162c-4c97-bead-de97859c1dae", "comment": "Malware payload (GCleaner)", "value": "69926d9ac51fd5b3815de63fe68fb72a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675126873, "uuid": "0df4799e-e7c7-4cd5-a798-843796efb78a", "comment": "Malware payload (GCleaner)", "value": "578b24affce88d9bfbc4ad1262a6a2cbdc7b121b47abba5702d312d286cbf5c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675126873, "uuid": "c0841af3-09b1-45f0-bbbb-6b4d525ce659", "comment": "Malware payload (GCleaner)", "value": "7efa1b5c3d480181d94571570ec290f4b21052b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675126873, "uuid": "0e56980b-2f5d-4a00-a8b8-e0b18098bdf8", "comment": "Malware payload (GCleaner)", "value": "7619c229d9a84604c5d2b295a3b3d7f684bef32f839d5a1402b55fa90aad3bbc0bf71328f37bc31b6f3a3e2619c6fe75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675126873, "uuid": "7f201374-7777-4309-9479-dfefd3a14c8f", "value": "T1C2A53312E592EC71C280EA3D57798E45F97AFF05713C4620B8DE63EFA4237902D62B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675126873, "uuid": "6a9f7171-aa71-4300-9ddf-f9122b901db4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675126873, "uuid": "b2e15d30-1a32-4b9c-8236-780bc8df02d8", "value": "49152:2cYdZDRnxV8nPXh0d8M3FDPKmZQd1euSWSpbBXnMm6LCgv2MR:DyLn7iXh0dj3F7VnZnMmSv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675126873, "uuid": "7285665f-235d-426f-99c5-58f407343d3a", "value": 2165781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675126873, "uuid": "30030299-1ddd-46f9-9110-e919d97c258a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675126873, "uuid": "766e758d-b324-40b0-9a05-77b00ad17c50", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0714cd21-a1b7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675204298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675204298, "uuid": "38278566-c9d1-4004-9d90-0623d403bc3f", "comment": "Malware payload", "value": "69ef770f54e29a2fa0de7d773966383c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675204298, "uuid": "f6a56a73-fb0e-4af0-8c6c-d31082758750", "comment": "Malware payload", "value": "57c62ff274441d075033cfceb230a8332b003afc1770b7358da647ef116fdc98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675204298, "uuid": "5a188741-d25b-40ba-8e52-2370aa600afd", "comment": "Malware payload", "value": "25fc7443c064de472a6a2f446da0b93d7df22eaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675204298, "uuid": "a1f946d6-3efe-46f2-a807-24250b90caae", "comment": "Malware payload", "value": "d2731ab6dc5858870eab8744f1465313a32b76f04b9d8982dc7b24f4737598d9270384444c62fa2193b77e4d6521d33f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675204298, "uuid": "13ad4070-7021-47e5-b7ff-fcfc59f977a2", "value": "T134A53301F1959035D282A5723F2AC221B632BE7D2D741123BD5CAB5D8B3F390ACEE719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675204298, "uuid": "55a88ad0-9908-41de-bbc4-025d6f66af75", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675204298, "uuid": "2c71ed23-894f-4d08-87f3-2c27032735ab", "value": "49152:C2iq5aYBbd8eUjqFrKEa0zsk1SBmmw46ZtC+L0APJGLCgv2MR:dba0bd8eU+FrdZskzh46TZov2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675204298, "uuid": "cbeb172e-65e0-4d50-bf9a-f4d99eb32204", "value": 2194544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675204298, "uuid": "a7c29b3f-a305-475a-8ae1-87bc9695340f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675204298, "uuid": "e7b7497a-a585-4280-aedb-5fcba627292b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5c93424-a1a6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675197263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675197263, "uuid": "f0eef649-47ab-4f0a-aa18-2228ffd0e2cb", "comment": "Malware payload", "value": "b7bd2834678cdd544b62aac969118651", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675197263, "uuid": "b86f0cec-6c54-4b35-a58b-2fe3e9d552dc", "comment": "Malware payload", "value": "595726f3d15c2d0793d1bff64c05bfe3c26fc248098274bf06697a43b92cdd31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675197263, "uuid": "3f851963-d6c5-434d-89ce-5f08edce6c0c", "comment": "Malware payload", "value": "4ffe6073a700610a47418f29bca022d698095ab7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675197263, "uuid": "7a2e047a-33d1-471b-9f4b-409b8cce7152", "comment": "Malware payload", "value": "32967dd7bce9001b9734042d1177e1b9d4479a6be7d51d10051e9c4ce71eda6e4b768360f816b0622589ee29fbef432f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675197263, "uuid": "fbb15a52-a5e3-4dcf-bdb0-96ffbb573d1d", "value": "T10B548EC2B6B27C62E9228B729E1EC6F4761EF5534E187365120B9BDF25B01E3C5A7301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675197263, "uuid": "8897d23b-2fe0-4213-b263-19fc5fa5647a", "value": "e2474d94404febb68b5af309915f543b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675197263, "uuid": "982a9346-db7d-443a-8b53-1bd8a98fd940", "value": "6144:WzW2LCtMhoTup5PnsbhdC0p6mqMoIuLq8M:QTmcoTupJkjFqMYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675197263, "uuid": "031344d2-0ce9-41c1-8a1b-15ecec62bea4", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675197263, "uuid": "5143869c-3b24-4e30-8da7-fe83a0236764", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675197263, "uuid": "c96baa87-5557-446e-a045-3bba1d6fd7b7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3685d1b3-a13f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675152838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152838, "uuid": "2f838ef6-cb57-4949-91ea-23e082597be7", "comment": "Malware payload (Mirai)", "value": "f3cc96fdf1cfe1897bd631f0ee832b62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152838, "uuid": "1bdec848-f73b-4df0-8f7a-62e20dd53717", "comment": "Malware payload (Mirai)", "value": "597c2db762cb68b57d5ee0434da6aff661ce935b339f8378d030bb724ef9a867", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152838, "uuid": "df0bde08-d77b-40b8-903e-f0e84fb7b74f", "comment": "Malware payload (Mirai)", "value": "8878b309285313a31e48947b20360566b3592a0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152838, "uuid": "715807fa-11ac-44ad-bb06-5764fc36dcb0", "comment": "Malware payload (Mirai)", "value": "073748794f02141328c4ce2bbb683784d2f6221c3bff483c33f0578a3a3a71adac9b7e33b84bb0767931b323c9f671c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152838, "uuid": "8dc392bc-13fc-496d-8c61-8267486551f7", "value": "T1F3B2C0CC65543088CA8D7C7C178D4A674FACA1D0BADE9B26E350CD98B3BEA4B3459079", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152838, "uuid": "69ea562f-d33e-4128-be28-f8f2f930ecca", "value": "768:c4rQlS07dEv0UXqUhvQE+CXQKMQKCXBpzZq8Wvj:BQlS07FUXqIYSXQKqulqJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675152838, "uuid": "82a22a04-6f55-4f42-b3d0-c78898435fd2", "value": 24912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675152838, "uuid": "d878475d-fe2c-49f4-8fd6-74060a390a76", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152838, "uuid": "ccd3ec26-e8be-4d40-8cc2-3531ff2abb7c", "value": "f3cc96fdf1cfe1897bd631f0ee832b62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de841d1a-a158-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675163858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675163858, "uuid": "1006ffb2-9169-4158-bad0-03043025ff4a", "comment": "Malware payload (AgentTesla)", "value": "b9542526b811562f19f0d56554a212ab", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675163858, "uuid": "47cee9c6-309e-4fce-b663-363c4404ef55", "comment": "Malware payload (AgentTesla)", "value": "5a17f78c7bc3ebea839234ea64ca67c6c053b38bdd0c6e724fb4442b7dca02bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675163858, "uuid": "ab8ef8ac-3295-476b-ac78-5cc55b200e06", "comment": "Malware payload (AgentTesla)", "value": "4e4b1ff047b1196a888fc4fb3e24d2b254b697d0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675163858, "uuid": "9caefa29-d96f-4959-8bcc-20cccd1ea7dc", "comment": "Malware payload (AgentTesla)", "value": "f47725910018e7e4e512286ce2821cf928e2104e0c37d73b15c7660915459eb3cc419f1d5f2bb33b17a27543a752a24c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675163858, "uuid": "4b181625-d601-45e2-8005-c1bf1fd8231a", "value": "T1BDE423895158868FD0A12BB38F3F45B9AFFC122E12A4979753C86E9E3C32FE5451D702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675163858, "uuid": "d41aee75-326d-42f1-8296-72ac20f4da11", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675163858, "uuid": "b21a8661-6e0d-45ff-b498-1a9df7bd1705", "value": "12288:/YrSUidpVgVmr6aifirZAThrJ7o6zySltvUAKeoNwm5oOnEFCRJk73SY:/YrpQVgVmraK9ANrRpzySldUAKeff8ml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675163858, "uuid": "3bae8ca5-09d0-493e-8167-d70a7f201025", "value": 661547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675163858, "uuid": "d129c5da-92ba-49b9-8a6c-1f98b49bbda9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675163858, "uuid": "1f275616-c5a9-41b5-b256-358236dbd8a7", "value": "fiy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5731a2ee-a167-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675170073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170073, "uuid": "637a20d8-320a-41ff-8972-548b5493dd60", "comment": "Malware payload (RedLineStealer)", "value": "66fbf317b644e369dfb190a2b9646c4d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170073, "uuid": "344d16a7-79a9-489a-8a0f-658b62a49a29", "comment": "Malware payload (RedLineStealer)", "value": "5a677b8e1b23a9b51534840f8125a44d060a69440e058261c813d97f92b17313", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170073, "uuid": "fca0493f-0592-42d1-9a08-242dccff526e", "comment": "Malware payload (RedLineStealer)", "value": "769ab8faebb9eea28fc312fcc252d6ed58c9e7ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170073, "uuid": "9619a702-9884-4601-8aed-11507327891f", "comment": "Malware payload (RedLineStealer)", "value": "23e8c9c51c6f369df13d92cdf0da72bdd4daf37ec3508e5490b0717679fa538aae3ecf32d22f87bfd39c15bfd9c5484a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170073, "uuid": "da783348-95b0-44b2-910d-3858a1b1abe4", "value": "T17A84BF02B2D1BC40F7664A76CE1ED6E4F51EB581CE1BA725231CAB1F25B22B3C762711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170073, "uuid": "637572f4-17fe-43db-acff-921f4e47d52f", "value": "78339dc1c5de0e493ea2b28607ce356e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170073, "uuid": "e88cd7a7-3199-4dfd-bb18-50b8e8cd4e64", "value": "6144:vx163LTTBv0X6l5qSeHMf4ZGfFpW5JI0xWlm7f4VRJ:PuHYYeHjZGfFcXpMmzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675170073, "uuid": "c591926b-9ec8-4e29-bd39-711276449bc7", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675170073, "uuid": "5946fffa-69df-4b74-93e8-5226cd6847ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170073, "uuid": "ec5ff3a8-583c-4ab5-938a-d0c76acb99f4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a791339e-a102-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675126829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675126829, "uuid": "2dddd392-4268-4e2c-8519-3142e5153c15", "comment": "Malware payload (RedLineStealer)", "value": "9ad55bf3d993fbeaa8527d8f8cee2e95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675126829, "uuid": "b15a102f-aac8-4e9f-b739-539455a0055b", "comment": "Malware payload (RedLineStealer)", "value": "5aa4304d76ce25d428450ce7232797f89e4fcc1c7d571bef470ad1c485a63a45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675126829, "uuid": "dde40996-634f-4eaf-a7ba-f518e3b53c94", "comment": "Malware payload (RedLineStealer)", "value": "5f27fd5129b8dfe6852427ce861c4a541ff0a47c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675126829, "uuid": "3b1eca60-ccd6-472c-bdb1-24f4597af435", "comment": "Malware payload (RedLineStealer)", "value": "65a7794a27636035f7f2f48ebdd4cde2d10888c0f3324348722c506d13b82b05463a9ef1513ac86b42204223497861d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675126829, "uuid": "90345e5c-6c1c-4156-97e1-4b25b698d0f6", "value": "T1B1541291FA50D037C41694B61824D3517B7ABC32DAB9D94BBBC11BEE4FA21D22B1E307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675126829, "uuid": "d515cf0a-06b4-4019-b8e5-346d82bb303a", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675126829, "uuid": "49bc32d0-2af9-4395-92e5-6e25db8994e4", "value": "3072:ej7ZzuNBLOzQ485e4OmKhEJM5Gpw3pQU9VYPXlqpQFmK3faFL8wD77+y1UAnQSdH:+SvL+Q4OEq0GpUQLNqpeXaF5/smaDgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675126829, "uuid": "8651b74c-5c5a-433a-bb9a-857bf25e71d9", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675126829, "uuid": "ab9fa38e-4ce0-4568-b5bf-c2c8b7355a2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675126829, "uuid": "0a209460-cf18-4f33-924a-e6da01e11400", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7b2a74-a14a-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675157489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157489, "uuid": "b4165d39-0b06-4b95-9e61-20c995422c70", "comment": "Malware payload (RedLineStealer)", "value": "e96e788efbed097bc3eddcad6466141e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157489, "uuid": "8fadab07-8ae1-4f32-853e-e5e8ec1af451", "comment": "Malware payload (RedLineStealer)", "value": "5b5a775290b907aa05d1f4ad6a2b8191e4da559f96f9800446bde625e6d425cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157489, "uuid": "15c99636-8c03-43a0-8e11-86c037841a3b", "comment": "Malware payload (RedLineStealer)", "value": "307bb70328bc80122fc53a97e44a5b2ff6bb15f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157489, "uuid": "091256dc-9aa5-48a8-8790-37e526f703b1", "comment": "Malware payload (RedLineStealer)", "value": "642afc3070b54c0d28f462c9e0e461cc75e002e99d04bf4e1d2e05d7cc478178a6de5405681265772b52db152de03de2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157489, "uuid": "fc77b28e-f632-4c71-a538-bd86c03fc2ab", "value": "T1F484AF22F6D1BC41F965C6768E1EC6F4FD1EB593CE18A7652318AB0F24B31A3C762211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157489, "uuid": "fad5a5f6-0349-4b36-8055-3e1dddca37e6", "value": "a2c8bd590ac12702f85d4107db46f8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157489, "uuid": "a214a91a-71e1-4203-b5a9-c5a1f60effd2", "value": "6144:VHvxLTXt6D1SLSPrf9CZzApAfbCu6dhR51m7f4VvzZeH:1pfyAUrEKp+or1mzOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675157489, "uuid": "2b3b2e66-a73c-444b-8355-c35e590eb1ba", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675157489, "uuid": "b0d32a61-729b-4137-ac1a-fd3f0a501553", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157489, "uuid": "756efdcf-0d1a-4cd2-9df8-7a5eaaf76c29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0af59dc-a149-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675157392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157392, "uuid": "e429a63f-a595-4cfe-a1f4-8e7e859d62dd", "comment": "Malware payload", "value": "ff380d062a9811037f058a3097443a29", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157392, "uuid": "c5021576-b382-4a33-865e-808dd9bdaacf", "comment": "Malware payload", "value": "5bcedfbfcb009a3b9f2e50da697225aaeee7644006660635fcd31173a23992c8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157392, "uuid": "79a347d4-1fb0-4264-b74e-2e4299e95257", "comment": "Malware payload", "value": "a6f01f81d1137c10aaee22644fbf04235ee29969", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157392, "uuid": "ae0b4678-2360-4893-ace0-acb88b4d56da", "comment": "Malware payload", "value": "cfd0406cbb00aef0adb324b4e37934b0ab1ff57db747f8bb1afc30efd633fe45910f3fbd36d174fc8adafe1bf2271998", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157392, "uuid": "dd276e4e-609c-4cbb-bfb1-cd8fb9e21ef2", "value": "T1D113E16CE490990DC2E78D3E784504F6F90A9883924E906F24D5F7CC9F19D9747CA6CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157392, "uuid": "36dc0ead-0b5d-45fc-b30c-8e818d09dc80", "value": "768:+8VcAFv/4vkgse/mgfXNfUKsNpYLDNvfXlApNmP+CV8nyJIemjhR:+wZFYv8ee01M32xfVyCyhjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675157392, "uuid": "b30632eb-e598-4819-bf6c-4c217df34860", "value": 45047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675157392, "uuid": "9c5d98f3-04a6-476d-ab29-e133770da3b3", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157392, "uuid": "deec60f6-9339-48cf-bb1e-45b832ce5d71", "value": "Manideep_Resume.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b680030-a176-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675176630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176630, "uuid": "ff99128a-a480-4c66-8a20-85d7ec3558a5", "comment": "Malware payload (Quakbot)", "value": "2c73b714dd061510b893a9ba1f81ae29", "object_relation": "md5", "Tag": [ { "name": "1675161160", "colour": "#029B8A", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176630, "uuid": "a8facc9d-9c86-4b70-b386-e3c0c32c4879", "comment": "Malware payload (Quakbot)", "value": "5c7ed60ed2856f07d50c4f21808bf037f95f2ea31236f41044760d459ba69099", "object_relation": "sha256", "Tag": [ { "name": "1675161160", "colour": "#029B8A", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176630, "uuid": "ca36ffb6-9a47-4ee0-9ec0-fa18a27af5a0", "comment": "Malware payload (Quakbot)", "value": "83d01a17ff1e7951e62fd66bf12cd2922cc3f4b6", "object_relation": "sha1", "Tag": [ { "name": "1675161160", "colour": "#029B8A", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176630, "uuid": "90eff0ee-4dda-45a1-8aee-b63f69151d6d", "comment": "Malware payload (Quakbot)", "value": "5050e97a3e0c23aa937a1495de50041b0841da72d97f803063843776a5d796eb81fd2cfa874e4c885958eab22d81bf60", "object_relation": "sha3-384", "Tag": [ { "name": "1675161160", "colour": "#029B8A", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176630, "uuid": "0a6394f3-51e0-4cba-b49a-2a49801e4a14", "value": "T147D3134F6D513F90B10F5FC84DA3FDBA09C8E09E081F444935210917DE6AB7849EABAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176630, "uuid": "9a4057c7-f37e-4baa-ae2d-2368d518aaea", "value": "3072:lCyEpWcxtJhRp+tQpfb/CnZfyQdm6lD90y/lbIiO2Eibzl8WDXGJy2uq7:lCPWuxWQ5+fB3qZd297D6y87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675176630, "uuid": "d552b6a0-f216-4869-a8dd-93f2b0a990e7", "value": 142152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675176630, "uuid": "93b1d480-3416-418d-902f-a0d785fbd6c1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176630, "uuid": "bad22245-4dbe-4f75-ae7a-b558718b3d6a", "value": "215070.one.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3388794f-a15f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675166577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166577, "uuid": "24f99e3e-89ea-4226-82c0-b405fc163b4f", "comment": "Malware payload", "value": "4e3fda8f3793a830cffef2a69d5732a1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166577, "uuid": "575796c2-f4e1-4e0a-bf91-85edebd1d68c", "comment": "Malware payload", "value": "5d84ff17e26d5af0efde25962f29500d7690414f3d35a79006a16a3055a71e7d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166577, "uuid": "fce243dc-537b-452a-a1a3-7d8b1fb46ad5", "comment": "Malware payload", "value": "b14b132eea30ce1d6377408669b08bf3c2dead1c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166577, "uuid": "0b87f0aa-3434-428a-9d80-078898a0297d", "comment": "Malware payload", "value": "eeb3b6ef3dc04fd5431c307327c9c47131f8191de52f701519305ea543e2b28f3450aeed0de34f7a762a35ec62c62699", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166577, "uuid": "f6e39f53-9110-42ad-92ef-7cd49912f834", "value": "T1C6036D5AE79F1265CF411273631B0A899AFDB33EB35054A1746C933433EDC2E42666BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166577, "uuid": "ff1008e0-79d0-4060-8598-76a3bcd82b93", "value": "768:QFx0XaIsnPRIa4fwJMxbiuSJ108DMq0/iUqLD5/S/UEkDdFuw:Qf0Xvx3EMViuSJK8gq0/iBLD5K/UEkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675166577, "uuid": "e31f3d92-6676-4fcf-9e3f-e353c63ab676", "value": 40756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675166577, "uuid": "724f7e0a-dde5-40c2-b02f-4ecb9645b749", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166577, "uuid": "b3189fa8-eedc-493e-9199-74bf705c1428", "value": "#736353.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6495c773-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140460, "uuid": "b268729c-b739-4741-913c-3b78ce027ecc", "comment": "Malware payload", "value": "6d629b26ed3e22019869fa9a46ec992e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140460, "uuid": "ec511685-84df-456e-ba10-8ac7b44fc482", "comment": "Malware payload", "value": "5e52b1989c42e139ae017a8ff2d085d223933a164a58d96fedaba4bae76084a6", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140460, "uuid": "efd4ff2b-4c74-4f27-bc49-018b6fbf873f", "comment": "Malware payload", "value": "a02c727a10ac2b67cc8cf75928a6c1dc5b021dd3", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140460, "uuid": "9232e253-279a-48e2-b26a-c0da223801b9", "comment": "Malware payload", "value": "ac76f42cda961bb6bf6c9e9b5726907254ed18c177dac063542b917a2ae3a525c65929cc3677ac6ba1b8f8ee90a526cb", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140460, "uuid": "7b8c2805-9660-418f-82e8-ed719b308bc6", "value": "T12F363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140460, "uuid": "5b8d13d4-b0e5-4c44-8fac-daf382350e2a", "value": "98304:Ov4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXN:OvpvFa+g8RWLdPk/84tCEr0RtNiC5eS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140460, "uuid": "5936173c-03c4-4fc1-940d-8a31088fe8f9", "value": 4993536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140460, "uuid": "85669710-2882-4992-b625-ff129e554d7c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140460, "uuid": "1720e5bc-a6d9-44c7-9cc0-d782467c9326", "value": "5e52b1989c42e139ae017a8ff2d085d223933a164a58d96fedaba4bae76084a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef98b802-a108-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675129526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675129526, "uuid": "322234a9-0b28-449d-b2a9-70eb84e8a618", "comment": "Malware payload (Formbook)", "value": "ead9d5856a0907b1e5ba48d6a37d5afd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675129526, "uuid": "132959b2-1c1d-4dc9-a3d8-13471140df01", "comment": "Malware payload (Formbook)", "value": "62563b5858256c4048137b94b1f0f3a6abb1cef7e2f9afdf3e874d08ac3ab708", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675129526, "uuid": "9208d926-39cb-4307-a641-813ec084a5b6", "comment": "Malware payload (Formbook)", "value": "5ff60f733ff4438cf4a141d333ba2ab88fe397af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675129526, "uuid": "76b99339-2890-4f29-a7d5-25bbbf242ff4", "comment": "Malware payload (Formbook)", "value": "e10fa135c15ca8dc86c6b9d59097ff008aa6eef50e2959cfa5d9787bff2248b2b214ae43b1705171f95c1d3b5a6a81ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675129526, "uuid": "575cbcc6-c724-4fc8-b66b-ed0dad37e6f9", "value": "T1E315AEE1065DC7D5E8F60E380628391467A9AC97837DA17EBEC7147B84F674F40B83A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675129526, "uuid": "7d42005e-d73d-4b37-b4b7-70acf5cd40a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675129526, "uuid": "d05d99f0-341b-4d6f-a923-97fd39706426", "value": "24576:0XLepD6b3ewHdqo3CMq4kd8ABucv9OMj4yudPD:0XLNb/bCNdBlX4y4PD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675129526, "uuid": "3ebbd8e9-e8d5-405c-a6b6-46ad2ee08a3f", "value": 924160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675129526, "uuid": "3e5450dc-a501-4c48-8602-a291d1472915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675129526, "uuid": "d7c79e9a-bd22-48a1-8bd8-c257e953d70f", "value": "ead9d5856a0907b1e5ba48d6a37d5afd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc87ad0f-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140608, "uuid": "88ed167c-ab93-4728-8a54-8a747ebdc100", "comment": "Malware payload", "value": "57d283006e8c3c32d3023166da6d0862", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140608, "uuid": "bccc7c69-9dcd-4356-bb74-f9b652dfb4d4", "comment": "Malware payload", "value": "629cac83fc6f9e21d358ceade9955f0140f281fd6ffbd975b270fa7f5e294235", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140608, "uuid": "505a4ba8-95f9-47f9-9cce-2c7fcd1d4a12", "comment": "Malware payload", "value": "e9947c819cfb754cfeb8d8ad85ca0eaa9d235702", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140608, "uuid": "92358e3a-6e6d-4b55-b4ad-7434077f9ba8", "comment": "Malware payload", "value": "00037b00b10a729ecd2777f7e4498636aa280513982a4452757c720ca734fe6a5a69497d65db44403c592796030843cd", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140608, "uuid": "b975d542-4b20-480f-bba3-ca72ff6bdb8a", "value": "T1E7363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140608, "uuid": "d47da8a1-af99-4b9c-9ebc-9ab707afd1af", "value": "98304:Vv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXu:VvpvFa+g8RWLdPk/84tCEr0RtNiC5eS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140608, "uuid": "c563098e-a6f4-4bab-94f7-0387ead055ea", "value": 4993536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140608, "uuid": "42ef4321-2693-438e-a21a-dc4f8ad51e8f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140608, "uuid": "131c90fc-1b9c-466a-85ae-9879dd540f58", "value": "629cac83fc6f9e21d358ceade9955f0140f281fd6ffbd975b270fa7f5e294235", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7397d4c-a13e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675152678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152678, "uuid": "f495e3ec-4ecc-4846-bf44-0793245e4723", "comment": "Malware payload (Mirai)", "value": "23c1fd0c735c7ba91fea6264d64ea2fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152678, "uuid": "23e1ec70-7f3d-456c-a2df-771a8ec905c4", "comment": "Malware payload (Mirai)", "value": "64c0909c9ec8547928dc5484561fc1965b5e2d7b135272598cc76882947c381e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152678, "uuid": "9443e971-0d0c-47a7-86a7-41d5bcab8dad", "comment": "Malware payload (Mirai)", "value": "a4f023cd5469eba431d5acfd55fa303c7b9a431b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152678, "uuid": "684a3b24-fc42-4212-86e7-d18de9e53d92", "comment": "Malware payload (Mirai)", "value": "97fc87f6651792b64e83648cdf29aa679a5d942f0b213285f92fcd4ede6b09518fbc99f56a95629e956a494bfdb0b279", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152678, "uuid": "730e5ce4-7913-4613-897f-711578b914d9", "value": "T11AA2E019BE1C828BC832293944E9EAD61356FC71F2EDDC092940D16FF4B33A95874F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152678, "uuid": "73d01625-494c-45ee-bada-c664c40cd271", "value": "384:M0DLpj8s/qPui8uZxoIA57RWQjJiEVi+ZkXaqOKV14b+502F2vwA9dWuMW21bAK+:x98o08kxofBE+ZkXaqGbp2F2TWul0c53", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675152678, "uuid": "f44ea85f-0f41-40a5-b062-2fdfc0c2f387", "value": 21492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675152678, "uuid": "e4490bc2-3114-494c-ba4b-9a3c0d398fcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152678, "uuid": "ba342981-3eb8-421d-9d9a-4d14ac926d20", "value": "23c1fd0c735c7ba91fea6264d64ea2fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdbda344-a146-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675156179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675156179, "uuid": "e347c94a-36de-4be9-8c37-5017bf76a2f3", "comment": "Malware payload (Smoke Loader)", "value": "ef4734eb6342c1166b64c1597f8c1fed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675156179, "uuid": "c2d9987f-6b41-427b-975d-12852de9ad27", "comment": "Malware payload (Smoke Loader)", "value": "64cc720d6376d78a879d2903286a39b23fed46aff045741ed6bfbe838f6a7143", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675156179, "uuid": "027f02fd-8a8b-4330-9b88-d97d17fe97c6", "comment": "Malware payload (Smoke Loader)", "value": "598ad1a4ff2c5e4ed49e14ec89cfd871f9bb83ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675156179, "uuid": "bd75b620-bedf-40b5-a170-f9934cef1a85", "comment": "Malware payload (Smoke Loader)", "value": "03126429ee55261b7f4ac3a0114fe45e157679c55ac1db250193a827d72f589b18114345a8a6833cc6eb1ba9a1f20940", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675156179, "uuid": "b3148e56-30aa-4da1-961c-a310e6dc753f", "value": "T1C1548E02F2D1BC41F566C6768E2EC6E4F12EB591CE18B76523186A1F25B33B7C762311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675156179, "uuid": "20eb1ac1-30ef-4a74-9b8f-26db342d52b8", "value": "a2c8bd590ac12702f85d4107db46f8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675156179, "uuid": "44f017ab-988b-4fa8-96b8-487aabc1b008", "value": "3072:J7uYDQALDF7R4OK4qsizGICFHucyS157f43H7BFf4SFHHWtRCDF1:wCQALDcFBsmGIqU257f4V/nWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675156179, "uuid": "ba0a514f-e8bb-4aa6-b2f5-848010e65ff1", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675156179, "uuid": "7b18f99e-539a-4c66-bba4-078629cfc8db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675156179, "uuid": "cf4afdf5-3cf5-4d44-8d96-1678d927956a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c05bc6c6-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140614, "uuid": "c1508574-75ce-469a-b53d-a0dc38f7fd29", "comment": "Malware payload", "value": "579e6c2b370c8a61eb108a837082042e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140614, "uuid": "1d0530e2-6192-4b8e-8c1e-853da2e39209", "comment": "Malware payload", "value": "654a7b9e0381e9f114bf92f1d581b0843d66b0f85ad1b440081b1e3c9f07e71c", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140614, "uuid": "443feb57-a6ee-49e8-b2cb-08211bfa74b2", "comment": "Malware payload", "value": "d3397e67111bf7a3e65b8c48dbfc5fcbe80f1ecb", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140614, "uuid": "5d911cc3-c733-4a98-9ddd-97938a6d5e50", "comment": "Malware payload", "value": "4bf7164dd2c8e4eecb6401c9063bda8fb1a92ba4cb9a189c00cc997f290c4471fa8f1514e8afce96aeb18d72032d3491", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140614, "uuid": "e7d12c49-a70a-41ca-ab1e-a16e281be3bc", "value": "T122363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140614, "uuid": "a5aa7e96-5776-4f68-9609-c2615b04598f", "value": "98304:Ov4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXx:OvpvFa+g8RWLdPk/84tCEr0RtNiC5eSI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140614, "uuid": "a90bf36d-57df-458f-83cd-a732fa75f7c9", "value": 4993024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140614, "uuid": "7d2e576f-4486-43b2-b645-541bb12e33d3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140614, "uuid": "13fae8b9-b4ab-4c01-affb-5d8a06c50fa1", "value": "654a7b9e0381e9f114bf92f1d581b0843d66b0f85ad1b440081b1e3c9f07e71c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b023db6-a15b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675164818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675164818, "uuid": "6287306e-6db9-4750-ac4b-7a0ac5b1f920", "comment": "Malware payload (Smoke Loader)", "value": "a6b0512de00c810613c968a796751844", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675164818, "uuid": "2b8e8530-f790-48f9-8c9e-510e128f362b", "comment": "Malware payload (Smoke Loader)", "value": "659f7a8f3091b7efc414c9ce51dfb59fb6d85c2d14ea011b19226268ab766562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675164818, "uuid": "b36238b0-6630-4571-9ac0-e6f416d39d47", "comment": "Malware payload (Smoke Loader)", "value": "4d1af1863a384f8cdf47feb66ae040f596e9ca3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675164818, "uuid": "3d77b52c-3d84-45fa-9a8f-28dda478c53b", "comment": "Malware payload (Smoke Loader)", "value": "995188849cc3d1b2fc96220514656ff9ace54d053134e870d64393f3ddb1762d3e9577962b9af5707e53cd83c9ba37a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675164818, "uuid": "bc9ee4e0-9788-4157-b465-7c9fdf5f1da1", "value": "T128548E02B2E1BE41F5658A768E1EC6E4F51EB591CE18B7652318AF0F25B33B3C762311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675164818, "uuid": "00e05dde-4379-482c-9cea-370b7a9ec0e9", "value": "78339dc1c5de0e493ea2b28607ce356e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675164818, "uuid": "eb38dc78-a7ea-4e5a-9c66-272cd122a09f", "value": "3072:FBuOsunGLXrRouO2rl7U43I55AigxVQj+WD2Hv7f43H7BFrYJDUsRCqx:m/unGLXC5K7EnAT3Y+Pv7f4Ve68", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675164818, "uuid": "90c1f7a0-e353-4c6c-a4c6-e34aa29f24d5", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675164818, "uuid": "6edbdbeb-8678-43a6-a54c-2dccd3e73683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675164818, "uuid": "c9ac5d3c-5703-49ed-85fd-d90369b67448", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa7cbb1-a153-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675161658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161658, "uuid": "f5bc1483-b193-4e7e-a6cc-d105822a562d", "comment": "Malware payload (Mirai)", "value": "75622996c65bcf7fe069f4b2cea07b13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161658, "uuid": "061e6d1d-f36a-437b-8800-f1c7df5f0f18", "comment": "Malware payload (Mirai)", "value": "65cb3ae0ac1469aaeee666326a62fb0ed4fbea8acbb9c60b6b57c7d4d999f05f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161658, "uuid": "f0ae850c-1599-42b8-bbfa-11cc41f7e07a", "comment": "Malware payload (Mirai)", "value": "c6ae5d077c3c046eee837d65f867977023557003", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161658, "uuid": "f2415ca2-3996-4507-9238-2c0fd739fc3b", "comment": "Malware payload (Mirai)", "value": "d21e1becae9b5066b8ea081d5428db6242ec64e48642c870f86005333ad624d23755ee2e5d9c1684e2afaf66fe2af3fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161658, "uuid": "434aab0c-6444-4e7c-92ee-cb98533d2645", "value": "T1B9B3C60ABFA05EFBE46FCC3304B49B0525DDB91722B96B3A7630D61CB55A54B06E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161658, "uuid": "cc2e6b51-ab62-43d0-bcbd-8377af0b8e38", "value": "1536:N+U8VEPvQhJcLb1XXX2+NFbjYK4jFvnydoZKT6BrUMkW:N18ePI2XPspvnydohlkW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675161658, "uuid": "643c2c1e-ba7e-496b-9a28-c81ee371ce4d", "value": 117468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675161658, "uuid": "b5da5f9e-e3d6-402a-a9f9-c85e6d180c2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161658, "uuid": "cac508fa-65f3-4244-83a8-7011c5b89558", "value": "75622996c65bcf7fe069f4b2cea07b13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f2ffa10-a146-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675155967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155967, "uuid": "81c957be-dc10-415a-b324-58ae24233223", "comment": "Malware payload (Mirai)", "value": "a6633d7918f5c9e8c5b33bd524b87cb0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155967, "uuid": "260ee46e-e9fb-49aa-8bb4-c27bdf7b869c", "comment": "Malware payload (Mirai)", "value": "66c357728c91bb8c3ec24e7f1f8fa19ee6053c9c0c89b3528116eaab030d8702", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155967, "uuid": "45492c2c-7eaf-42d9-9c77-f0cf6204a02d", "comment": "Malware payload (Mirai)", "value": "f2094d39c15f5d2aadb8ad0e605419983f3ad645", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155967, "uuid": "add0df6f-c65f-4eae-98da-16fadf4c4127", "comment": "Malware payload (Mirai)", "value": "286ae1862871588ffb41fca4065f48ca6fb2eb00b423e3dbcf87bd5c174ae857d4df5f0c549b466215b0f8bfd08da78a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155967, "uuid": "909a2087-9899-493d-98f2-2ba082f2d0ee", "value": "T12CA3941E7E258FBCF799863547B78F21964837C627E1C141E15CEA015EB028E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155967, "uuid": "dffbe656-7da4-473f-9d2d-aad1fdc3eb82", "value": "1536:9Or+7Ob2jo+JLUExySNj0EY7ZPnpUkao2PqN7t7mQgW2fH6pjD0:8+O+JLv/jI7ZPnpPadqN7t7mLW2Hu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675155967, "uuid": "ebd7156b-c815-4fa6-aba7-075f9051ce81", "value": 101684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675155967, "uuid": "ee8a85a0-c0b4-4801-b6cd-e1e336b571e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155967, "uuid": "980326d4-c548-4294-9832-140c3e2f5da5", "value": "a6633d7918f5c9e8c5b33bd524b87cb0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52eacec-a12c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675144864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144864, "uuid": "c08e488d-a6c4-4f9f-b335-71e56c449637", "comment": "Malware payload (RedLineStealer)", "value": "029100b41e75f788e6b6c01441b692c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144864, "uuid": "fa4a01b8-f3b8-437e-ae13-76a36c5670cc", "comment": "Malware payload (RedLineStealer)", "value": "6722fb152614081939f525cd45c5f16a129e76dcbc88d644a857d4a4b01c7bcd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144864, "uuid": "3710e5c3-c9ad-4353-8470-ce282c74d9de", "comment": "Malware payload (RedLineStealer)", "value": "de7ccc22a64eabb3751bd21b79b4b54ce2fa49b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144864, "uuid": "ca9f180b-17ab-493c-86a7-26452b00ee5d", "comment": "Malware payload (RedLineStealer)", "value": "c8bbfb7ac793547292f16a62a122f275b61ad8ca82cdfa917b101e258218f4a624264adab54a721f1440b57eadd8ee21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144864, "uuid": "51865efa-8000-4754-a054-05534dbc16a8", "value": "T1E284B002F6D1BC01F96646758E1FC6E8F51EB5D2CE08A7252398AB1F25B31B2F762311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144864, "uuid": "e534d303-8d18-4b94-8671-532d93939f76", "value": "a2c8bd590ac12702f85d4107db46f8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144864, "uuid": "3fdde24a-4272-4d7c-9771-cfedcd069dd7", "value": "6144:jk9QLjmXqvq5sMTWN3Ufx/VueIfqE864+1m7f4V5T8:I6fbI4864+1mzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675144864, "uuid": "51e2d5a2-e383-4549-aa0e-726891636016", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675144864, "uuid": "114ebd74-23d0-4925-99bd-6fd840c96c33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144864, "uuid": "2e09e91e-30e1-43d4-b0b8-012b0b2cbf32", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb3d240a-a153-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675161651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161651, "uuid": "ebc1feb2-e7f7-4491-87a1-ce8d28d55f48", "comment": "Malware payload (Mirai)", "value": "ecc1f8305d7c126d4e417270f41f0b88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161651, "uuid": "f31d6582-662e-4d66-aec6-428e6bb4ab4e", "comment": "Malware payload (Mirai)", "value": "679192b329486b7f840c4804640ac68e292ae02b26c57499c206989011faa7a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161651, "uuid": "8bfe4b7f-24ae-436d-a1bb-4d9edc910684", "comment": "Malware payload (Mirai)", "value": "5de0957b95939463af0e0c21bbdd04f7429544d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161651, "uuid": "b18ddb8e-69b2-4838-a3de-dcaece25d5f2", "comment": "Malware payload (Mirai)", "value": "3ee2680ccafb76dcf51f9b6c7f5f6471dc69e934596e3564d67396b15065320a873931cbe02a7cafe18ea9bdbddf5976", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161651, "uuid": "c46de792-1022-49f9-ac71-6c50f1327bac", "value": "T172B3184AF9815B11D4D92ABEFA0E118D33135BA9E3EEB122DD244F2137CB65B0E77412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161651, "uuid": "961d766d-f6dc-4c19-8673-c599bc1ed9e3", "value": "3072:uAiKpKxKyK/KMP/gXq5a7J2bdcanM092eDsPbd0JyjJ:ukUs5SUI5d2hcanM092eoP0MJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675161651, "uuid": "c52f828d-d2ee-445d-9e0a-5aeb225678ff", "value": 108140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675161651, "uuid": "f2fc8784-9a3c-4ea4-84ea-ac51759362af", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161651, "uuid": "eee34c49-3fe5-4041-9146-975a9cad90c5", "value": "ecc1f8305d7c126d4e417270f41f0b88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fabfe1d9-a19e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675193970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675193970, "uuid": "b613c26e-0683-4b00-9f39-f8442090d7e3", "comment": "Malware payload", "value": "69101e26faea9e8412c011ab73da7e92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675193970, "uuid": "65f37ba3-cd6a-4b80-bc83-f1d6f24ad0a4", "comment": "Malware payload", "value": "67a7f99493b62e553232daac052b6382ddf57eb5661ee08ea0fa769d92ca6090", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675193970, "uuid": "550f96a3-eb7d-4123-aeae-5f4511e97216", "comment": "Malware payload", "value": "1e72408118f740c4dfaca4ba157bb07c55ad9b1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675193970, "uuid": "d8f6d355-3048-43d8-8124-766489e2c1e2", "comment": "Malware payload", "value": "6f64d8d4c79c56d128cddf4f10093c47b4bc1634992aab8e7ae2235cba1217be8f22797145e5ed89954f37184c536fe0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675193970, "uuid": "c89946b9-0195-4a0a-bf5b-497b6cf85368", "value": "T111F59D12E9809035F4A301F297BE1A7A5E7CBF31231054D7D3C8689C9B658E1BB36B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675193970, "uuid": "278e97fd-eee3-4597-ba51-66837a2cde7d", "value": "022b33510c2cc67820972fee66dd38d4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675193970, "uuid": "14ab5dbc-fc5f-45ca-8c1c-06de7296ee33", "value": "98304:AqNHddSy2xT3SJ0vsw4AHCJpV/82TJNK+gT9/69CzFc7P7CbM5zD6sILTjblMS0u:rjV/pNK+gMwz+i4osI3jhMSN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675193970, "uuid": "58bf427c-7078-4ab4-8f50-0adf14d6e71c", "value": 3640320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675193970, "uuid": "e7cc5a8c-b1ac-4dea-b77d-65f2c486f2bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675193970, "uuid": "fafd32fc-137e-461d-b793-3c4c958afaca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f28db76-a105-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675127942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675127942, "uuid": "4fd2eb60-35ee-48dd-aff1-4d48df237898", "comment": "Malware payload (Formbook)", "value": "8ba02b03bb01ec961fdb0b1a5dbd49f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675127942, "uuid": "60e22987-d6a4-4835-8da6-dc0e4641a9fe", "comment": "Malware payload (Formbook)", "value": "67cc4306421a289d79bfd855c3da5e7ccbfe55e8eef44fc6c48aea748848ea5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675127942, "uuid": "c0146d56-ff9a-4393-9837-56f38bc1713a", "comment": "Malware payload (Formbook)", "value": "0264ff8e36f69f5a78e417dfe38b48e68c99383b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675127942, "uuid": "c84b8ef3-1cd5-4fe3-b603-74be2ec545f7", "comment": "Malware payload (Formbook)", "value": "f89d69f21253143710f067d0fab240ce6b0a1425566b7b038f3e6814bcff553267245c682b647a48eeb2ccfcd5389b47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675127942, "uuid": "732302d1-b73f-4646-996c-7ecace8aeb66", "value": "T1E1E4019A832DCEABD66A43FF58B414442F71156BB112E71D0FAFE8D1C88F7004561EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675127942, "uuid": "ca988d57-cf16-47a0-adc1-18131ccf1848", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675127942, "uuid": "c906f6ea-dbce-430c-bf27-660b48a99e8a", "value": "12288:LZuOwJq+5HcYVvQ7A+gYAEBqDGY+UND4IjMxS02Weh3ih9H1A:8Ocllc9AXYRCND4IjMxS02BYTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675127942, "uuid": "13e9e88a-a87d-4d6a-82ab-217c9e4517c2", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675127942, "uuid": "17ee8e87-1bbe-46f9-9a0c-a104137aee3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675127942, "uuid": "8a2bfd4c-dc93-40c5-a342-38027181b9bf", "value": "8ba02b03bb01ec961fdb0b1a5dbd49f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbc02fcd-a195-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675189999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675189999, "uuid": "8b4b156c-b7ce-41a2-af0d-41474e3a4503", "comment": "Malware payload", "value": "6e5a788c4769930b873924f3ec758eb7", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675189999, "uuid": "6e139fb2-5a41-46eb-aa6f-f382825edb0c", "comment": "Malware payload", "value": "67cedcf3db2450ff9b924403912629c01eb69f4d4d9ba4b16a6ffcd80fb2ef0e", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675189999, "uuid": "bb84a430-07f6-46f1-91b4-9d6a552f732f", "comment": "Malware payload", "value": "fb12ff69d81b75634e8d16440e6e3a630bf4ccbb", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675189999, "uuid": "42263ef1-63e3-4088-a725-a939f8e4d3bf", "comment": "Malware payload", "value": "74c60d5ac740747c7bfd83d2a2475729a7eea75aa6323593d3100e558ac6ed916250fdb4860a8d592685289f2db8b326", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675189999, "uuid": "9383edec-d948-439e-8bfc-9afc288178f1", "value": "T1B165AFF875047DE62A7F576BCA96ACDD03B516229ACBA4CD8064BBC305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675189999, "uuid": "b92d484a-d2a5-4ff2-8128-5a41a80f8e23", "value": "24576:ouJ6FV2EU4kgskPFCMUC3aM/OmMkcN+7AUeRNP8DxnmPqKZnYGtbOcQmo5oCiDNW:Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675189999, "uuid": "31e4fcdb-655b-4a8b-9f19-59a1dc48c320", "value": 1472406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675189999, "uuid": "de658274-9fc1-4bd7-824a-8ba601a131bd", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675189999, "uuid": "917e4d84-b7bf-4506-82e3-879639eff49d", "value": "SecuriteInfo.com.Exploit.RTF-ObfsObjDat.Gen.20040.12636", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f53e94b-a1aa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675198970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198970, "uuid": "3eab77f1-bc7c-472e-a0f3-49efb7dff4d3", "comment": "Malware payload", "value": "a3564fea212fa82859288b782dd089dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198970, "uuid": "e81864aa-6c6b-4e80-912e-fb38bb5df8e3", "comment": "Malware payload", "value": "6821403fcde3b293dd94ee34dad97c79924727b18ca7e7de198ba381f16e3d95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198970, "uuid": "529b7dc1-2228-4ead-b70a-745c08104afd", "comment": "Malware payload", "value": "92a922d43e6b6f05063dde314d34065121cc6bd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198970, "uuid": "eceb4b30-f736-47fa-8154-3aea56c965e2", "comment": "Malware payload", "value": "0cc37d14b63fd120eea9c5d2c9809563759b379e8c8896edaf5db60dad4eadb45d32cac8e430c077a672813ee2b40321", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198970, "uuid": "55ddfbab-7de4-400e-b422-fc8935a38115", "value": "T11C84CFC2A6F16C62EB228A31DE1EC6F4751EB45A5F187776220B9BDF65B01E1C5E3300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198970, "uuid": "55c80362-8802-4454-ae60-bb61d26cecee", "value": "d84aba910fd98bff40c3867e1dd713e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198970, "uuid": "79d00cf0-347c-4694-80f0-23329e481c8c", "value": "6144:oZU6LnYmOz6ZLsF6jqKv8b91vIhSj9gmxWXnR3hA3O7mqMoIeXn8M:sRbHOhE+a8bzvy89JxUnR63OSqM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675198970, "uuid": "ba04553f-ec01-4513-8ab4-5c803db1448c", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675198970, "uuid": "da0fbb57-b5d0-4698-ad66-97341356904f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198970, "uuid": "bfe58e25-c103-441f-8881-2a68157c9fc5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3187e8c-a188-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675184374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675184374, "uuid": "2a37ed3e-e03f-4d52-a788-601465af8f67", "comment": "Malware payload (Smoke Loader)", "value": "3dfc35bc88b31d921255680def5cc345", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675184374, "uuid": "b354a61b-d45d-495e-b59e-08356c987f9d", "comment": "Malware payload (Smoke Loader)", "value": "6831b3e0a71212510c30f9bca48cc87ee83d88e327427d1475381eaa9c23415f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675184374, "uuid": "a68672fc-cb16-41af-b0ee-6de5ec788927", "comment": "Malware payload (Smoke Loader)", "value": "ef01eb8fb4fa5d08f681a3cf6e4a81a25e798ba4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675184374, "uuid": "8c38522a-1419-48da-b03b-6c78f415be6c", "comment": "Malware payload (Smoke Loader)", "value": "eb57bb67c4c9d9c11e57d1a0d36f80055a64fa49f4034717be1f65e498709d4bcef429f5229ae47e5d52e9e5deaadbc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675184374, "uuid": "bf1dd653-f141-4bb9-831e-554d8e4fffb4", "value": "T1A6548DC2B2B27C63E9228A719E1EC6F4751EF5524E097366221F7BDF25B01E1C1E3249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675184374, "uuid": "9834ad8b-39da-41bb-a6c9-233dc7c192aa", "value": "9c039baca0968dd2f90042d865dd6c2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675184374, "uuid": "c8ac3820-db0e-4e90-87db-018953bb9424", "value": "3072:T7uFlYRL9eRA3uxqrMoHlNprUbsOpS0NdN6BYsELY6TTimqPUx6WfQz86G3MMo:2FqRL9b3u6T+IKAmamqMoIl8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675184374, "uuid": "f5644c17-5e21-4391-aef3-f6b6d79ec34e", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675184374, "uuid": "bd7ac62c-a5b1-49b4-8283-70d66809f5d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675184374, "uuid": "898883de-c86a-4132-8b7b-a695e14c4e25", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b2f0d5-a124-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675141506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675141506, "uuid": "68236d9c-fc87-4d3c-bd24-cdabfedd01c3", "comment": "Malware payload (Smoke Loader)", "value": "dc3eeb24f9267b3459dc977fa76fa8db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675141506, "uuid": "57bde171-d20b-4792-b77b-deb8312fae6e", "comment": "Malware payload (Smoke Loader)", "value": "69420d1b4894f98cb680ce0281483c5f52b0b68a7fc221733e8bbf1ae631cc2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675141506, "uuid": "ccafdf7b-f590-4008-a302-be2f85ab95a8", "comment": "Malware payload (Smoke Loader)", "value": "21dd1f52b88000055382c5ecded4371ddf415fb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675141506, "uuid": "6a31f691-56a0-49d2-ba50-136603577973", "comment": "Malware payload (Smoke Loader)", "value": "cc32847de52d482fc9a83059614d9fe4184189a54579f5a9328a45bb564822a6888a7814e7ec2632fb1611ba2622d0b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675141506, "uuid": "c5e5c751-d57b-42c0-ae7b-709b0521c8e5", "value": "T112F3D020B980D033D05654711939C6A97A3EB9312E79A907BF441BEF4FB23D12F6A35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675141506, "uuid": "5a33f515-44c4-47c8-82d6-7de98c8b9f8e", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675141506, "uuid": "d556541c-717e-41a9-8196-4dee57e9fc02", "value": "3072:xj7SiSLH5j2Ie8U5JnIHNipFA+IYQgRzp4AJQv:YL4Ie84IH0pqDYQgRze4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675141506, "uuid": "88020181-0b55-4e1e-8a94-4d1debf112fd", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675141506, "uuid": "1ced5a33-2379-49c0-9e7c-acb9481c449d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675141506, "uuid": "ed1d3a4d-7bba-430f-907e-4c0dc0f33d44", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f2047f9-a17b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675178649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178649, "uuid": "21793f40-4e0d-42da-b23e-00f0149e7655", "comment": "Malware payload (AgentTesla)", "value": "b96328243464bf21604da5eee040851a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178649, "uuid": "8b7aef43-689d-4ede-926f-60a5707dcbde", "comment": "Malware payload (AgentTesla)", "value": "6948edba6f7b9c858039de147b963bfb584fa8d9f51494bf380e86f89c7cebbc", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178649, "uuid": "99784f51-77bd-433b-9135-a7f1faf58f77", "comment": "Malware payload (AgentTesla)", "value": "80d06f333ed8ddd4825a8d587dedbd16d45885b0", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178649, "uuid": "9b14870b-4c5a-4eab-892c-c9f40e0925a0", "comment": "Malware payload (AgentTesla)", "value": "2cb266ff1178a36570e383805c2b92d49d7cf0462badbba04c4acdfeb1ad3ab7b3e8d736aaa12ffd5f4a1c687352b118", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178649, "uuid": "9d3da8fe-a235-4add-8f64-8e425cffef52", "value": "T16A54233017A6531E70E9B42584FBEF8414BDB056B6D287734D578893AE858E123BF3AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178649, "uuid": "a3b3abab-54d2-4933-9528-7838dc5d4046", "value": "6144:w93JUYoy7ZpOnu++xJOUoBeZJDWFLMTUYzBA2U:w9yy7POFacevELMTUSe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675178649, "uuid": "9a6f6d9b-512b-46ec-a58c-0ac6b165edaf", "value": 294968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675178649, "uuid": "92a0eac3-bebf-4b1e-85d3-d13d7c6ca639", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178649, "uuid": "ecc96115-4d9a-46b5-8a9f-ed4cf56f53fa", "value": "Urgent Price request. P.O1672891.exe.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c06a172-a137-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675149331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149331, "uuid": "0151f94a-f4b9-4dff-9691-debad00fb168", "comment": "Malware payload (GCleaner)", "value": "9486942e7803130b1c185fc8f315e9fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149331, "uuid": "b3124c22-a72d-4933-9a2d-fcbd89158e04", "comment": "Malware payload (GCleaner)", "value": "6a0cbded329787dd348eabd86e2f9076ebb4432727ef5d32f0caafbc8d5a3ee5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149331, "uuid": "409814a0-6e0c-4a39-8099-a409407a718f", "comment": "Malware payload (GCleaner)", "value": "d12690f6cf1d6929632d47ef24e1046ef984daf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149331, "uuid": "e7a59e40-35f2-4564-8173-45115ece1583", "comment": "Malware payload (GCleaner)", "value": "df8ae3ecf98a7c77983b9043f0b57defc0ed508001a5a68cc949bb7c0a26186609bb9382677ea4171b96cab7c0d891c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149331, "uuid": "7c100f0c-cae5-40bd-b914-935d79b6a159", "value": "T18BB53342A9B58835C503C77525A2D051FCB5FAB11430B5EA716F330F2E3F6A8A471EBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149331, "uuid": "5c404026-a428-4713-a56c-32534156a37c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149331, "uuid": "96920b24-3729-4e36-8d03-9a18fcbc4902", "value": "49152:C20qrb82UupTEwWbOB91L8AbZbdrU0T1357oDWOBPAXP8V1SdzAp2DLCgv2MR:d0Xl/OBTooZ9UcPn+AHcov2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675149331, "uuid": "1ac4ba30-ce8b-4067-9af0-e735ce8d10da", "value": 2373575, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675149331, "uuid": "5a294f1e-b153-435a-9b55-2449d71cd246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149331, "uuid": "0369e080-3703-412c-b989-682117159a05", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f45fb1-a1a4-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675196517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675196517, "uuid": "2aa08302-017e-4a03-a618-e21e84dce9c9", "comment": "Malware payload (AgentTesla)", "value": "a884c1d58aac7ba80e3797e7b33106c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675196517, "uuid": "3258c0df-a8ef-47c8-9bb8-80d0c62edd94", "comment": "Malware payload (AgentTesla)", "value": "6ab0db83fb2cc559c25195cebe6e8cd7d8ad447f1bb67da47b0058c29860bb06", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675196517, "uuid": "550e6246-4bba-4d0e-b859-184f903d04ec", "comment": "Malware payload (AgentTesla)", "value": "8edf61f29db7e830f1cc1bf2e5698c9ff25ce626", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675196517, "uuid": "b5729152-0d34-4b5d-b317-f6869d74627f", "comment": "Malware payload (AgentTesla)", "value": "b6227c96abaa0f575509a25ee3de253cea75a07b19279066f3a7df74dd9eabc734ea705424aacb2dd3d5a6a86bd157ca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675196517, "uuid": "777df79a-8023-4372-b438-391be7503876", "value": "T1F8E412AE8378C8F9D694017725B424548F312AEEF4F6DB4C07AF6618C4CF3109A369E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675196517, "uuid": "e1af3743-9929-4369-ba7f-799bf619befb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675196517, "uuid": "dc43a65a-4b63-4508-85b2-adc48590ec14", "value": "12288:5huNJ0H5LlQ/CNkD3H5CuXqoSmC+q0taeWeh3ih9HfA:7EqhlQV3rPJqveBYT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675196517, "uuid": "3a62cef6-9384-48a5-ac51-08cb65f9e446", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675196517, "uuid": "271914ea-8392-4eb0-ae01-df43606cb28b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675196517, "uuid": "198a0dae-b702-4bde-b760-43a3ef93bccb", "value": "Required Order Rfq 028367881.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca4c983-a156-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675162808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162808, "uuid": "263f3b2e-fba5-4dba-a12f-cc15a1132783", "comment": "Malware payload (GCleaner)", "value": "1fc4547458f914ec748782ee8c15a8f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162808, "uuid": "22e4daba-bc04-4fab-b05c-a79bc24ed168", "comment": "Malware payload (GCleaner)", "value": "6ac1a5988a00875af0d65514f2b17d40b7c828cf8ccef1675fa8e6f59431ccc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162808, "uuid": "0c585c71-c241-4d5d-af7a-74ae9f38526d", "comment": "Malware payload (GCleaner)", "value": "ea1a4b01353260f8cf9f831bd7a1123e03c2d30f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162808, "uuid": "29d17337-1028-4f0a-932b-259c95eb7068", "comment": "Malware payload (GCleaner)", "value": "709a8d4d8c82beea378c9038b4aac16214da5aff88d18b5447a2b750f230873916571dfe1bba927f8cf57ace89dde7aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162808, "uuid": "41854a01-c452-4130-a3ec-a8fe087f0842", "value": "T139A5335614EECA36C2B636711D2251107D73FF8B6971960662BC70692F3B3A0AD063BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162808, "uuid": "15a2b73f-ff68-4e4d-9475-70599b58b741", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162808, "uuid": "8d8eb7d5-b8a9-41af-82d2-c47554bebab3", "value": "49152:C2iCaYwuziRwSaXH5LPRc3TIvsYTwgQIFP1Otxx7rtgKvjwgdlJLCgv2MR:dk5wBXpy81Uxx7hZdllv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675162808, "uuid": "8dd689d0-81f1-4ea3-bad7-6095c844bf09", "value": 2192517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675162808, "uuid": "06427a13-d8d9-41a1-baf0-48735d997b23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162808, "uuid": "72a5d9a0-26a6-45d8-aaf3-12420a2bf4b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cab9204b-a168-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675170696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170696, "uuid": "b5d76fc1-08d0-4a98-b3bd-dfae2099f0d6", "comment": "Malware payload (Formbook)", "value": "d352ea94e85aec707a6c269626943e29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170696, "uuid": "6f071a20-d06b-479f-9525-f313279b9d3b", "comment": "Malware payload (Formbook)", "value": "6bc6ca3dfc2f605544d24bd9b675fbf8b49a90c591b3892b438ef494bb5f6cb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170696, "uuid": "1701fa2e-aba6-45d2-be7d-0ca1f12c7f28", "comment": "Malware payload (Formbook)", "value": "edd676e4f60d8f0190162c8f092983c6af84b49b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170696, "uuid": "d8b9860f-421f-4dae-a988-ecea8bb95c34", "comment": "Malware payload (Formbook)", "value": "8cfff97df246e5fc9f200381b89e16cfc133857fd2d8f5a52e1ad29e2cc16bbc38fa8000bbd703c6ae6ab586728e294b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170696, "uuid": "446e53b7-7c45-40f6-b90f-2c73db96b4f1", "value": "T14D74DFC6FE40D4A5EC2A87311A3ADE715A537C3D91B4251C3BCE3E6B3EBB052942A513", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170696, "uuid": "6bdb76d1-77d8-45c1-a5aa-7655e492ef1f", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170696, "uuid": "ab39dd92-22bc-49ba-9011-db29976c72d3", "value": "6144:zYa6SIuubU9cdy9XqFFKt089uc/Ak+Dw989uwmdckP2r7kIrY28Ij2s6Y:zY1uubZw1qF1c/+kjdfPY7kIrY42s/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675170696, "uuid": "b2651fe8-b7a0-4130-821b-ff13fbd8d70e", "value": 356654, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675170696, "uuid": "f064ede6-37eb-426c-9c79-dc86979c4d46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170696, "uuid": "ae2d511e-d713-4e3a-b89e-119803913008", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5a39c58-a163-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675168567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675168567, "uuid": "ae351554-c3a6-42a6-a559-84556c1434e3", "comment": "Malware payload (SnakeKeylogger)", "value": "1093a416ea98e74b08ed2bdb7dde7f44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675168567, "uuid": "08e547d5-46a6-49b7-af5a-25392206084f", "comment": "Malware payload (SnakeKeylogger)", "value": "6c267c695c79b58e8aad70a3b64c8c725e94a7e9dc531d6ee1d9bbe5a3e945b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675168567, "uuid": "8b6716d3-e869-4f06-983b-aa7eb79d1ae2", "comment": "Malware payload (SnakeKeylogger)", "value": "e52e19fc8e2d65bca9d595b877ceabd6d494f9e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675168567, "uuid": "5b0611be-b13d-4130-a924-40b4acb1d3ac", "comment": "Malware payload (SnakeKeylogger)", "value": "36824bdc36e0642b317a3004554c3b3f6b1acbdd943145b62a9581fb6b56f2fa9b627c571a1d8064d4c497058bade7df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675168567, "uuid": "32231724-55eb-4c37-9aa0-7a65b391226c", "value": "T1AD15F800B3EDE16BF1723AFD9FEAD579C5AAB6F91A13D21F1254010746A6D841F222F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675168567, "uuid": "2ff4e836-937a-4cb6-95c1-6597e3371852", "value": "49be0836dac021f86af2cb207b4613c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675168567, "uuid": "6acf1d31-56f6-46a3-a00d-9452a005b244", "value": "12288:w1Wl8TpCMxskWv65fPqFoBkgheGH3AjbcdP/QiKe9wrEP0rpQHlZ:wAGn0y8yBkgIm3iQ9PX8Wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675168567, "uuid": "1d2af659-2110-44b4-ac31-51f566a69530", "value": 898457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675168567, "uuid": "2190d6c8-c011-4645-bed0-a434fd740949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675168567, "uuid": "65022709-f892-4880-8621-53c9615c1678", "value": "SecuriteInfo.com.Trojan.GenericKD.37340827.15726.2348", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44899df-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140621, "uuid": "29c3942d-f500-475f-9e43-38da047e1eda", "comment": "Malware payload", "value": "7ad6c0f04bac7dda6d8bcc10b39d53c6", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140621, "uuid": "ee1da5f1-4dd4-4d26-b862-4675d8316f87", "comment": "Malware payload", "value": "6cac434d2ac88d5e83eccb987d052e93ebd77b7c0b84c704bd0855be4bafcd0d", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140621, "uuid": "58fd0259-c082-49ea-b9a7-6788125e3c82", "comment": "Malware payload", "value": "414af141fd2bee4f71e0992a01d840a169aec040", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140621, "uuid": "38da7939-25b2-426d-b4a5-427b0c613caf", "comment": "Malware payload", "value": "37144fc93439bf7540a08a042a1d91e513210ea62620c1313903340a3099c2db75d18f7e057091b9bd87eb80c5d27eec", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140621, "uuid": "45f09bac-3156-46f0-a838-62b6bd2c3eab", "value": "T168363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140621, "uuid": "4cc9e7b4-87de-422c-aeb9-ec66b90266a6", "value": "98304:Ov4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXd:OvpvFa+g8RWLdPk/84tCEr0RtNiC5eSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140621, "uuid": "7df56d52-65d6-4cba-8d76-8d390c829ebb", "value": 4993536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140621, "uuid": "bb17cd91-0fc7-4e7b-97dc-407a790745f0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140621, "uuid": "15c27031-aa29-490f-9712-1cacd225e7a2", "value": "6cac434d2ac88d5e83eccb987d052e93ebd77b7c0b84c704bd0855be4bafcd0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f79b9d17-a17f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675180650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675180650, "uuid": "7946af09-bbb0-4d46-a8e6-28f3070d35f8", "comment": "Malware payload (AgentTesla)", "value": "0d2012d1dfe9462c19a0f9a20dd6019f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675180650, "uuid": "84f66659-f9ce-4f1d-a27b-6d2f15cd55d8", "comment": "Malware payload (AgentTesla)", "value": "6cb5dd0bf129fd5152f417722f1d1bf6150e539983a9bdb336cb6e27841f0887", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675180650, "uuid": "305ed2ac-b46c-4219-a4fa-76c5a6f6ca45", "comment": "Malware payload (AgentTesla)", "value": "1a3cbdef94e05026df59162ed211a0574c45556a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675180650, "uuid": "064d253e-3a8f-40b5-af20-9787ceef8e20", "comment": "Malware payload (AgentTesla)", "value": "5271f2874d3b2fa7a0555aa0e8e1d60620f150b3596a3cfdd39483bf3e55c7c76b9e50129f5e0a5e712c30559c67ac1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675180650, "uuid": "96c1e64b-628b-464c-bdb7-d3fa0fa731ef", "value": "T13F64120851A0C47FE4635E312DB127A3ADF2582229989B4F5B815F1E7E33F53992F392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675180650, "uuid": "e265c756-2268-4d0f-9327-a40ee8ee6d89", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675180650, "uuid": "f9350cb1-860f-4b37-a974-c774a611c864", "value": "6144:/Ya68d4aiwy7JN+ZWaeJX3DUmxs5wbqfcw4/vQ5yjMd77bfIJfXlSCxO/4CcwRc+:/Yyd4aFy1X3D325kqN4XQAjMBbiflOQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675180650, "uuid": "e7916492-c05a-49f7-beb3-8cb599533500", "value": 327360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675180650, "uuid": "7e75e871-2710-4741-9483-60d7fe7214a9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675180650, "uuid": "50a61f86-782e-4111-9f3f-855f7ad7ef3e", "value": "P.O.6652023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9711dff6-a107-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675128948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675128948, "uuid": "bd3b7fb1-d260-416c-bb28-9781cf350bd0", "comment": "Malware payload (Smoke Loader)", "value": "f8fb7c73eba308a8afded08adb534334", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675128948, "uuid": "a84768b4-c0c2-45d5-85a4-2dc49ca2983b", "comment": "Malware payload (Smoke Loader)", "value": "6ce28fbb272aa517eff98a5d9ae6a1d761aad01e06bea056df2036076b53fcfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675128948, "uuid": "895d06ce-a27e-4993-ace4-6fc236b1a9a5", "comment": "Malware payload (Smoke Loader)", "value": "b73f584313353e2accdbd94ab11fac85d74cf294", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675128948, "uuid": "95f7356a-e7f0-402d-b84c-b87fbc367ee8", "comment": "Malware payload (Smoke Loader)", "value": "349a63c071b66736b7b7ec58c95d06753fb6be0052d95b0770d45198e392b0317612a9c217a0420db2db70db82c40914", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675128948, "uuid": "c950dfd9-3bb9-4d40-9fbb-ffc530eb6793", "value": "T16F04D025BA4CD0F3C019547C4464D284BB6BBD312EB9D8477F8527AF5FA22E0236A35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675128948, "uuid": "433db5fd-705e-4652-86a8-fa6275252058", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675128948, "uuid": "88387bbf-d442-4733-bc62-590990acef50", "value": "3072:djkd08LdAsOBKcr5hV1awI16twb2wil6OTeUI5Z5QyGf:gLiKctYUSri0i1uH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675128948, "uuid": "1fd2db14-bbfb-4364-b60a-e5b1af1de47b", "value": 173056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675128948, "uuid": "239a0893-45cc-49c4-af36-69d7b7dab68c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675128948, "uuid": "9b48b04b-86bb-4c81-b1aa-236dd4fd8058", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df65fc2-a148-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675156663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675156663, "uuid": "96136c86-6896-4eae-ab3b-9231379c3241", "comment": "Malware payload (AgentTesla)", "value": "f47104a71fd6194240dbe0d5a1561349", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675156663, "uuid": "badecb6d-5e66-4780-99bd-3131d069e164", "comment": "Malware payload (AgentTesla)", "value": "6e7dc162617db3cf1c783aac63379eadd462b1e19139b6dca2bb62eebe807d31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675156663, "uuid": "c8cd3e76-7c24-43e6-845c-90a4219e5ca0", "comment": "Malware payload (AgentTesla)", "value": "eb9ef791259646e8e48f40a83172c6bc86ce6bd0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675156663, "uuid": "7d819fe4-bb6b-487b-90bd-e3f7ff822c28", "comment": "Malware payload (AgentTesla)", "value": "e7c582fa3abb6c2d8f34a38775a4698854218219f8c2cb438b9917cbaa2daf0fae2be11583bd4542e4fee8ab7106e174", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675156663, "uuid": "dd0b9f4e-be1f-48b5-9f66-bdf7169dcc64", "value": "T10F64239B78F3704813966F3174F322990A28FDD7360208B87593B62DE659C776F832A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675156663, "uuid": "ad57bde0-bddd-4cc6-8a9e-d280b9aa3e1c", "value": "6144:UStfIyp6GUOeyhwr2RrPlbhTBNSU/41StdIrdng2U:dtfiG44M2R7HBNS/jrJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675156663, "uuid": "b9ebcf0b-7704-45ac-94c4-43ba89340576", "value": 311149, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675156663, "uuid": "d86ceec0-16cc-4668-b001-38759a1cfc69", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675156663, "uuid": "b6f6341b-b824-4193-b238-aa31f18befc3", "value": "PROFORMA INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669f8bc0-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140464, "uuid": "afaf97eb-406a-45fc-8088-f0d7386da519", "comment": "Malware payload", "value": "9e7b499e0640bc974647171128afdc38", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140464, "uuid": "c0144f69-b5a6-42a5-a6d9-a05483473462", "comment": "Malware payload", "value": "6e841c609fa4d228509ca25c2432017e54e85220f4b02900a2cc02456a6bd20b", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140464, "uuid": "45e21fa0-26b6-4958-9028-6415d86d2a18", "comment": "Malware payload", "value": "8ee711a404a70e1568931a6603d82a484094d228", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140464, "uuid": "53b98083-7234-42c4-a47b-dd7dbf37532f", "comment": "Malware payload", "value": "c4e0dcd6e0f413ce68b4b96e17bbd581e4a0669c2dda6a627c405d4e2c5c0860416d40d4db39b90b4408172c1e442d1e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140464, "uuid": "c5eb3158-0105-4752-a55e-8d8fecfda893", "value": "T129363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140464, "uuid": "c038ad12-1670-4006-b6b7-0b12098e6ce8", "value": "98304:Vv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXX5:VvpvFa+g8RWLdPk/84tCEr0RtNiC5eSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140464, "uuid": "413bc549-711e-4a44-9c34-e5414535eb4d", "value": 4992512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140464, "uuid": "fcb80aa4-436e-4684-9143-d9290eead232", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140464, "uuid": "27ceb9e2-a277-4c90-9854-8f3a6834c9a6", "value": "6e841c609fa4d228509ca25c2432017e54e85220f4b02900a2cc02456a6bd20b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059be814-a1ae-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675200430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675200430, "uuid": "6166484a-54ed-406e-86ee-06269129345a", "comment": "Malware payload", "value": "1efeca7b3cc85f2da37969f3f2fbe63f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675200430, "uuid": "e13161ba-637b-41c4-9bbd-b1b1b0905929", "comment": "Malware payload", "value": "6f040e524c1649738d26b07f9ba50970bc8274a4f7d2b3c8567781f7e6e9f43f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675200430, "uuid": "d61ea1c1-a3e2-4b19-b5d4-3cea74578be2", "comment": "Malware payload", "value": "e7c4b4c4f96bbb5c3a47fabd21242c37b1116442", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675200430, "uuid": "a3464e17-a25a-459c-9360-83c27add15a2", "comment": "Malware payload", "value": "edff7abe3e28e2436b381e346f4f68511f1b18e35efac6873530575c0736b06e00f7117228a0a3e7c65cc20a8c048e86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675200430, "uuid": "590fa1f2-53f1-4902-8523-2e1235d2efbb", "value": "T1CA549EC272F27C62E9268B718E1FC6F9761EF5424E087766121B9BDF35B01E1C1A3A41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675200430, "uuid": "9dea9486-2720-4d9a-ad82-e7f2191dd60e", "value": "d84aba910fd98bff40c3867e1dd713e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675200430, "uuid": "c8e27b06-4fa6-4de3-83e6-151b53102025", "value": "6144:V5zcL/2PwFD9+yJYS+oaY1imqMoIeO8M:bgTZDUUSXY1NqMMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675200430, "uuid": "b311a594-8516-4703-a1b7-2bb99c734677", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675200430, "uuid": "39153fd6-7aa3-4c64-ab29-edd1233161c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675200430, "uuid": "2827593e-00a4-4128-977f-6fd170ee34e5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b46faa0-a19a-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675191930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675191930, "uuid": "c9d54f29-c323-49fc-9384-bb7cbd10266d", "comment": "Malware payload", "value": "68513340c8b997a6e15d2f911315b49c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675191930, "uuid": "d02937ea-8775-4338-9600-7989581ff180", "comment": "Malware payload", "value": "711ac72e97e57d92f4dd8f366c1910447af2096e9ec20319c8fe99b81eb34dac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675191930, "uuid": "58b2e6c8-f44f-4e99-861c-4bb82e36adbf", "comment": "Malware payload", "value": "518861c3379dfa9abb217175579b8d61a04a9f61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675191930, "uuid": "1fe2f7b6-9fe3-4ad2-96e5-4f789b375fb3", "comment": "Malware payload", "value": "bd5e9168cb344c6551187371de6d66aa44b2751bdfefeaa4bea1b6231d404b775e313e382535bf8f1394e7f7a570c3a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675191930, "uuid": "ce8a27b6-5c2c-4c63-9aa1-d2ee9c5d0887", "value": "T11C548DC272B2BC62E9268A729E1EC6F4751EF5434E187367221B9BDF15B01F1C3A3251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675191930, "uuid": "a189530b-c12c-4bdb-b497-3a866f3be9d6", "value": "9c039baca0968dd2f90042d865dd6c2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675191930, "uuid": "c0431fef-1b12-4866-b401-65ad87617cf9", "value": "3072:GmuBa/LSMRAR5yONrJrtrfVgKx8emqPUx6WfQz86RAl133MMo:uBa/LSRRUOLRrtgkmqMoIe08M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675191930, "uuid": "7ede2da7-17a9-4046-b8f1-9d1ad96a2b1c", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675191930, "uuid": "24705d3c-98b2-4a6f-a0df-52c2d60ff5d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675191930, "uuid": "fe5a9cb6-6ec5-4588-bc40-09c1e744fb33", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a255a75-a193-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675188922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188922, "uuid": "82dd219a-50e2-4d18-8087-0224cd311df8", "comment": "Malware payload", "value": "e65ef80a128d6475f1d74337ca57a0a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188922, "uuid": "e5865b74-caea-4c59-b277-d0de1edec5a8", "comment": "Malware payload", "value": "71c5aa0d92cf3b525dd1a921be51a5b860456579db4145bb62166c513db5a5d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188922, "uuid": "6533b411-20b3-42a3-ac4c-e9a86a7b95b1", "comment": "Malware payload", "value": "632024b57e9c0c170a3e874bf15f37c0a3fa2f70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188922, "uuid": "4ed413e4-190b-47c3-86a4-5e9065c6b9a4", "comment": "Malware payload", "value": "7fb3301345d904d852b4e9a84ba96d44ad7d1e78da0a9cf5d0a8191088ec4f42282ad28e624d7bd00a6f4c83e7dc4b89", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188922, "uuid": "337c2562-4538-4d6a-8efe-48b51450e205", "value": "T168A53313D0E24837C6E78B7266328652E7B1FF5990B1526B324E382F6E3B1E1547627C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188922, "uuid": "c2840191-136c-48ba-bd5d-d8435b5fe98f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188922, "uuid": "2294cb88-72c9-4c21-a3c3-3c52eb63fc5b", "value": "49152:C2VkrGSCjiaGf7A4szoIdx3J4/hhbDKHC5R0LCgv2MR:dVkrGHOaN4szDDZCFFsv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675188922, "uuid": "2a46746a-635c-4649-ad68-fae04811c764", "value": 2179294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675188922, "uuid": "901cc077-2919-4bc0-bad2-6695cd7d1c20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188922, "uuid": "3dd1e8df-46f4-4d8f-8712-15d223d7e608", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad642e5-a13e-11ed-88f6-42010a9c006e", "comment": "Malware payload (PureCrypter)", "timestamp": 1675152443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152443, "uuid": "8a028907-44c6-4f7d-9db0-e1bc7210a408", "comment": "Malware payload (PureCrypter)", "value": "12f82bd59a4b2273510a7a2c01b82f6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152443, "uuid": "2376c850-6f68-44b5-9213-3c30fc8b5b83", "comment": "Malware payload (PureCrypter)", "value": "7200e2fdf4dc5ccbdf12e1cdd109d878f0e0909f3530769376c7f154385633d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152443, "uuid": "443adf44-ec74-4175-91e8-70023deab23f", "comment": "Malware payload (PureCrypter)", "value": "be9c13bf17fe304597729fc71f3eafff02e02a44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152443, "uuid": "44e35641-76b6-4991-9261-6d1e99999faf", "comment": "Malware payload (PureCrypter)", "value": "5a4e6641271837d6d330381fe5036560be3eada5e9c4fa5f407810eafd21fee48dc6a59111830d3203b5e79d9c318470", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "purecrypter", "colour": "#93448F", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152443, "uuid": "835fb1cb-55b8-41f9-ad99-2258cac927cf", "value": "T1E076E0D7F6EC5455F0A655FFAC80231490EBACDDECA75213B34DB5BC24882E138A0B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152443, "uuid": "f3b09225-8124-4159-b8df-62c5fda1b0f0", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152443, "uuid": "f2a9e772-a860-41c9-a127-01247f3536db", "value": "98304:os1DgtKt0M154pX1M0gF9OtfXJroEBV5FL0BsS4HJG+V5Os+vE9zK2SCmBh:gk54fmotPxoI++nOv8ICmBh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675152443, "uuid": "8d73129b-1b34-4505-826f-eb089cd1d000", "value": 7536128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675152443, "uuid": "992db0d3-041b-4e4d-bf38-85b68245e613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152443, "uuid": "119fce7f-99a2-4d66-bfa3-95e939e4bfa0", "value": "12f82bd59a4b2273510a7a2c01b82f6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa8b3015-a153-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675161623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161623, "uuid": "7b870c4e-5922-4ad1-8ce2-9d68964d54cb", "comment": "Malware payload (Mirai)", "value": "3869b9faf5c7742cf7c6fc3e1fa87b0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161623, "uuid": "193b087e-df7f-4db0-af9a-aea49966888a", "comment": "Malware payload (Mirai)", "value": "727fab6097653eb2f15fa2e265147c3888a36fdfc8f21a6756ed5c4f2267a9d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161623, "uuid": "f28dc912-63dd-47d1-967b-0e302e7c3e9c", "comment": "Malware payload (Mirai)", "value": "10c3ce6d56ccdc32d4423ca145825d923f3c9b6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161623, "uuid": "befa3cab-89d8-4168-8d8e-70ad1448dc00", "comment": "Malware payload (Mirai)", "value": "882f5053dca202ded0245d5fb575ac9202fa6746a1287f84eeacf9b5cdad7c0b1e8aa5db79d3ba85d10ce710d884019b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161623, "uuid": "e6cd2879-3e5c-43ad-a50e-b6ed0f6f9c43", "value": "T16AB3960A3E119FBEFBAD83340BB7CE255699329637E0C545E15CDB081E6024E685FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161623, "uuid": "37c0e8e0-15bc-4307-8b21-b73b86837770", "value": "1536:IRzVd+m/iaRaaa4Uy7rm8h7sf/cV91RimmwZ8G8UnfDaVP07BeF2Pfolo:r47dVsfkX1lRZXnfDah07BPf5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675161623, "uuid": "f5081f2a-581b-4578-b303-20f73ab98a54", "value": 113372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675161623, "uuid": "d5e446ff-7b81-4dd0-b554-7753a40bee8e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161623, "uuid": "77756002-0388-456a-8af9-ef39c425ca45", "value": "3869b9faf5c7742cf7c6fc3e1fa87b0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c047f80-a151-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675160713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160713, "uuid": "00ce7fc2-7640-4e53-8eea-50d5578f09e9", "comment": "Malware payload (Mirai)", "value": "3e52ea470e320432f94a8f811068a8c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160713, "uuid": "4216d11e-a7e1-4d95-bd70-fcb1b268ce66", "comment": "Malware payload (Mirai)", "value": "729a7ddb898d60056a88eb12e1923ec42400ca17b150401430e9d3c7b60a112b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160713, "uuid": "3fc041b6-58c0-4391-9c11-2ff5de091a31", "comment": "Malware payload (Mirai)", "value": "dc870c588780fdc06a122b7f38ad97ac8b13428c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160713, "uuid": "68b4fe0a-8534-4682-82ed-f6121e9f5a5d", "comment": "Malware payload (Mirai)", "value": "ddd253f3186da701fb3f8b315c839c16a3d6a4c122a9e3b4ea6b279d0687ee5bd27abee9cbc761b3cff2aa9050d43ba9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160713, "uuid": "d2281c55-db93-4b60-a4f1-39151b4fcd04", "value": "T11293195AF9819B11C4C91A7EF90E218D331357B9D2DE7223DE245B217BCB16B0E6B422", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160713, "uuid": "fc65e163-4cbc-437a-91b3-3eba01c7cb69", "value": "1536:lcnQnnOWPKSKrKeKVK3LgSZS4X7N4zFMFlav5scpIaiC+jMmAr/C5qYBx:XnOyKSKrKeKVK3LgoS4rNYslaF+jMmAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675160713, "uuid": "efec00e1-5d5e-4b66-be57-6effb3b15b2f", "value": 95788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675160713, "uuid": "ea9f4a69-e212-4fd3-b5d8-c1cc5ec0a05b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160713, "uuid": "bf5c5d84-40cf-4dde-9670-618fd6971533", "value": "3e52ea470e320432f94a8f811068a8c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83193301-a13c-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1675151678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151678, "uuid": "09ed8511-2c1a-428c-a5d7-826760786f61", "comment": "Malware payload (DarkCloud)", "value": "c6753752404e6edef62db0ebfd3166f3", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151678, "uuid": "03197430-92e9-4a3b-b64f-d95234fdc34c", "comment": "Malware payload (DarkCloud)", "value": "73ecfd9ab9dceda5fbf6baac647e3d2811e52b406f1d33985ae00ea97d75591c", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151678, "uuid": "dca7b94f-09a3-42ff-9a0b-6f9a4c8786ff", "comment": "Malware payload (DarkCloud)", "value": "aea5b391f0e8e0d95a08524453943fc54fa792f3", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151678, "uuid": "631addf0-08ef-449d-af15-8d1445ecf7fe", "comment": "Malware payload (DarkCloud)", "value": "3c63fcad9bea7e3b612bb35940dae0542d4e29ab60d4a5ad0041716937b79e13fcf31aa896cc84033ca3b3fe9d883318", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151678, "uuid": "ff25a809-4f65-417d-8b2b-b6477077f515", "value": "T1770523347616F00C55F3D7B52C0E24EC6602E1F7A532A9E9C94EB1FA11D46FC8AD263A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151678, "uuid": "a10156b0-6bb2-43e6-93cd-74b3f43311c4", "value": "12288:rplsH4iWrHeviaI+5x98jQnxznAbQPxIYvfQrghT6s20XV44BNkQ0XPxrTyi96h:rbe4iWrd+ppxzAkOkH2QawAPNP96h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675151678, "uuid": "5bb5f8e5-11ea-42ae-af4c-280d36be3b71", "value": 828696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675151678, "uuid": "cc0ba407-2b05-4fd9-9cb5-8e1ef2648392", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151678, "uuid": "ab4e2d1b-d4f4-436d-a031-4998260cf80e", "value": "payment advice copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66daa98a-a174-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675175683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675175683, "uuid": "947175c5-bc26-4d70-ac5e-c07267ad337e", "comment": "Malware payload (AgentTesla)", "value": "f055eed37cfc5e0280520f1d46050400", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675175683, "uuid": "13d81045-bfe4-4dca-8021-6097c2490b58", "comment": "Malware payload (AgentTesla)", "value": "73f8f4b1fab2eeb0135f6207c88a0d5f7f8a5390ddd3f30403b7431ada2be289", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675175683, "uuid": "3eb56636-28c1-494e-ab6d-ffa01b291c60", "comment": "Malware payload (AgentTesla)", "value": "97a770a44b477cc3def188a3a7b7dbb58d75c0e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675175683, "uuid": "d2d30057-8cce-40ca-851f-c8300a46cefb", "comment": "Malware payload (AgentTesla)", "value": "18997605cc89452449f5a06ea61c3859563abebc2d7b436107d17d042eb8ab1982c6106310d9461b0507ada57c35b40e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675175683, "uuid": "8e211fed-f611-4c6b-b457-3635686baeea", "value": "T116F3066892B88E71F3DD407DC4AC311406F2A1465E17E7DD1EA1A8F63F06783762E8E6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675175683, "uuid": "f7bd04c1-26a2-41d9-b9ac-6d70f4887337", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675175683, "uuid": "51cca8eb-f9b3-4fe2-825e-acde0ab2ff79", "value": "3072:iFgNR++gYRnis+XMK64ksvsJh94liUQ7hfbsrRijOd3j:iFeX1b2E1UQ7hfbmsSx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675175683, "uuid": "35d82e13-67be-4936-8094-e62c0ba48a03", "value": 171008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675175683, "uuid": "21b584b3-e2b9-46e1-8f77-399e67625fcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675175683, "uuid": "cb7162f3-ac4d-492a-be3d-0443b56790ed", "value": "Purchase Order with Best Price.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b766fcf5-a0fe-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675125137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675125137, "uuid": "5093e634-092a-4758-9b57-5f1cfef05b19", "comment": "Malware payload (Smoke Loader)", "value": "217d5b6f6b7d1559394d4b9351381b21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675125137, "uuid": "6500e90d-9580-4b7d-b5b3-01ce3a56ad36", "comment": "Malware payload (Smoke Loader)", "value": "740eaa3be698a95da05243e3a2f3849afa1c1c8c7d5bc0a247d36ab56a9d2402", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675125137, "uuid": "88f38f11-c602-49f4-95e7-be43e462fdff", "comment": "Malware payload (Smoke Loader)", "value": "8199f888e3184b92385e7d1175bf1b0da67f1785", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675125137, "uuid": "ca8e8d50-a3b4-4229-9b70-f64c3442ae3e", "comment": "Malware payload (Smoke Loader)", "value": "b8708438ad5b9e119ba6b5c28bb094b69c2c4e1c0a8fe8c91f96fcb3f67bc427ccf3b9bbeaaa3cbeb41d8b36ec49827c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675125137, "uuid": "5e8772e1-dd58-40ee-8de2-6d0c6941b05c", "value": "T132F3E021B880F732C45664BA2576D2903BD9B9310A75A9477F802BFE4F722D2732E347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675125137, "uuid": "c4cd509d-3289-405d-95fa-41fe8554c4dc", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675125137, "uuid": "9f5f0fa7-a35f-49ee-a945-ae34a6087b44", "value": "3072:bjr6PeLASGuB5HSLdY7Gx8BZzcuir6sNAt+C9DP22wW:dLJGuWLuK8vzcuir6sNsn7w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675125137, "uuid": "d11855c5-0670-4d9e-b5ae-edee1bcedaa6", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675125137, "uuid": "7745e1a0-e8a0-41cf-a8f4-8ef17034778f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675125137, "uuid": "945bccac-81ca-4a87-b634-73f02e6e3a60", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fee5b0c-a171-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675174490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174490, "uuid": "1b13341e-9fbe-4cb1-bb58-1d1dd36af6a4", "comment": "Malware payload", "value": "1ebd1498b6b6f12b5e355ed8acd6eb40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174490, "uuid": "dcf90285-7447-4c35-b923-acb8cb9f0f28", "comment": "Malware payload", "value": "74604aa22e852d29abcf47bce7d558afff4ba1fda17334b5d44629a350c12da2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174490, "uuid": "b9b03a38-a10a-455b-ba47-f1de00f5a345", "comment": "Malware payload", "value": "67e5be34defd745f91abc8c1910b89eb15ba8384", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174490, "uuid": "b29a2a68-31f4-4458-b421-36152e2996ac", "comment": "Malware payload", "value": "213b75a6ea8732c7d52096b77f347aadddfb06fe87d9784a2c8f3b0cdc7244bd01a6a77d3ab76db98687bf9c03f2dd92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174490, "uuid": "ced34fd5-5f24-4cad-9609-b56a4206b311", "value": "T10DE41254B6BC2BA2EA7E87FD9164B80107F07C67A413E3260EE670DF6631B425270E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174490, "uuid": "60d0d244-6855-4424-9092-fe3370fefc01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174490, "uuid": "d5a2e024-6055-481c-8a60-b5d6168fdc9c", "value": "12288:en2ThVGeZODSQQttoeXRCNu8DbUUGJ2glgVbwCTWc56vDt5KMITo:eESoKQtt1hwunlebnfeDtao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675174490, "uuid": "d1d48443-4ece-4be2-85fb-5b5256cd4caf", "value": 709632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675174490, "uuid": "e17bba98-5b1d-4501-9f1d-93952a0568d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174490, "uuid": "0b908df0-ea34-4051-b8e7-a77648cae9f8", "value": "Contract Draft & Drawing Specifications pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a7a2dda-a17c-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675179017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179017, "uuid": "89bafcc5-19bf-47e5-96dd-82989c270b86", "comment": "Malware payload (RedLineStealer)", "value": "7ee98181d1dbf6857c74d70ab2c520c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179017, "uuid": "2511ef46-0945-4b5f-98c3-87bfac22881d", "comment": "Malware payload (RedLineStealer)", "value": "7501b0d7dede2c5ce3d1dc1589ea9c895f21bf93bc5591f0a721eceddb38aadf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179017, "uuid": "4df8afed-8ce5-495b-afa7-eb91a94c1a99", "comment": "Malware payload (RedLineStealer)", "value": "6395fc2df17c0b9b23f559743ceddd87051f333e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179017, "uuid": "4dc4822e-fdae-4f80-acaa-d737e50e6be4", "comment": "Malware payload (RedLineStealer)", "value": "e8a79706b9fba5592e97e1f001c0b821e8261920a755a78c993134d9babf2ff502c50b3dae5a427051c717c3b0579d6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179017, "uuid": "efeae15f-0a2b-456d-8e48-56c17f9a4897", "value": "T12284D0C2B6B2BCE1E9224B718E1ED6F4769EB5434F147776220B6BDF24B01A1C1A7301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179017, "uuid": "2100f8fe-f82f-43cf-a04e-f48177a30824", "value": "e73db8d7bd9f9f6b2076d026a8fb8fc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179017, "uuid": "30347af7-707b-47ae-b818-001c33b4192c", "value": "6144:S23LLHM+yzg1zp2alFH0IKRkH545XCsZ5NmqMoIMjNW8Mu:Zb7/RceIX5Z5gqMOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675179017, "uuid": "69ca3dbb-3d44-460e-a044-09adaa14e0ba", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675179017, "uuid": "d450f224-449a-4f1c-87dc-0029086d5de8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179017, "uuid": "7c0d474b-d05b-4225-9f97-768851e7bf4b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0a66e37-a1b6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675204180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675204180, "uuid": "1263e880-4de2-4234-9c3a-4fd260e8f3a3", "comment": "Malware payload", "value": "135bedee1f6c1ac7dc630ec4c55a7851", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675204180, "uuid": "63c28ae2-3638-4d84-b323-800edd14b6f5", "comment": "Malware payload", "value": "7584a6a0118f7ceb74df1ab3390f57ccf162be8fe2fe4f10ee7550a81cd856f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675204180, "uuid": "de9d4c76-8945-43de-b440-835b05477b4e", "comment": "Malware payload", "value": "862dd89a5d0a557112402f2eb63f69f48f72822b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675204180, "uuid": "ff668150-24ac-47f8-93d1-2e9321ba0ee7", "comment": "Malware payload", "value": "24dbf14927591b62160af6c03e8c4731861187e60ac13e9d10501ea9562307c6323cd43a4b904c5b5c8469e0d4f0e7d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675204180, "uuid": "aff1310f-a25b-411f-bb70-a5f2c4895c15", "value": "T1F6549EC672B27C62E9268B319E1EC6F4761EB9534E587376221B9BDF25B01E1C1A3340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675204180, "uuid": "d31569ab-4930-4103-a627-462ac9d4e1f1", "value": "d84aba910fd98bff40c3867e1dd713e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675204180, "uuid": "ffcf2e88-3bf8-422b-b79e-0f539852f73c", "value": "3072:vBuKZ/LEQRsXO3yy4a5Xs8cq4TfYrrrohENOuvmqPUx6WfQz86bI1S3MM:gKZ/LEZXGX88cPjqf9mqMoIUII8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675204180, "uuid": "6350b512-4670-44ba-8e0c-161eaf74de1b", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675204180, "uuid": "1c692d4c-2036-4ddc-b1cf-77104c68dd71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675204180, "uuid": "04930879-7344-45fe-b3f4-98e479e27e6e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a1d222-a153-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675161499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161499, "uuid": "99c006fd-0504-426c-8827-e6bab2b1b1a7", "comment": "Malware payload (AgentTesla)", "value": "8bcaa7ae08b0df39a77e0735368f9fd9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161499, "uuid": "06f5a77e-fcf6-4f44-afb1-ab5d5c740cda", "comment": "Malware payload (AgentTesla)", "value": "75bfe8f3bfe79995b79baa25a9a3f04c9ed467e90f399072d20f83da691353fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161499, "uuid": "7c28a4a6-f343-418a-9e48-782fa8ba26bd", "comment": "Malware payload (AgentTesla)", "value": "9238636c460cf7fa7bb76b793e79db0655363c70", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161499, "uuid": "847a81a8-e8d4-41c9-bf0c-4674a3fc6613", "comment": "Malware payload (AgentTesla)", "value": "f07586f1b78b2b25c039a17825adb8a38aecda58dfd833581de43cdcdd25a6c5301d0b8c225369587b234db78ad1c92c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161499, "uuid": "b39e6481-e72f-4c00-8f29-45486729f164", "value": "T17F74128012B4D0ABD7779B702CA52EA5FEF6EA0535649B0FA721694E3C32B03D13D760", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161499, "uuid": "4d8a59d2-1bce-49ec-8f98-2e4732a961a8", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161499, "uuid": "8c3c84e3-c891-4df6-8556-af9709ad0109", "value": "6144:pmOP0zXCW5tflQKHaTJX7ikT/lYi4iG+HnGOvr6BzyO2+3d65Adq3HlJAjuO3ehT:cXCW556K6xmyZ4qvr6lB2cq3wjHOGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675161499, "uuid": "a7b6cdbf-2cca-4b89-80b1-d6e3cc51ffc6", "value": 360500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675161499, "uuid": "7a4df127-ef9f-4aba-9043-508e630b7476", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161499, "uuid": "4a222638-bfa4-4a3a-9883-053d3d77e514", "value": "Ordine cliente27T182149.764.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c39aa3f-a196-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675190134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675190134, "uuid": "c4d5f9dd-2216-4e3c-b74e-67c19b8e4367", "comment": "Malware payload", "value": "d1a82616394437c8354c8277f60b660d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675190134, "uuid": "dfd6649a-dc9e-4ddd-a120-8687ca835870", "comment": "Malware payload", "value": "765a4d57b2db92c2fd904b11a3e2dd26cdaa38843cc1760ae84e3334822bf4c4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675190134, "uuid": "ce5c9066-f8a9-4c21-9522-44aabb56741e", "comment": "Malware payload", "value": "0b864e81a9508d4a0d85034477790124474e7af6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675190134, "uuid": "884f7e44-ba96-4f47-9df3-c74069a12cf7", "comment": "Malware payload", "value": "007930fa9fc6dd9726decadf06af4d5e4977883ae0226a1e5770b7494aa8c849b36a0608a10a1aa20cb98fb1ae02c2ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675190134, "uuid": "c817de0d-2dd9-4327-b6f6-0756b70ed8bd", "value": "T1FA176C87B8924583C9E43A37B8BE81C833B616BA97D7661B4D05CD34BABF1D90E35704", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675190134, "uuid": "aba303bf-3a19-4ed9-b94c-e63769058fd6", "value": "196608:6ehFrz0mR+is1AI63333TK43WoDnvEYXvwC5ofMlkb:qisiBWoDnvEYXvwCAo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675190134, "uuid": "10e573bd-f4b3-4b42-bcb9-b7d89dd5cda4", "value": 19988480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675190134, "uuid": "90b1a36c-7c32-4f11-9c18-94e31394f725", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675190134, "uuid": "19c1934e-4902-4e7b-9ba3-d57695a322eb", "value": "765a4d57b2db92c2fd904b11a3e2dd26cdaa38843cc1760ae84e3334822bf4c4.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "871987e9-a146-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675155980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155980, "uuid": "80211819-247f-4fbb-8b8d-0dfc5cfba3c9", "comment": "Malware payload (Mirai)", "value": "b4c240767f0ada0082aa7272ed345985", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155980, "uuid": "2f32c877-1a7c-43ba-8002-60b428e1c3ef", "comment": "Malware payload (Mirai)", "value": "7678de3eb37b25c697e066088e85cc4c009cce39c0a77eaaa814e51ac545f1dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155980, "uuid": "73c041fb-3143-4784-a30f-54b59a8e0450", "comment": "Malware payload (Mirai)", "value": "020f0b3663e326c34c6dd0661be116ebece2285d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155980, "uuid": "5eb9bf12-55df-42fb-aefe-07fb97130c5b", "comment": "Malware payload (Mirai)", "value": "37e7ac1f015734ee27ea0178d81b050199b915ec6ba782171f739cc579869776fb4a59d3a0eeea6ecc7e831014aef502", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155980, "uuid": "4a4375e4-0f09-4928-b894-14f18b589f0a", "value": "T1E5734C4272280B47E4920A742D3F5BD097FEEAD021F4B688695FDB568635E372486FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155980, "uuid": "dc0d26cd-d7b8-4bbe-8d48-dd9282c4ebb7", "value": "1536:xGcTq1R1r1WDnh7fbVawpFTWpHcqyYusYIoyZn3q:0WBVo8xsYIrZn6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675155980, "uuid": "657ccd5b-f0d4-459e-82ec-a00b65f6054e", "value": 76672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675155980, "uuid": "535b97a7-4a93-4069-b458-edd4016e3e9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155980, "uuid": "daaf0773-649b-4ce1-992e-ce7690933d12", "value": "b4c240767f0ada0082aa7272ed345985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abfdc3dc-a144-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675155183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155183, "uuid": "a0580750-8216-4c7f-967d-8c2bc73dc024", "comment": "Malware payload (AgentTesla)", "value": "5679a3b4d0a2f034efa87c838b972e43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155183, "uuid": "ee2bd182-4334-453e-b1fb-33f7e6680cb2", "comment": "Malware payload (AgentTesla)", "value": "76f2e24151a110b474722868aa411baf79605bb0802afd3eb29b1e91217c04dd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155183, "uuid": "921968d9-e41f-4314-a313-c16bcf8c371d", "comment": "Malware payload (AgentTesla)", "value": "ddd78c224351c8938835eee974f2be38cd067717", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155183, "uuid": "81effcc5-93f8-4fc2-a2e0-d95282cc42c6", "comment": "Malware payload (AgentTesla)", "value": "3c6d4ca0ca3cd6f71dc91d314eb633f42bf1e7d4d8fccd1dff6441d3221185c065b7f3ee7c1821e6aa2f62223a59590c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155183, "uuid": "447c5359-fd32-4451-bac7-0bc567c88a91", "value": "T15CD42311127843E9C61D03BE75738D30437A5E69B827EF0CAAD6B4E615777C213B2AA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155183, "uuid": "f9764c46-9b78-4724-a952-e36a12e61241", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155183, "uuid": "ac6b4ca2-333f-4caf-b9c2-ad56d3cd7c17", "value": "12288:+qjy3thZ+GvJp2eJzJStedQiPGuf/WFmGqYNar8z9i7+pvFCWtO:kth0bAMENP5Q2YNar8zw6Rkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675155183, "uuid": "9342054e-ecdc-4bb1-a203-d2beb20962c9", "value": 622592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675155183, "uuid": "237fcf34-a9b5-4398-b8cd-5f8bacae9a7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155183, "uuid": "f05faa05-5cf2-4555-b48b-34ed5e70ef32", "value": "1-18 Produkte aufgelistet.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8093788-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140627, "uuid": "0558b5b5-3d05-40eb-a170-f6ab09958246", "comment": "Malware payload", "value": "be996a725c9e7944fe70b541397883e0", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140627, "uuid": "1a34a10a-ee96-483f-9bc0-09bd2d9f5dab", "comment": "Malware payload", "value": "77d52b5e2a9e605459d63869088684887c21c2cda56bbc58e1fe90ced204d6f1", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140627, "uuid": "e0603149-55f2-4ef3-8123-cd0e1c413b6d", "comment": "Malware payload", "value": "f17aaf8c9da40fc8100ac229505fd42546cc016d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140627, "uuid": "309b3814-4e86-4105-a95b-06e87fa9bb8b", "comment": "Malware payload", "value": "45a450482dbf6cc8dc171caf64250e6e24007f364c4b97b855d87aefeb1170afd8098aae066cafa4a9d7f84d4b5fb2d0", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140627, "uuid": "0a40e51b-716d-4f8b-bd0a-fa662a9cef09", "value": "T14D363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140627, "uuid": "64727526-e762-40f1-b46c-058889c0dc84", "value": "98304:Hv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXX1:HvpvFa+g8RWLdPk/84tCEr0RtNiC5eSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140627, "uuid": "85b73996-05a7-4940-8ee0-cf26e8edc8c8", "value": 4993536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140627, "uuid": "e452a847-283e-426d-ad7d-1b3505c25c8d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140627, "uuid": "d6261890-ce29-4516-9be4-d2fa3dea6c79", "value": "77d52b5e2a9e605459d63869088684887c21c2cda56bbc58e1fe90ced204d6f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308075a9-a1b7-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675204368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675204368, "uuid": "bc4ce517-594a-4427-a57c-6e97412aeb79", "comment": "Malware payload", "value": "896768bdac96b3137575762bf55bf178", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675204368, "uuid": "87a372b8-6e5f-4f45-a0c8-cf9a92a5ee33", "comment": "Malware payload", "value": "78061aed810ac77489f94ea0b46e51d3179b27b5c04e5f1dad89a46bdcb1701e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675204368, "uuid": "a091006f-7be5-40e5-a510-a569c0b003bc", "comment": "Malware payload", "value": "7ba5aa92bf59fb9b128ea162f18e59a2b71c0eef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675204368, "uuid": "5cb7425e-4b82-4970-885c-8d3db56e5c78", "comment": "Malware payload", "value": "daecf6d2d47525655dca4606eb6e3985d485c7ae595e417945657824bb4398cd2ccda43f25a6a1e980ebfddfb6adafb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675204368, "uuid": "7f5c8df8-1447-4aab-938f-836c3835bf46", "value": "T1FD84B0C262B1BC62EC2547329E0ECAF8751EB9524FD86766321B9BDF25B01E1C5E3305", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675204368, "uuid": "8d588c30-a3f6-4052-b0dc-b7b2e5e106f3", "value": "d84aba910fd98bff40c3867e1dd713e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675204368, "uuid": "c4294b3d-1891-48e1-a4f1-65abd03387be", "value": "6144:7K2rLNCPTJZov9JdWUdlQvwHvzHOcirQBIzmqMoI94t8M:eS8yWwlQve7HOK9qMbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675204368, "uuid": "a0816a4d-47c7-4b82-8415-122bb6312857", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675204368, "uuid": "bc08f4f0-d3d4-4cf3-9f19-f8cb4c3ebab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675204368, "uuid": "b68659d7-7acd-40d3-a333-db764f4780d7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f14bf4a-a1ac-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675199721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199721, "uuid": "53a16ccd-aa92-4698-bb74-e06486d71bda", "comment": "Malware payload (DCRat)", "value": "a004cd8e5a3c98905f606c1adf947876", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199721, "uuid": "d1de3eb9-a29b-4f60-9405-88e2aa2ffdb0", "comment": "Malware payload (DCRat)", "value": "783e64fd0c3955a98240e9e42f216c5e78e63021aeb5913b7a262dd1e3f9683e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199721, "uuid": "bb741878-7f08-46c1-af4a-e90506721936", "comment": "Malware payload (DCRat)", "value": "7516ab2fb8ed0d5300da3b408b6ef9496859a717", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199721, "uuid": "e230570c-fb70-4563-b06f-0dcb9fdfffe5", "comment": "Malware payload (DCRat)", "value": "b8b9eff8f0a60d639219af98474424c1f7a74da669f1a2622e277e09674f3a86649a4f4b37899c13b31add0c629fb3eb", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199721, "uuid": "23e0b2f6-b0a1-4c2a-a2dd-b8f7d4b740c2", "value": "T188B529906E2BD9DFC1D80878C4C25F46971C0EA907B89BA2D9E67C397963C531D8EF24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199721, "uuid": "db397d95-cbb2-4728-9f17-845e61a2be38", "value": "a3017ccb2c25f455f959277b4c3674df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199721, "uuid": "35330a1e-6c7d-48e0-8bb3-642b068facc5", "value": "24576:iD1CSLX+VpapJhM/r8b2f1XqX+lCLxwMylv06dbFydnjzjQhkKqyVIkFHfIHYfrr:I1CSggEsZ/x4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675199721, "uuid": "094d16e1-ea58-47d2-bf03-eaf1dadbf825", "value": 2434954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675199721, "uuid": "042f532a-e814-4f9a-beb8-145b73b866b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199721, "uuid": "14d02cda-339a-4bf5-8809-dced2cfec2af", "value": "a004cd8e5a3c98905f606c1adf947876.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d7d372-a168-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675170683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170683, "uuid": "7ad1d9c2-77ce-4a76-800d-8fa01e3fab14", "comment": "Malware payload", "value": "0af814821cb254e4d0bcf37ba3a2e5e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170683, "uuid": "76ec50af-b3bd-49eb-8971-a196be8e2708", "comment": "Malware payload", "value": "7841746c54c53dbcafdf3f357c7a84b90fe3b089e07f30dea15ef6f7f15b0f00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170683, "uuid": "3f36990c-fe5d-4b2e-b78c-514d8e257638", "comment": "Malware payload", "value": "370cb64323444508d45e0060d1887929dc3eaacf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170683, "uuid": "489a0947-272c-4e28-aa75-65e25d2e1a51", "comment": "Malware payload", "value": "b3e0595c6a489d821ea0b4d7bef1d1951afd456a19090fc0e20bce2ff0b3545869d38104c849d554302889ecbf52d2ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "X64", "colour": "#FE8399", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170683, "uuid": "982a4f08-4721-4781-a771-01beec548f75", "value": "T1E0764B07F85151E8C1BED230C62692A3BA717C494B3027E72B50FBB92F76BD46A79314", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170683, "uuid": "7abe67b1-f1e5-49a7-bf79-fe197a2d5566", "value": "57c9b357ae0cb2f414b0a5873e2f216d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170683, "uuid": "7a3f4a24-36bc-4fc3-8a2a-33f0fb5bf3e4", "value": "49152:Q+ECqx/ZGyPUPrb/ThvO90d7HjmAFd4A64nsfJ5RvmcNSRlTjSDxbAcsrKHhan8P:+GmJSJ/1SsZvioE0Az+5p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675170683, "uuid": "52e278bd-85b2-4cd9-973e-1976b809e6b8", "value": 7806464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675170683, "uuid": "72f03803-d707-48e6-81e1-c3e3f5f51a96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170683, "uuid": "0adb802f-9dd7-4960-80e9-60c05d5a8238", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1267b4-a160-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675167206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675167206, "uuid": "8428a172-031e-4d74-9b68-469613343736", "comment": "Malware payload (RedLineStealer)", "value": "d9b7bab5892b590981c41e9130a5ec3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675167206, "uuid": "cb743808-1bc8-4782-9bf9-d8e6f8617058", "comment": "Malware payload (RedLineStealer)", "value": "784bf4db7f2b57022b72660f8b0086131f0f362ce7279c7a607ef5939d192982", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675167206, "uuid": "51ffe229-03a2-41fb-aa02-131789be3e75", "comment": "Malware payload (RedLineStealer)", "value": "f1a38d3478b69669e44bc75382e77ab6badfc7b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675167206, "uuid": "44c5627e-9a59-4d0b-97aa-67635eff8293", "comment": "Malware payload (RedLineStealer)", "value": "a821b5675dd0baa1d0f6a51eb04d1ecb8fe46f024f4a5572604bf7017adee7c53f2ff117027a2b657f9841483b6f3972", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675167206, "uuid": "27153567-dfc7-4ca3-9e37-639cc63c8225", "value": "T1E7044B3AF5C1C537C0710A7C8E96D2E0657DBB202E2D685F75E90F4D9E3A0924A6D2CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675167206, "uuid": "a502c6f3-b381-4ed1-9f2c-a686b544857c", "value": "baa5b88b6bb86e914d34b43be035dc81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675167206, "uuid": "3ed722d8-c29d-4e20-bb74-ebcb23d83a19", "value": "3072:HRYYMKgPpQHWmAFDWF9Aq0mxb4nrH7eKKQbRfOQIYaQM3+4Nugw4HN:qYjTWmAFDWvAq0mxbAbLpMKYN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675167206, "uuid": "94715636-2e07-4377-8d6f-14bb96d062e0", "value": 185344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675167206, "uuid": "f2d0d5d5-b435-4f4a-a8d0-0232d9ef5456", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675167206, "uuid": "4985f42d-30f9-4534-81f6-41f708e7866c", "value": "r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a49921-a19e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675193721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675193721, "uuid": "ddc165c2-ea0c-4462-9cf5-78f5c2b1b929", "comment": "Malware payload", "value": "f93c1e0999dd585fff601987dba7e0cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675193721, "uuid": "4fc19d4a-088e-4e5a-94bc-a34041a58799", "comment": "Malware payload", "value": "78b55179470444e49d96044aee45cd71d71f8158342fc08e56c200ed5a97f846", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675193721, "uuid": "9e398a9a-5b2c-4c7a-89ac-7f489ece792a", "comment": "Malware payload", "value": "10d5e01a8751b883f1917149685bff1e3193ac12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675193721, "uuid": "b8d1efa8-0514-45fb-9099-e1ccc558ff64", "comment": "Malware payload", "value": "8b5b767b3bc5a972dac13d10d4bb509834f4d5ec066249ddfaa0edd6de79edb61d64608e8a0b927db06e9131d8fb676a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675193721, "uuid": "82c9702e-81ca-4311-bbe9-7997b86569af", "value": "T1EC547DC272F2FC62E9268A719E1ED6F4751EF5524F09676A220B9BDF25B01E1C5E3300", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675193721, "uuid": "293324d7-1fb7-44c2-98dd-b6984dad13d0", "value": "9c039baca0968dd2f90042d865dd6c2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675193721, "uuid": "d04a2e4e-9756-48e2-9b22-16d1ceba254d", "value": "6144:GF0AnLvw8QZSwHEfS8VmpwE/mqMoI0468MN:zYDagwkqZjeqMF6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675193721, "uuid": "09b89118-15c2-4495-8e06-11063d82bf4e", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675193721, "uuid": "ca93b5a0-68b2-4ec3-b078-9cb4f8b8aa3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675193721, "uuid": "8367e48d-bfdb-458f-b8e9-b30f63788efd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "937f9fb3-a139-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675150417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675150417, "uuid": "af6217a2-96f2-463c-ac70-bbc29a4cc025", "comment": "Malware payload", "value": "f26a8722a6deec5f530ebcfd2469087f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675150417, "uuid": "e228c99b-e050-423d-b89f-9f5627b9ca94", "comment": "Malware payload", "value": "79a6c6005c09e01722fc184dd0d042c32dea4c97bacf2c7d1a1c088d87d4da72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675150417, "uuid": "85f195c9-8ad4-42d9-a20f-33b326c83ed1", "comment": "Malware payload", "value": "7153ef673457d29166228f5977dff128722cf0d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675150417, "uuid": "1ac63349-5722-4a0a-ae61-669a227b533d", "comment": "Malware payload", "value": "705e3088a2f09bd3e3f3a69748bb480cb7e2c2239a500a191f04ff1a73b3d808d210e8ea4a7cbacf35414ca5562ac6bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675150417, "uuid": "8867ba5f-998f-4d9c-9cec-fc3e7679e850", "value": "T1F0D3CF502AE0D052E8924A30B5A97E739EB1DD32B7741E4303707E587D7EFD16A1E22B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675150417, "uuid": "c9f6056c-b1d8-4454-9c4c-d75d1fd9a11e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675150417, "uuid": "bfef8c7e-4755-4dd5-ae84-e91777bfb3ae", "value": "3072:0bG7N2kDTHUpoukGdW2Pzy5n+7bSfDdfrxAu:0bE/HU8mHry5ngWfJf7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675150417, "uuid": "5a15ab38-a53f-4a97-ace5-113f6f3e0985", "value": 132408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675150417, "uuid": "785e2785-5175-4251-b17f-8ce02b823932", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675150417, "uuid": "4b17e395-2982-46e9-8f85-96b2ad7f73a4", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9c7535-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140633, "uuid": "141eb3bd-bfd2-45a9-b8ef-8edd82cc12bc", "comment": "Malware payload", "value": "fe6544a9dd0743c783d1b615d5d62fdf", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140633, "uuid": "cdc5ddbe-1f56-4b3c-8d4e-317edb554bfa", "comment": "Malware payload", "value": "7a3d1b636c40404bf9abd69eab8188d09acfdba887ce800987da94356dfb5fc4", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140633, "uuid": "dbfc6ea2-151a-4cc1-b145-746807ad1f53", "comment": "Malware payload", "value": "3547bb97ad10afe432e1e068ba94d1cec6a322a4", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140633, "uuid": "c1a225b3-3eaf-4def-b0bf-12d10b547b66", "comment": "Malware payload", "value": "8319168211c852303ad64f2c86e6fbbf86506f68ef6bbd6dd83754ffa1fd461424e00728aea616f07ab93868a404ffd8", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140633, "uuid": "a54fcb2f-3d8c-4cda-a0c5-00fa922920ea", "value": "T137363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140633, "uuid": "0288e515-2b73-48f3-a41c-b34289864d84", "value": "98304:Hv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXX/:HvpvFa+g8RWLdPk/84tCEr0RtNiC5eSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140633, "uuid": "b72ed575-d708-4e73-9d2c-05f9efc29051", "value": 4992000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140633, "uuid": "73f7a8cc-7ad8-4916-b10e-b86c848522b5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140633, "uuid": "2be92f00-506d-4832-bc13-19a74cf43118", "value": "7a3d1b636c40404bf9abd69eab8188d09acfdba887ce800987da94356dfb5fc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95ef09f-a117-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675135985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675135985, "uuid": "10d25f05-91ab-418c-9010-d4bc13993232", "comment": "Malware payload (GCleaner)", "value": "9ad1e2a1e689fdea3f921fab5c9e5643", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675135985, "uuid": "f10a3f05-119a-431f-9471-2c4b825b3ff5", "comment": "Malware payload (GCleaner)", "value": "7b0ecc95cb16926781dc4288bfa80a2a9992939df686c5f0beef4d15b7f22986", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675135985, "uuid": "a2f69889-f877-4de8-999a-2d55193d95c4", "comment": "Malware payload (GCleaner)", "value": "01377a060da6ba672cbcfdc8f199bb924fd359a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675135985, "uuid": "703f7c1b-0f12-4b93-aed3-5e3a4a64b672", "comment": "Malware payload (GCleaner)", "value": "7c7aa1a31efafcdfd5321680cdf8087b7ecb2cd058ba2478e54c39fd559e12e7e351a3b3e70680a2756fc4674aadd13a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675135985, "uuid": "a06d31a4-7cb4-4139-95b5-366ab97e2abe", "value": "T125A533576820C236F503CB7A9C3A5815FCB27690157C50FEB1CC3A9C6BAB32865F8329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675135985, "uuid": "45d67f58-aaa1-4f72-9b4d-fb463b16321f", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675135985, "uuid": "b3534097-06ac-4336-9aef-b6e424c24211", "value": "49152:ufo09mz4yeQtIqT5J2WmOzc9VeHrZZNNPFK4v+2FKZy2LCgv2MR:AA4y959/Dzc9VeHrZXNPAARKDv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675135985, "uuid": "cab936e7-3481-49ec-bbc1-5d93b7b22952", "value": 2180069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675135985, "uuid": "7ebbdb09-435a-41ba-a713-3a1fd167ae6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675135985, "uuid": "93d5819e-9ed4-4260-b14d-7cd114f177b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0846baad-a10d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675131286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675131286, "uuid": "ef5ecfdd-e8a9-4226-b3af-35a94836d498", "comment": "Malware payload (Loki)", "value": "b0c4d4fbe7822e436d8dffc074375fe6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675131286, "uuid": "79a063e5-2844-492a-b410-5664af5506bc", "comment": "Malware payload (Loki)", "value": "7c5c9edd1dce19df97f4e259a49b5a0399036fd6181692fc0538492db3589e32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675131286, "uuid": "63368bf9-8f72-4191-8900-a277e8904b40", "comment": "Malware payload (Loki)", "value": "2ac5c8e1e0706ebcabc41fbdaf637b61185e227d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675131286, "uuid": "13e236d2-7bca-4a99-a050-e971758bf6a1", "comment": "Malware payload (Loki)", "value": "ed7b811741f597391e6458bdb6422b70af3a471d39d7c646f8fe063510a1092a451c0eaac296b8c41f8454c0bddab0b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675131286, "uuid": "83de590e-cceb-41e2-bfb2-847a7af3a3b2", "value": "T1B6D44941267B87E7C4B909B41438E47826A21CD18A6CB13ABDC67DBBBCFA74F0095753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675131286, "uuid": "2c159ec9-b6ec-46a6-a169-69456bd1a9a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675131286, "uuid": "8c2000a2-21e0-47ca-aaf7-b02a8b65a9ca", "value": "12288:MVV+Ynu0b+NoexY/9X6xaQbstgM82ks/tjLInIdZDTl+q:1Y3+NNx89XOaQbWgifOnI/Tl+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675131286, "uuid": "1ff1c20a-d329-4207-9aed-7ec75be57e11", "value": 631296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675131286, "uuid": "6ca67d03-93fe-4808-82d8-26f0f53b3b8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675131286, "uuid": "3c3e073a-8304-4031-b604-6d26a3c0a717", "value": "b0c4d4fbe7822e436d8dffc074375fe6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaac4d34-a1b0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675201674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675201674, "uuid": "0b58168e-20ff-4f4b-933e-339fefb51474", "comment": "Malware payload", "value": "9d2c2c792b71b659a3c07179aeb3c1cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675201674, "uuid": "9adeec83-7eaa-4528-a1a0-059100775c2c", "comment": "Malware payload", "value": "7cbfb5f75e8025187aa52bf43e432ec7f60ffb31b52d129994e42f69d5d6f15c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675201674, "uuid": "869a419d-9352-48a5-93ab-3b2bfa20615e", "comment": "Malware payload", "value": "cc934ba223bd74ef4b4aa11964e0e9c3e06ad4d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675201674, "uuid": "4fe2b3c5-4169-437a-a250-5cc158788f01", "comment": "Malware payload", "value": "0d7db9b99aedfbacee71f5290102293dd11ae6e3cb1cccb8ab3a8b42ee6d5e380b56de44f03c7b76a484283f32b39baa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675201674, "uuid": "bf27f628-dadd-49af-9e9b-7422d4c69006", "value": "T1E0548DC2B3B2BC62E9218B719E1EC7F47D1EB5424E5963E6621B9B9F15B01E1C1E3340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675201674, "uuid": "5e376a9b-dd30-4d6d-bb3a-b7d993bb0bc4", "value": "d84aba910fd98bff40c3867e1dd713e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675201674, "uuid": "e0057d1b-fd07-4c33-a4a3-146a67a2dfe0", "value": "3072:6P2uQVz5LOeRsCa+sLbqOK6WT6cB4+Z6mqPUx6WfQz86FY3MM:KQVz5LOHC5sLbmD6c14mqMoIt8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675201674, "uuid": "a80dadb4-6b7e-4ea0-a18e-fec04fe32020", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675201674, "uuid": "2b117392-fb3f-4d9a-b52c-97baef892940", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675201674, "uuid": "dcb5055d-9077-4c27-bbe9-288e5868452d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d71297cc-a163-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675168570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675168570, "uuid": "7b4dd126-0f90-4802-b893-606a5a9fccc8", "comment": "Malware payload (Formbook)", "value": "d77f6cce4247fd70d2616169ae116bc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675168570, "uuid": "ad13de7a-7b1f-41a1-9271-e34f38985c09", "comment": "Malware payload (Formbook)", "value": "7d309cb18ad6a9c5354ca0f9869bafd06bea93f8f30a86d00c539c0c38c9de27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675168570, "uuid": "03ccd7c6-f433-44bc-9649-e3906c65a586", "comment": "Malware payload (Formbook)", "value": "3ce50a9adec63b4de131e8b81b631e4afc624e7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675168570, "uuid": "f17b10fa-8c66-4013-b856-60fd998ac3c1", "comment": "Malware payload (Formbook)", "value": "0d283a722e3d4f29b163838160e052f4f6cd43a488774f46bac483026dbba64131b57e5b5a1686db393d09110bfb72a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675168570, "uuid": "e9a4a2d6-0690-4d8f-bfac-ed9a90835b5b", "value": "T1C8859E9DF962DCB4C91D03F1A5A5CC130A14A51F84796ADE30AA735536E32E3482BCFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675168570, "uuid": "63a36275-ce08-431b-b1bb-1b3988f65bf9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675168570, "uuid": "3b07254d-b80f-40b6-881c-0863d36d1cd2", "value": "49152:W0fHL358DgM58DgqrTissLTcw2FQOXyQZCC:W0fD580M580ITiscIw4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675168570, "uuid": "41e838e7-e2d7-44b6-8182-9a2ad99ff288", "value": 1754624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675168570, "uuid": "f76e2edd-7d57-4701-8f52-f06f904875eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675168570, "uuid": "d35225ea-8b27-479b-bdfc-df31a0d46a2c", "value": "SecuriteInfo.com.Trojan.GenericKD.46728592.11836.29179", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "798fa6fa-a15e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1675166265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166265, "uuid": "f9f34397-c9ab-4f2b-aa3e-e1b312d231fe", "comment": "Malware payload (Guildma)", "value": "9fc7a3f9b15b36ce23bb668f364b3d9e", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166265, "uuid": "3c2770d4-8ace-48b3-9534-f9200707e8c8", "comment": "Malware payload (Guildma)", "value": "7df24f04c4df829cd9e643cd9be596d0996b79d1fbb9422c75a17741f10414a4", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166265, "uuid": "32fa0173-6c1d-4028-81a3-58f6d5ce46f3", "comment": "Malware payload (Guildma)", "value": "469bf87d06a2a5f75552ca509460d6612907da78", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166265, "uuid": "b4d3986b-772b-4108-bc35-dc9fd4dca38a", "comment": "Malware payload (Guildma)", "value": "c90549d1543872eff9be218db85313a7302d954fa5b6ec7cd508305d1427c08e2098f0167cb37e09077c6514564349ef", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166265, "uuid": "e38dbcb9-abaf-4b7b-abe8-762d7f2d6d59", "value": "T170D27C5D0113D40B45725517B5E368BCF70B8A27C52AADA0FAC388827AB01BE26F5F7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166265, "uuid": "93f64648-291d-444b-92f8-468e578a9f6d", "value": "768:UZsZ2mm497G8Fcp2YNIwp0YkGCiCB3274XdPHrotfK1Nfy+WC57DzDIDz9WjcJ5E:ssZ2mm497G8Fcp2YNIwp0YkGCiCB327k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675166265, "uuid": "7c7995dc-45a2-4cfd-928d-28a66c408eb7", "value": 29817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675166265, "uuid": "419e5656-f2b8-4fbf-82ae-93c30273ab0b", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166265, "uuid": "c33c603e-2f72-4431-b06e-7e4dc38161f8", "value": "payload.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dbbed8a-a13b-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675151186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151186, "uuid": "c14ea5cf-6787-4431-8e1d-dee7c32ff753", "comment": "Malware payload (GCleaner)", "value": "cc6193d08d4a1c8dfc61f931dd4fb81d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151186, "uuid": "8bd694c5-64ce-4ff9-834f-549b7c921f1a", "comment": "Malware payload (GCleaner)", "value": "7e9cd170e2b1b548048a5be7da04f9857ebf025ae7f8eecff2349245c1b94743", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151186, "uuid": "7f124767-7530-404b-8c0e-6e8e2c951b7f", "comment": "Malware payload (GCleaner)", "value": "f77dbb56f26f4340817685fe6ab2dc91129a0b3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151186, "uuid": "520e576e-e4d4-457b-9935-3f7dd0991e08", "comment": "Malware payload (GCleaner)", "value": "072f35816789c238cc406c4146fc70ede238877224fca7c3fbf9ea3ab41af4f27511e4220b573d6a99ac948bc1819b9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151186, "uuid": "45ad4258-839f-4ba4-9952-e0e28a39c8a8", "value": "T146A5330456FA0039E216C7B0107E90A0B5B27B665476136D722DCA5F2F7FAB0B5EEA13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151186, "uuid": "191cf960-1d7d-4730-888b-702aae7f14c7", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151186, "uuid": "67b2d0a2-7df9-4b24-9d74-89ec77ca88f7", "value": "49152:C2EA/xAQi+j/udjrD2AcAEM8kHPXl+1ottBnvFofnxHXIQ8LCgv2MR:d7pouGdjOAcARZXXt9dM49v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675151186, "uuid": "404a7741-9279-4def-9a91-4750e0d845ae", "value": 2213201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675151186, "uuid": "efdc0ed8-ad20-492a-a300-bc5d72d6e77e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151186, "uuid": "bf62302f-cbea-4040-be73-5b36d74777c9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977d565a-a1ac-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675199816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199816, "uuid": "8a9e3b06-64ab-42cb-99ab-06e80d1a76ca", "comment": "Malware payload", "value": "772dbc4643d6ea936549ff03b877d71a", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199816, "uuid": "1d40c73c-d747-4060-b343-83604522c72f", "comment": "Malware payload", "value": "7eb67e2bae7a8330b56064529b460a449cea5976d3483e7e971f017db1c43879", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199816, "uuid": "57970b4d-976f-4446-b3ed-a6f89d3fcfb9", "comment": "Malware payload", "value": "5a51847c78ed79cfd8e447f8dc5c36981014c523", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199816, "uuid": "c8c5ad96-ea70-4055-b3d6-c988c1c21670", "comment": "Malware payload", "value": "d9c610104b9016de28ee0d4ff0e156303d1b47adbb849d12746c718a342fa22cf52cf74d4c82c4d95812a8b0ddaf994c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199816, "uuid": "6b285124-fe59-479c-90ae-040f79e68143", "value": "T1CA537C002798C965E1AD8AF8ACF2554106B1D5772102DB4E7CC804DBAB9FFCA4A527FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199816, "uuid": "0967d91e-b5b4-4711-a204-9e18f81a3fab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199816, "uuid": "3b011ce2-b850-48bf-8cb7-5a33768c2811", "value": "1536:m5UdjvpYcRVSQxZFeeiIVrGbbXw7lq2vaHGj1pqKmY7:m5UdjvpYcRVJZ4eXGbbXF2JOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675199816, "uuid": "231f4844-f2b7-4146-9f29-5f31cdf3dc1c", "value": 65024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675199816, "uuid": "8ae306bd-6838-4330-8c3d-03c83068f4b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199816, "uuid": "613c89c0-d54a-44db-9ce3-1320ebfc336e", "value": "javaw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbec6cc0-a11f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1675139372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675139372, "uuid": "7e9f8f92-45d0-4fe0-a525-ff7bb9cf47c0", "comment": "Malware payload (Rhadamanthys)", "value": "27bb9abd524480ce1b30123ee769270a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675139372, "uuid": "a81b9b98-7bcc-4d72-827e-6b84ccfd541c", "comment": "Malware payload (Rhadamanthys)", "value": "7eea472a5c1e7ddae6e79deb0948c8caa219b26763f77f4e249a2666c4b38b56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675139372, "uuid": "65d7d269-f567-4b11-b1e8-92c40e424ada", "comment": "Malware payload (Rhadamanthys)", "value": "682cb6bf50f2c662165a241413343c9170d907fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675139372, "uuid": "13ae4ae9-1507-4446-a5f8-36391bbb9052", "comment": "Malware payload (Rhadamanthys)", "value": "9b0ad07668a523eb58fd87ea7873696b2a87c6aea41645335f2612adf8e3ca78a78da6298ec8310d4119028a0796d72c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675139372, "uuid": "6090e7f6-e6e5-4bcd-b9e0-9a0f710be62a", "value": "T13BF3E125B680D073C06146B11924C3987B7D7A321E7A9947BF945BEE8FB22E1362E353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675139372, "uuid": "72f4b00a-0640-4c5d-a3f6-de846ded56b3", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675139372, "uuid": "a2c04d99-9368-4a61-bd34-63edc40ada7d", "value": "3072:ujFEHqbL0C0om5LSfw5VfDMc9RKUfSvRJ8NQZ0Y+4:loLR0o0qw59Dl9RJfkJPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675139372, "uuid": "5e9aec2d-4c81-4710-a580-e43f16b00c49", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675139372, "uuid": "70b57425-6b36-433a-a08b-40989b0927ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675139372, "uuid": "b9e42b83-4b82-4bd7-a280-f38dd0d17712", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d220e7-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140467, "uuid": "cc951e92-b6ff-41ed-99b0-3a73e71fd014", "comment": "Malware payload", "value": "66182b63d16f5bc7ad136d5638d22d37", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140467, "uuid": "14671238-b8c1-4a13-8176-aa89cb8b2c11", "comment": "Malware payload", "value": "8057d3ff1039d59da429bcde2b206ff11d8be59b4c037aaf116cd8dd61fd7d0c", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140467, "uuid": "d259ff5b-a2a5-4e9b-84bc-71d69c3ae43c", "comment": "Malware payload", "value": "4793e36ae1c4bbe2c9bcad789ffb1aabefa38485", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140467, "uuid": "b66a4c16-db16-4343-99c7-9d95bf69c624", "comment": "Malware payload", "value": "13a714297fef34161ea2b76a9116bc9c20a3f3cc2ac23efabbe6e3bd5c472e1a1878b51d7e17eae8568bdf3074ef6a86", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140467, "uuid": "5360ecb3-3738-4bf8-b9a4-012feb06d37a", "value": "T1F6363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140467, "uuid": "5d982a9e-9a9e-42a1-bb45-14b1eb3005c1", "value": "98304:kv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXn:kvpvFa+g8RWLdPk/84tCEr0RtNiC5eSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140467, "uuid": "4f58b5eb-377a-4bd6-be71-f376970ee2f0", "value": 4993536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140467, "uuid": "183f0ef6-594e-4ac2-9df0-c521cb02e82a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140467, "uuid": "95ea7df0-c543-4a50-af96-7eaf736d2885", "value": "8057d3ff1039d59da429bcde2b206ff11d8be59b4c037aaf116cd8dd61fd7d0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d86fcfc2-a16b-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1675172008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172008, "uuid": "a23376b5-9dda-4342-b87c-2be428d1027b", "comment": "Malware payload (TeamBot)", "value": "845468a14d696b1feb02f40002825ab2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172008, "uuid": "ec1961a2-f664-4bdc-8ceb-497ad5c15bc5", "comment": "Malware payload (TeamBot)", "value": "814417051895f56df975f8599218b2e11c98bcf1fd1362fe4aca564a41ef7637", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172008, "uuid": "1c004f72-3216-461a-9251-bac77f6c8626", "comment": "Malware payload (TeamBot)", "value": "8eeca92c19a14515ae7b86179dbb499876cc5de4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172008, "uuid": "0e899066-7a80-47dc-9069-30bcaff9db72", "comment": "Malware payload (TeamBot)", "value": "d582e72ff886bb68df6d657129e2a273061117d8d008a778f289fb8ad02369634559d9487b2c5e888561607e4268c2dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172008, "uuid": "e30f82f2-30ec-4962-8009-49feda9d1425", "value": "T1E2549E02B2E1BC44F5628A758E1EC6E4F51EF5D2CE08A7653318AB1F25B31B3D762B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172008, "uuid": "ff3cb85b-7e70-4424-9adf-96c576e0e230", "value": "78339dc1c5de0e493ea2b28607ce356e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172008, "uuid": "d8129075-c3fa-47de-8317-e6c3833a2d63", "value": "3072:1Mud9pvILzGRokEBlb7sDKDCp2ybv9vRFzIpa0jJR7f43H7BFvj9mRCqx:dnFILzj5pQKDq2ybv9v7I80jz7f4Vxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675172008, "uuid": "be0ddb9a-b654-492c-9b08-a96be6809650", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675172008, "uuid": "277816fe-1788-491e-b31e-576804b24cfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172008, "uuid": "ad99fb4b-3d4d-4c50-839f-d4faaca907c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e611498b-a171-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675174608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174608, "uuid": "80addcac-774a-47d4-acf9-f9ef632dc78e", "comment": "Malware payload (GCleaner)", "value": "f1a374b514394cbff60274dcd067411c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174608, "uuid": "0b82d2ca-a243-4a0a-8265-433e02cd23c6", "comment": "Malware payload (GCleaner)", "value": "81cb517c45eedbb6b4a839b39013c5aaef94f34792879545c3daa8444efd2922", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174608, "uuid": "790ecbbf-dbce-4913-9319-63ac4fa7f6e4", "comment": "Malware payload (GCleaner)", "value": "6f578b874f36b85af22bc75b089a75d0c1144421", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174608, "uuid": "fcd87fd1-8d58-4c20-b419-d7752df9eecd", "comment": "Malware payload (GCleaner)", "value": "065c5ed74f2445578d1f09dc4c927a29e856f77c386e9979c3bf51e94db2eebb207fd106801bb781a6f2200158d31b5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174608, "uuid": "baa1660a-8430-4f0c-bd1b-a218ab9e17ac", "value": "T192A533C4F3956C79E662EB3C5C7126422D79BFB9313CA20E301C555E3E273A1623EA85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174608, "uuid": "57e8ff60-1b15-42d8-a3b7-b44631994a9a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174608, "uuid": "38aa56aa-669a-4f8b-b83f-a8f64833edf4", "value": "49152:C246PJSQFF265hd2o8jc1C41FvsDlT76LI/3QuE9LCgv2MR:d4Sx35hdN8FSvsRd/g7Bv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675174608, "uuid": "2f46b546-6180-40aa-8176-7feddd973ba6", "value": 2206191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675174608, "uuid": "123a5fbe-bdcf-4914-ab3c-305ea0caab90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174608, "uuid": "0ac99e37-e18a-42a7-8501-01cb1a4e6c0c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1cf2c68-a190-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675187861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675187861, "uuid": "b5a94cf9-76e9-48ed-8bce-813a5873db9f", "comment": "Malware payload", "value": "3c201fc4355b967aefaae295cc6fa701", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675187861, "uuid": "d54eec21-c593-4fd4-b5c6-62d8866d70c6", "comment": "Malware payload", "value": "82539bbc4b89e4cb63f920ac8d2a59f48237688830da77c2aa3da81b58fe5dc6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675187861, "uuid": "e62ecfe2-a014-43c7-9455-17e1165223fd", "comment": "Malware payload", "value": "4ad41361158e353f97245fab6cc4a428ecb3412b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675187861, "uuid": "0fdb6ca5-53b6-4761-aa82-9789da53c4e2", "comment": "Malware payload", "value": "49cb7196be286ae96fba2f354d535ac6e569ee50fa90076da4c8152c4f031699b356eb981fbef97775f91b2e3ee38aa8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675187861, "uuid": "eeea9a3a-a190-4058-8e7d-5d26fb5101ff", "value": "T1C104022422B4C4ABD9A383331E7C4A5F9AE5F9116698831B7B705B7CB5B1240ED0F363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675187861, "uuid": "9a682692-b3f6-4249-ad75-234650ee88b7", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675187861, "uuid": "7944dc37-2189-4cf6-af6d-8862ac38d581", "value": "3072:HfY/TU9fE9PEtuVbaQ0J5VhItJ/g30rXufhkiz1mWGf3VIYydK0QPWWBT3QAU49p:/Ya6r10JJOY0Lu1mWipy0PLHFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675187861, "uuid": "aa9bf518-f789-4d87-84f8-218efdff633e", "value": 187183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675187861, "uuid": "ca7c8c03-157b-460b-9670-89ca2aa0c0c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675187861, "uuid": "1f5ac25c-1e07-4830-99ee-a22e7929e42a", "value": "3c201fc4355b967aefaae295cc6fa701", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce192d3f-a115-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675135054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675135054, "uuid": "144dc02f-8988-43d0-8af8-796b452fea47", "comment": "Malware payload (Loki)", "value": "f9ef1fe311686cb5fe268707df8bd971", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675135054, "uuid": "391d43bf-c860-4448-8521-bfa606e46375", "comment": "Malware payload (Loki)", "value": "825b7e40d0e8bd99cf623386f74a97db1dc5b9317fc0df9ed1b108a7fbbd817d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675135054, "uuid": "d609825d-c076-41ad-bea7-9a5cc7031db1", "comment": "Malware payload (Loki)", "value": "7a9fcdbb9e8c9f95a4fd5cefa00078eb2503bf14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675135054, "uuid": "978119f9-35d8-40ad-8a93-1269bac6e956", "comment": "Malware payload (Loki)", "value": "cf95d48a5f04438e8afb5cec3f279c0a3862f5a483f20970d5f336c35eeac9f40346a0217a96a4105ca99a48981bab19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675135054, "uuid": "cf0ccc02-7a87-45f5-a6fd-036f3d476376", "value": "T130D44941567B87E3C4B909B01438E47826A15CE18A6CB13ABDC67D7BBCFA74F009A753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675135054, "uuid": "924d0439-4782-479b-9e4b-82e5c923f101", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675135054, "uuid": "b458e336-4b65-4f4c-a2b3-3652941aa399", "value": "12288:sqNXsnu0b+NoexY/PrMERjU/u0pNQ5JGJNnuPG9TlT:rs3+NNx8PI/uSG5JG7nuu9Tl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675135054, "uuid": "20b91865-3720-43ea-b652-683926bad90e", "value": 630272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675135054, "uuid": "fa3d16c7-8a8a-42dd-be88-a5eac0de7009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675135054, "uuid": "928b5799-325e-4b83-b2ce-88dee2dcc2ac", "value": "f9ef1fe311686cb5fe268707df8bd971", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2972457-a104-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1675127787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675127787, "uuid": "1d9c7b51-8dd6-4d34-87a4-98c7a01ed4de", "comment": "Malware payload (TeamBot)", "value": "5d93b58581a18b4c80a881607f543c18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675127787, "uuid": "78e5df39-73f7-4a94-ad17-dae6505d9228", "comment": "Malware payload (TeamBot)", "value": "82fbb8602d6341312aab04e2e03696395281809b1b31ce1ad0ce6e4627b095a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675127787, "uuid": "ac4f6dce-62a3-4bd8-a714-5e5ed90f498c", "comment": "Malware payload (TeamBot)", "value": "9111b32f4e07f5fcc87a2f9fcc01449078bffcc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675127787, "uuid": "ba9dd5b4-7256-4f00-9eaf-4db0e2790b6b", "comment": "Malware payload (TeamBot)", "value": "154b0a4c0b94df1e02a74a37ce7f925731abbc05dc0b7d8a08308c8ab2b1518d29bfb755ce069665db6269e14d382fa7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675127787, "uuid": "9e9ea882-52eb-40d2-a963-9cf2709ffef5", "value": "T133F3E011B690D073C11359B42638D3957B7E69316AB6840FBB401FFE4F622E2673A363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675127787, "uuid": "3e0a3383-adcc-4651-b041-b0277f5b5c81", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675127787, "uuid": "08b962b3-780c-40ff-b81c-cb40fdd95647", "value": "3072:sjfmycb2LkS32c0kj5OAF9dxRGb60AZfrb0OvmO8:HbKLD32c0kgAFbLG+DFf0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675127787, "uuid": "29580f72-3995-4709-a76d-02a3015a0075", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675127787, "uuid": "b8b244a5-fe7a-4d54-8904-75b043cdfb23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675127787, "uuid": "ecdc449a-2554-4c98-8f37-3117b47600d8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "710d370a-a15e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675166251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166251, "uuid": "0105a078-0e5c-4fdf-932d-dcc3fd8b45e4", "comment": "Malware payload (AgentTesla)", "value": "29ce6a9bf2ee2d6fe4c67a954beb2587", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166251, "uuid": "190faf38-e395-42e3-a289-85f45a010119", "comment": "Malware payload (AgentTesla)", "value": "832ca5bfba2b2c48d64036b6d28506e4f56107b71fa684784b57acb17ba68a0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166251, "uuid": "827354b9-7568-4e3d-b7ea-4f454110371d", "comment": "Malware payload (AgentTesla)", "value": "e1ce379ae6c7aa0ec3c63ffbf272584150845435", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166251, "uuid": "f46317ef-1b07-424c-9b10-a6d953d1dc9d", "comment": "Malware payload (AgentTesla)", "value": "dc6368c0e637b8eab415d7edbf0ad40cecdfd0574742e3b084eedb1e81e47615359acf6316ca0c5b0a95ace132790f66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166251, "uuid": "0919082d-92e2-4bb1-af62-39a4930ab8b2", "value": "T12DF4D33D99765ED2C23AF9B1C6E1C420B5AC81C23313CB5DDBD61AD84F096826EEE51C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166251, "uuid": "bc0fe1a6-c87f-4f73-a0bb-b1c832d39b26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166251, "uuid": "1cfe1267-5723-4e82-a40a-99adfe9cc464", "value": "12288:lXrNRk440+w0DtzsROLdrClNDndaIuxAe/CE1OOGOO/OO1oljwXOGPah9TWIgyMY:d6zsYxcNDndNuxAe/CEhKpP49ijyEi8q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675166251, "uuid": "73ca6c9e-980f-4a94-ae70-0a994339a441", "value": 741888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675166251, "uuid": "668ea6bc-d87c-4269-b748-2e270ddfb08d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166251, "uuid": "f5e29e95-b27c-4938-a267-078d9b88e901", "value": "Fwb; Bank Remittance,[90,000,00,].exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39432b6f-a173-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1675175177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675175177, "uuid": "fdd2d24f-9dad-4e1f-b45e-88f0e854e601", "comment": "Malware payload (zgRAT)", "value": "42a1df8c09d5b88458b460dcc8919ed8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675175177, "uuid": "dbb6a9b6-0ef9-4360-93df-4f025d07bea1", "comment": "Malware payload (zgRAT)", "value": "842ff8028ad6540cbad1190e12b1867d98e604d8694bea0e82f866d7311b4a4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675175177, "uuid": "e3a484fc-0a9e-47ce-8b1f-2e4664cd7d55", "comment": "Malware payload (zgRAT)", "value": "2b97bcaf937c255144043727dacd5eb1fc0e6191", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675175177, "uuid": "b51619f9-7a8b-4c8f-96cf-b29b738f0363", "comment": "Malware payload (zgRAT)", "value": "aa67317220ded77fa237561736e8565262305b6d38fc719575154384ec6f7e71051c4b8a717a0686e3971216b1ae27ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675175177, "uuid": "80607072-de3f-478c-92e3-aee4e716e02a", "value": "T1B3456C407BE8EA27D15E5772F4A241244BF0D806B753FB4F26A8A5AD2D437407C892FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675175177, "uuid": "a4e7fe56-d748-413f-ba4b-00294668f99e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675175177, "uuid": "026f5494-8b09-464f-9eae-7bf22530447a", "value": "24576:tCaVcl5731qq27uovjgUpf7yJ1rga/v7f8suwB:tCWSqjH7Srf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675175177, "uuid": "ae5cc329-753e-4845-a617-bd25e9ec2995", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675175177, "uuid": "544e2a9f-a899-47dc-a770-d2b94aa421a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675175177, "uuid": "470309bb-46d5-48ef-92db-b56837bc0d68", "value": "dloidddexeEncrypted.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56a187ca-a143-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675154610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154610, "uuid": "b7dc109b-62a5-4d48-b21b-a72a3bed827c", "comment": "Malware payload (Smoke Loader)", "value": "9dcbedab4f0369334d6412a485751210", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154610, "uuid": "1c006f16-8c5f-4b60-bfac-1db585e7db95", "comment": "Malware payload (Smoke Loader)", "value": "847fae0cc7df2ada1054936735a296be29b08ff49f90ffb4378c637e369dc410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154610, "uuid": "5184780c-96b4-4c07-9911-085bac2cce05", "comment": "Malware payload (Smoke Loader)", "value": "f31dccad206bf314e741f0b61ef513af7e00e3aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154610, "uuid": "cb230bd4-449a-4e48-ad66-f0d9e1f94bc4", "comment": "Malware payload (Smoke Loader)", "value": "7dd224d9bf4c4867ad2d2e0a54da0e4ad42fd0b088a94fc9a943ccc5ac8367d05709a8b7995480c78abc7aa85d683e68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154610, "uuid": "b2d18091-c22f-478d-adf0-b17907e51f02", "value": "T182548E42B291BC40F5668A77CF1ECAE4F51EB581CE08A76523189A1F27B21F7F762701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154610, "uuid": "2f8f499a-1c3a-4d66-bc73-e7aa66d8cc79", "value": "a2c8bd590ac12702f85d4107db46f8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154610, "uuid": "9baefcee-2cce-408f-8df6-1f3267fc3a8e", "value": "6144:4OYbCLpALLZtlVkoxFEFBF497f4VSL9q:bJ96t7F0BF49zO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675154610, "uuid": "bae5c669-abaa-441a-8473-593fb7136ff5", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675154610, "uuid": "712db24c-5ba2-4982-9e48-88433a4abb05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154610, "uuid": "8acc666d-e388-441b-82a3-b1478486cc7d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06d7244-a148-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675156935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675156935, "uuid": "a5c659ad-0238-4b31-93b6-9f645f4a2863", "comment": "Malware payload (RemcosRAT)", "value": "1b7fda525abb7145a0cf5099a2bb0124", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675156935, "uuid": "69c289b0-b98c-4f9d-9366-f0b94b76f3e2", "comment": "Malware payload (RemcosRAT)", "value": "85420ddd075768164031bf43563925bff88c5b298d7924ca95fe1cb0519dd76b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675156935, "uuid": "cdf9e678-b4a2-4951-a935-6e1cc7bb8ead", "comment": "Malware payload (RemcosRAT)", "value": "5f0445d82f2f59d66d74df0f321bcd63023a87c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675156935, "uuid": "1a1f8a8c-a2f0-4f9a-b952-5f7ed62d9d17", "comment": "Malware payload (RemcosRAT)", "value": "721b826b0333f89d192840226df98c91361263d714d3428cbca85762b0be32305f1db00c02a862a94324d152b10e285d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675156935, "uuid": "ce36af89-0c48-4ad8-8a8b-e17c52918338", "value": "T161D1D701E39A6232EEB64B37AC7353410278F351A817CF9D28D5605FAD17298C662FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675156935, "uuid": "2e72317f-c927-4ff2-acb0-b56dd40aa22c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675156935, "uuid": "d2952d3d-b209-4d34-992f-ae04e6e727e5", "value": "96:rmc26N/JsNp8syjxQbw3kBFWkhL6CFRQt15vr3F6JNQikFtCaX/BzNt:rfJRW8HxswUnWaL6YG5vDMoFbX/D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675156935, "uuid": "a8c191ca-d7a4-4941-9890-eb20c0c4ec8d", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675156935, "uuid": "4da50c00-6888-472f-a3ef-9d8394eda621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675156935, "uuid": "c9c2ba54-529a-4475-9a83-6d6a2e8fa43c", "value": "Request For Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18a39550-a13d-11ed-88f6-42010a9c006e", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1675151929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151929, "uuid": "4c389dcf-7a38-4c4d-8a9d-34cc5c73266e", "comment": "Malware payload (SnakeKeylogger)", "value": "5d6f0a15f41a268461003036aa5f4066", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151929, "uuid": "968cde51-7a48-44a2-8bac-a16d49e86089", "comment": "Malware payload (SnakeKeylogger)", "value": "86ad4fe5295b34f09988a3baffb53aff6f7e48b5daeaed222108df83367397f0", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151929, "uuid": "6d06e686-06a9-4cde-963d-3b6b8f9473f4", "comment": "Malware payload (SnakeKeylogger)", "value": "a8ec07099c0c3a1d3f0f3cc31f839cb3c121a7a3", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151929, "uuid": "ea059613-8bfe-471e-b9e4-2f4de8ee1d39", "comment": "Malware payload (SnakeKeylogger)", "value": "7eb8fbc4150cdf2eb362c29d4f0a47a560dd444182811d4ecd11e6dac4c4ae0886d0a290d443d59e2781761d87911ca6", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151929, "uuid": "62b9dad3-3523-4d25-98b5-72a325fc4140", "value": "T1A4516D08EA19DBDE1670CC55882A2371BC1A53565DC6A124D9EFFB4B8B188E716CB202", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151929, "uuid": "955a590e-4a72-404c-bf90-f9012d952588", "value": "48:ZSBKoMCZsH0aFHjfrIv37sEcsobILjkrG1jy1JhsV7viYbss5jO1vNbT9idBsNTx:ZSBKoXs0aFDkCso+IrGw1J6V7vieswOF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675151929, "uuid": "9529bbca-73ab-498f-b98c-d4e4c8ad561f", "value": 3012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675151929, "uuid": "4ea1e0b5-0c2a-4c90-85a6-006e69e04b29", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151929, "uuid": "8d13772f-3b50-47d6-a78d-b430a3f408a2", "value": "STOWAGE PLAN.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbf2ca1e-a143-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675154807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154807, "uuid": "40c4c9f0-d84b-45c4-af5e-21681949c9f2", "comment": "Malware payload (Mirai)", "value": "bf9d7e68ebdf4c9723d8a4c5789bf46d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154807, "uuid": "32b53070-c44a-4c36-96de-254a8ce30fe6", "comment": "Malware payload (Mirai)", "value": "87989ad73bb00ae2b3d81b6fdd31c10290504beb454d385c4891551ec9274db8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154807, "uuid": "4de68011-b1a9-4d04-92f2-9be789f79ee6", "comment": "Malware payload (Mirai)", "value": "6e26e4191971a3f487ecb78c614e3f84e09ae639", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154807, "uuid": "b7ed8a8b-4406-4518-874b-39d448cf0c6e", "comment": "Malware payload (Mirai)", "value": "47791acb1f247c2d6c0901f995f604327e6395a22c4cc2e4e5356b9d3ee61cee4e56f88fdc357c100660b4c94a0c971e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154807, "uuid": "3945586f-4581-47de-8d6f-f04761034a01", "value": "T1DFA3D606BF610FF7EC5FCD3709E92B45198C550A22A97B327A34C818FA5B65F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154807, "uuid": "cdf5cf51-77bb-41d7-bd7e-45e1a61dd9ee", "value": "1536:wK2QYl2bqhAnRHUSBWZg/zjzjyQYTUPMBSEYzqZbh+W86:wKnshS0+W+HzuPfYzqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675154807, "uuid": "a771afe3-89aa-4803-8229-b83a30e0e99e", "value": 105780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675154807, "uuid": "c6a5eaa2-90dc-44d5-b7a6-dee87971ed8d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154807, "uuid": "8d993495-6b97-4370-8cae-592ace4250b2", "value": "bf9d7e68ebdf4c9723d8a4c5789bf46d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc67d0b-a129-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675143402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675143402, "uuid": "6317219b-b6c6-442a-aada-f296815c399c", "comment": "Malware payload (Smoke Loader)", "value": "54284e6ecb72c4ecd0a4e33c8afe8541", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675143402, "uuid": "14c753d8-ddab-498c-9600-a7f66b9a3579", "comment": "Malware payload (Smoke Loader)", "value": "889089c1927f104b687c3d6845856bc351ad192d1d50c43aa77f13e96e0c9284", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675143402, "uuid": "ff2c3f1f-d22a-4bfb-b601-8e8b14c90ce1", "comment": "Malware payload (Smoke Loader)", "value": "55cf4c0183bdb3f1f2dba397dad8d11a4a219889", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675143402, "uuid": "90f41e73-1eb4-4e85-95e9-9f3272b4b4c8", "comment": "Malware payload (Smoke Loader)", "value": "cc8b140cfec95b2eb79ecdcfca55903c6ecedf7bfbbb6142a533115667fe45a5ebe4534d4f705325c30e98a341c73bdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675143402, "uuid": "f8787a5d-b7c4-4fd7-8ebc-ad0e540be531", "value": "T1B1F3E026B650C033C01125742439D3556B7EB9321ABE9847BB811BEE4FB22EC677D367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675143402, "uuid": "3612483f-fe5f-4aa3-9eeb-9abaae710b1c", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675143402, "uuid": "3136f559-25ef-4853-b03f-8a3f9719d8f3", "value": "3072:Sj24CKWLU1c0vM65LJMM1eaObyQi9DCLhoC82qZCW7:UmLyc0UWMMwOQuDCLhofl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675143402, "uuid": "849c32c8-27bd-4cae-a5ea-4b7dfbf84fd4", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675143402, "uuid": "5b02d08c-c5ce-40e8-bb58-31c92dc44873", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675143402, "uuid": "18106c27-86c1-4a8b-b631-bab798becfe2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84344640-a14f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675159841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675159841, "uuid": "34fed2bb-8444-443c-af1e-21f13c6a32af", "comment": "Malware payload (Gozi)", "value": "b79471183dafff2c64bd5c9c737c0ea9", "object_relation": "md5", "Tag": [ { "name": "2nd-stage", "colour": "#D6B2EA", "exportable": true, "hide_tag": false }, { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675159841, "uuid": "9f29cd4f-90e0-4668-a940-6745ed7953eb", "comment": "Malware payload (Gozi)", "value": "88adde1c67af1d13fbcfadc97833449e884d24ac0bf13fd47c8284a6611532db", "object_relation": "sha256", "Tag": [ { "name": "2nd-stage", "colour": "#D6B2EA", "exportable": true, "hide_tag": false }, { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675159841, "uuid": "ec8fc1d0-cc71-4add-a01b-17a5c078f1d7", "comment": "Malware payload (Gozi)", "value": "cc79069a10cfc4aff0a769695e878bc8b1c2344c", "object_relation": "sha1", "Tag": [ { "name": "2nd-stage", "colour": "#D6B2EA", "exportable": true, "hide_tag": false }, { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675159841, "uuid": "249041a2-f7dd-4c3a-892e-24c9536ef975", "comment": "Malware payload (Gozi)", "value": "3fe8b69547824191b167ce971c8dabaf35bee7d6498561a78bb24ecfebfc576e46b684cd80dc95fa6ab5a0a4dc5c348e", "object_relation": "sha3-384", "Tag": [ { "name": "2nd-stage", "colour": "#D6B2EA", "exportable": true, "hide_tag": false }, { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675159841, "uuid": "8661d30f-3459-49f2-8de1-1fc0ebe470a1", "value": "T1F7B3AE55B996C170E0C09E7628396637FD3F9D7D5B60823B6FD7E6E48DF2011CA0A282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675159841, "uuid": "3cdfc314-5f0a-4fb5-9c2d-fbb5334af9ad", "value": "fd0e2ccb5477f66b73c01659efb44b9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675159841, "uuid": "e4acaa6a-5f1a-4d63-b369-68480f64be87", "value": "3072:MklTvLbBVJeAOwzku8ymvr1QzkwsAWvVaUD:NTvxveAF8ym5QHsAcVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675159841, "uuid": "044c31d9-efe1-42a1-abed-a7b84dedb7f2", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675159841, "uuid": "219522e0-c01a-4cbe-bb85-167653fbaf66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675159841, "uuid": "f29298c1-ea73-402a-9f71-dc560a60ab56", "value": "2nd-stage.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61a51f55-a15d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1675165796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675165796, "uuid": "302b7763-c26a-47b4-abea-e4d774a7cb4e", "comment": "Malware payload (Guildma)", "value": "8a2495ae5bcf5e8472a7f54f8ee9c87c", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675165796, "uuid": "c0ec872a-dccf-4290-96d2-0eff8653700f", "comment": "Malware payload (Guildma)", "value": "89da2eee6af1c267e164bd9b24866bcac56588fe67efaf3bdb9aa98afa8cf990", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675165796, "uuid": "cd59a856-0867-4f64-b591-078fd4d00a52", "comment": "Malware payload (Guildma)", "value": "7996b4a64d251a0fdf89c4ca3537bccf94b80a44", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675165796, "uuid": "9135118a-5266-46f7-ab84-8dbe3a69e565", "comment": "Malware payload (Guildma)", "value": "9f89586b47f8fc8acc5cead9ce59750bc8a89c0da2fb774a9d1e8eb15675eb0f31438454e9b2e112805e61e3588b95d9", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675165796, "uuid": "5390e162-b1a5-42a4-8ede-e8d74b987ca2", "value": "T122E072AE69882E342C2E3CC38BC00F107B5DFE830A4030230BEA03628169A408A6E35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675165796, "uuid": "cc237e34-ed7e-4f4a-8562-466fcc41b027", "value": "6:SGIfGlkxcvk5IjncEZhcvk5wkPOAIjdsLp0OmesAvrmsXerV63Uj1cSJJqaH9EWQ:Qgkxe5D5hex1tjdsLKOmesAzm74Uj1cB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675165796, "uuid": "3bbae567-1903-42c3-8b44-07f5da91b911", "value": 305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675165796, "uuid": "595eaa8f-65f3-4bd9-a590-6bcd595a3565", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675165796, "uuid": "ab82fad4-01b1-4c41-bbab-f071ea1a8e08", "value": "8a2495ae5bcf5e8472a7f54f8ee9c87c.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1426027f-a136-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675148915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148915, "uuid": "77c7b71a-37c2-4302-a6c1-5d90c3fd61e4", "comment": "Malware payload (Smoke Loader)", "value": "6c7c7bc8390f431d8f5841225e30eff4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148915, "uuid": "af7e6c66-3305-41af-b4b1-0aa680d7aec7", "comment": "Malware payload (Smoke Loader)", "value": "8a72b8af4296b3c3fb9aaaa316ca5b0f5049b215f27f846965afdddf9a001e89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148915, "uuid": "3efb2a2f-a561-423e-a0a8-084a3ea8249a", "comment": "Malware payload (Smoke Loader)", "value": "60232959549f6f01010b09cea5c434600d91ff13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148915, "uuid": "2fdcaf73-50bc-483b-aa4e-af00034c99c6", "comment": "Malware payload (Smoke Loader)", "value": "e8805a3d92ccb7c2bfa9222b085abcbdf6e40d3180e9e9013c4008152c9bae811e6e948608c5352c69c3fd6f50e354ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148915, "uuid": "87a9ae6c-87c0-4fdf-b7a0-0059ae266a1f", "value": "T18F548E02B292BC43F565CA368E1EC6F4F51EB591CE0CA7666318AB1F25B31B3D762311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148915, "uuid": "be64fd10-1839-4a7d-8fba-8180400d9808", "value": "a2c8bd590ac12702f85d4107db46f8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148915, "uuid": "8fba9056-82d7-4e0d-b084-3717cbdb6501", "value": "3072:fXuHF9+Ltb7R4rhVSIb5u3n8qc9u2pNMpBnxVnaTc7f43H7BFDPRCDR1:Wl9+Lt+rPSIban8bOnxgo7f4VT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675148915, "uuid": "72fd5d77-d908-4d7d-83d4-5f2e0fd4e21b", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675148915, "uuid": "aaf551eb-fa2e-4a9c-bc45-aba72c32c9e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148915, "uuid": "0520e052-43e0-4938-9b76-c387b279b1da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c02ae5d-a18e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675186939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186939, "uuid": "7738d39a-e9de-4dbd-854f-2c4c75dba091", "comment": "Malware payload", "value": "c6f4d7972d271013dd2588644330d0bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186939, "uuid": "b4818b53-0c45-4508-b1e3-c10efe2bfa94", "comment": "Malware payload", "value": "8b4e8c2d8b4e9876d6e4dcea91200191b45e9240dc630dca1501263c206811d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186939, "uuid": "4c206d41-8247-40f2-adce-9d85dcffa1b4", "comment": "Malware payload", "value": "e8d1cd3b32942f269d931ab54549cdacc20169af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186939, "uuid": "3cb6c2a3-3998-43ae-b9d1-6e12bcb14b6a", "comment": "Malware payload", "value": "66965767f28d1fe3e2b8ad48afcf72f071ed25b21248168d03c99122f9a273b3abd5aabc0d34597a73f1944e78e8cf7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186939, "uuid": "193f2f12-9be1-4553-9471-fa81b7dc21f6", "value": "T175548DC27EB27C62E9258A718E1EC6F8751EF543CE586766220BDBDF16B01E1C5A3301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186939, "uuid": "747220e8-f5ff-40e9-9bc7-744570ff70c2", "value": "9c039baca0968dd2f90042d865dd6c2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186939, "uuid": "2cc21bff-ec78-431f-b56b-fad8015e0c8b", "value": "3072:E5ubJmLBdRAfCJ0O65BoibDMuNn6Os0vk6gVx/atmqPUx6WfQz86vE3MMo:dbJmLB0fIdkBgDytmqMoIWE8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675186939, "uuid": "2507a0c2-03eb-4818-aada-a07524aec0f9", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675186939, "uuid": "c05c88c0-82a6-4d35-ac00-72967b8b43ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186939, "uuid": "adf7d70e-db95-486d-b6f0-2be74c4bbcaf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e63ca7b-a17e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675179990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179990, "uuid": "ca310a8e-afcc-430d-a869-bd1831eb1c39", "comment": "Malware payload (Smoke Loader)", "value": "02a3033165db55c9631c75ea4395cc8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179990, "uuid": "946d932d-2eb9-42f2-a9bd-85d5fce1a643", "comment": "Malware payload (Smoke Loader)", "value": "8b64c0872f03396621fd5e8075aacc1608eb6a3401f9df29374139a9cef149a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179990, "uuid": "7ebc61b4-18c2-4c6c-a25c-c649ea83337d", "comment": "Malware payload (Smoke Loader)", "value": "58bb01a711c059f9976e3219804907237507ab97", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179990, "uuid": "a716ce23-a7b9-4284-ae7e-de01e3db6cf0", "comment": "Malware payload (Smoke Loader)", "value": "7605770938712f9fdc97f3d680fe2725dda3b941c5807a8db15f2c0171d7e6c22cb2f3d744cc0254a2d02c791d73a793", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179990, "uuid": "6adffdc7-48b3-4e88-b7ac-13b40110b19e", "value": "T19F548DC6B6F37C62E922CA719E1EC7F8751EB5424E487766120B9BDF15B01E2C2A3311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179990, "uuid": "e0e96f48-4810-456c-97c5-55b43d9d9e63", "value": "e73db8d7bd9f9f6b2076d026a8fb8fc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179990, "uuid": "acc6efa6-03bc-4363-bd4e-0d240bf7e4f1", "value": "3072:2IuNj3vLJMSRo2GBYux29bL+1rZwBjvqByEbcL4ck9j3s5JmqPUx6WfQz86Qu3MM:oB3vLJ+1xgArVyEbcOj2JmqMoIDu8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675179990, "uuid": "d11c322b-d63d-4fb9-99e1-92a3217e6906", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675179990, "uuid": "44ea13f6-1a66-4543-843d-c4531a318259", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179990, "uuid": "acac990b-8a66-4ad3-8a2a-8815732129e6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e55e66d-a140-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675153361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153361, "uuid": "b727c08b-50df-410d-902d-cfeb6072e9cc", "comment": "Malware payload (AgentTesla)", "value": "ddd0b286e3d2e192bec5beae7c9222a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153361, "uuid": "8ba944e7-22cc-4559-b309-c24e61572fd7", "comment": "Malware payload (AgentTesla)", "value": "8c61d194e68c94fcc2c577a5d61a697698c7aba068807c648e17ac4b93351dc2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153361, "uuid": "01c8e75c-2936-417b-81e8-8531a1ebde47", "comment": "Malware payload (AgentTesla)", "value": "e596553296fa9c52d6c8284782e918693891dbf2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153361, "uuid": "bc387fae-a07b-4b1b-a7bd-1d3ba165f4fe", "comment": "Malware payload (AgentTesla)", "value": "77d47311080ad16fa617f952320b21f9dbb98a963cc04790546910605dcdf23a82ed0934ccc9caf99f7f862904c63fa3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153361, "uuid": "09cd6912-6de7-46e5-ae22-d31ff1503bef", "value": "T10EF4E53D99760ED2C23AF9B1C6E1C420B6AC81C23313CB5DDBD61AD85F056926EEE51C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153361, "uuid": "38884fd3-13fb-401a-8253-95067fedce49", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153361, "uuid": "33ed04fd-2bb9-40d6-abe1-cdc647422f21", "value": "12288:S2T40+w0DtzsROLdrClNDndaIuxAe/CE1OOGOO/OOR8ljwXcd7wJErzqQt26VJYt:4zsYxcNDndNuxAe/CEUSKIiWOjHgiATk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675153361, "uuid": "db098633-68f7-4d26-a4a0-831e7848d916", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675153361, "uuid": "80e216ff-6c10-43a5-aae1-a618e4e6415d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153361, "uuid": "0bef5004-a14c-4823-973d-ed2a4abe7592", "value": "New Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78a9fd5-a192-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675188703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188703, "uuid": "88c9c90a-6790-47eb-82e6-686898493c2f", "comment": "Malware payload", "value": "695c917b8535e4354e00ce5addb9ce88", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188703, "uuid": "f0c61036-12ed-4ea5-8ed2-96229d3ad3e7", "comment": "Malware payload", "value": "8c62a40c17fa23f09b6040e3ed9f0d2f0fa175f1c6cc56352e98e183f5388f0c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188703, "uuid": "94d02197-00ae-4228-bb38-68a61a4bad77", "comment": "Malware payload", "value": "3f9f09c5026737a97c6dcbbc8155330472ce4cf7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188703, "uuid": "00a87d2d-3f7c-4d5e-a5ad-e96ced71aafb", "comment": "Malware payload", "value": "dbb856a4f64b3b5a361894b35cf26f207762fece4b1674934c2ff5dc0732951573d0a4395099ca42821b90ddbaa13df3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188703, "uuid": "7e57bcc2-df54-4547-bf08-56216c3eb1ea", "value": "T1BEE44CE4FECBE1D1F4071CBC02AA253B59BB13185838BB3AD4117E19D821286AD67F75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188703, "uuid": "bef83248-b83f-4cc2-b53d-8d8d2e091048", "value": "48ee4c9fac8d1206bb74064becdbc1dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188703, "uuid": "7c27e0c1-9dc5-485a-ad43-a8adf7995997", "value": "12288:4qwFxm3G6H4RyuHbR1MxnuTV/iV1Sd/NzQNfy:lwFxm3G6H4IuHbR1MxnuTV/iV1QmNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675188703, "uuid": "bc086495-c035-41d0-a0a7-b96bd36e6b5b", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675188703, "uuid": "21f48403-ef6c-4ca1-b6f6-b7318b55043b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188703, "uuid": "2c2c4671-0527-4ad2-a5cc-abd362042b1a", "value": "12826.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad72bb59-a171-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1675174513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174513, "uuid": "a544958d-e9bc-456f-8ab2-00874e4ee30f", "comment": "Malware payload (zgRAT)", "value": "76d99d4dcc95199854df9f4a021ac456", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174513, "uuid": "6b019edd-ec4e-4733-aaf6-34e98bb9c1d6", "comment": "Malware payload (zgRAT)", "value": "8caf0002caebfae941f4cefefea93d663a6823f5bbe1ef1bafbe757bd7edd0b5", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174513, "uuid": "318a1f25-08e6-4d3c-89f2-719f7de1e5f4", "comment": "Malware payload (zgRAT)", "value": "576a004df6b122f3c71c07397eea1f854500100b", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174513, "uuid": "2830eab3-26f7-41c4-abdb-6ffa0891bf1b", "comment": "Malware payload (zgRAT)", "value": "4ef018ebef75d1d48ed8036e661944ea9b7ae8fc2595bcf5f3275aac833e9f17d99bf1ae789ef72299f08c39ba05c32c", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174513, "uuid": "47473940-31a2-4d65-bbba-1065996e8a1b", "value": "T19205335C2D88E77E8B6B08166A68155C1C707A46D0004DB364FF9A450B63D9BFF3BB2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174513, "uuid": "b7eb1c35-ed48-4172-a236-1a12662bb868", "value": "12288:ZML7nvXmvW+6cMDpogJZBurXM4cBNOq1RyosK/KQnp30lNPKRiDIiELtHxuxarm/:AmvWSgGYWuRtBpp3CPMiELuxQmEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675174513, "uuid": "e2fc5a7a-3dba-434c-ae3e-70c98d37733a", "value": 832203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675174513, "uuid": "4748406a-77f7-4c34-88a2-b95a78089412", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174513, "uuid": "65b6fcd6-4740-455a-840e-e36c4ba1cda2", "value": "..Facturas pagadas a proveedor.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2d017f-a152-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675161012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161012, "uuid": "87fb6c4b-3c48-4646-89a3-97607e56161f", "comment": "Malware payload (RedLineStealer)", "value": "530fddfc96096fdb7db2472417d3ec51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161012, "uuid": "6f6f3d24-e0f3-4c94-b888-436135130318", "comment": "Malware payload (RedLineStealer)", "value": "8d9bc69a49cd6d0e26c0dababd07868ba3e172f16aadc39cc0f4b114a35317e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161012, "uuid": "e22e3e65-1213-4f9e-8bd2-0e6c4aea557a", "comment": "Malware payload (RedLineStealer)", "value": "4b8f6df41dd7341b2499b59aad60c4ca57cfdd59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161012, "uuid": "174adcb8-7af4-43a5-be62-8c4c2595fda2", "comment": "Malware payload (RedLineStealer)", "value": "1cb2ad2f6ff104c3526b10690e61d516c6c836e9918ad9c819f746770019f44e9ec15fe29eee556a2e4d48264e225ce5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161012, "uuid": "141dd3f5-e815-4e91-b6f1-b8d9f01ecd43", "value": "T19284C002B2E1BC40F5628A758E1EC6E4F51EF492CE18B76623197E9F25B31B3D762301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161012, "uuid": "b939ea08-ac85-4dad-b0dd-bc139f8514d0", "value": "a2c8bd590ac12702f85d4107db46f8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161012, "uuid": "bb450348-444f-4a28-b8ad-ddac224fb816", "value": "6144:sWPoLnG7mpHPFydPsvYTUyxK5XChJQoFOcRgPQ2m7f4VX6Stn:7ATNdMcY1K50FZMQ2mzOXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675161012, "uuid": "8f9aacf5-575a-4bcf-a72f-464e784e942b", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675161012, "uuid": "76488460-b000-4b7c-8c2c-db6305ce72a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161012, "uuid": "a690df26-cfac-48cd-88cb-7053acb8c519", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52f792bd-a142-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675154175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154175, "uuid": "317341f5-7ee9-446e-9b32-86d4e786c859", "comment": "Malware payload", "value": "dd28f9617937d0d3d1b6048e90d0ce37", "object_relation": "md5", "Tag": [ { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "senseofswitzerland-ch", "colour": "#B73529", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154175, "uuid": "228a2fd3-18a3-472d-b053-166cb292aedb", "comment": "Malware payload", "value": "8da542e5c115ab1a103b50d6c1ee952413dc5e73e40fff51066f7c377e4b4b79", "object_relation": "sha256", "Tag": [ { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "senseofswitzerland-ch", "colour": "#B73529", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154175, "uuid": "43dd9e7e-df78-4302-af2a-1aced7b46b3a", "comment": "Malware payload", "value": "db3ff4dd2093ad3e6507836fe409a0860d0c5305", "object_relation": "sha1", "Tag": [ { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "senseofswitzerland-ch", "colour": "#B73529", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154175, "uuid": "cd203504-9668-4a40-9975-bfc9c63e808d", "comment": "Malware payload", "value": "dbdefec3dcc5aa1cb3c29e6c4b21242f0cbc3fbe0496b385560dd16d82d31318c1ed230062e7570719dfdf359c113652", "object_relation": "sha3-384", "Tag": [ { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "senseofswitzerland-ch", "colour": "#B73529", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154175, "uuid": "c454d462-2261-49d5-8792-685821c8f369", "value": "T1CF35709FC93E30D2CCA27AA53E60F49E6B51CC635C1A0924FA457A18C82FE7D11DD729", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154175, "uuid": "953d9b99-999a-41dd-bfa7-3171cd5bc625", "value": "6144:hC0aKmd1e+Zlk4U9eG2OsCdvoa9z9xHbZtotigWVjCW8XVHEIQCXJHNONn2tK7j7:R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675154175, "uuid": "84f36486-24bc-484f-874a-c97e9c0eae44", "value": 1154709, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675154175, "uuid": "27aedc1d-1ba8-4552-b444-0daeaf5cc7d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154175, "uuid": "6c7d87e9-6815-458a-8f83-82b3a7c31ada", "value": "t19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b0267a4-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140471, "uuid": "3803021e-aedf-486f-b1a7-02c6358760c1", "comment": "Malware payload", "value": "70a050307f0c0bd2ddeb2bd84a130d13", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140471, "uuid": "a411982c-29d3-41af-ac3f-949e0480c694", "comment": "Malware payload", "value": "8f7dfadadf9644d2e56c9f1b1c8931f30d7b56067057e5d55cec3ba44125d82b", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140471, "uuid": "5a9052aa-fd1c-4e8f-9fdb-020403d5bf07", "comment": "Malware payload", "value": "50b0bf4157c2e0a5abf83ac7ecdcbbf3970ec5b0", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140471, "uuid": "3dcce3d7-407a-4160-95c6-72825bb8ea24", "comment": "Malware payload", "value": "3bbacf1c6c9a88298e6f310bb3816b3ec64002671f32bc923d7f149f0affd3163fe01bc33b27c884c3567cb26eb1b23e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140471, "uuid": "3e8f80b7-f87e-4ed9-8624-a3d22df0b8e6", "value": "T159363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140471, "uuid": "2231d571-4d77-45a7-9746-521c3b16904a", "value": "98304:Bv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXW:BvpvFa+g8RWLdPk/84tCEr0RtNiC5eSn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140471, "uuid": "80843c66-3f5a-4cf9-a750-37d4589a751b", "value": 4993024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140471, "uuid": "ae171ee8-de45-4cf5-8d77-9a319af81878", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140471, "uuid": "f9182dab-c145-403c-91c7-9936f7177281", "value": "8f7dfadadf9644d2e56c9f1b1c8931f30d7b56067057e5d55cec3ba44125d82b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c326d487-a172-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675174979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174979, "uuid": "2e87f5f6-e05d-4f15-a80d-244f9c11ea9a", "comment": "Malware payload (AgentTesla)", "value": "9005b8a2f7b988823c308b0a5e5bfe2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174979, "uuid": "aac8bccd-36ba-411d-a7c9-2ea104a09ca1", "comment": "Malware payload (AgentTesla)", "value": "8f8a2c67fb8794fec52060bda086b85a4e9bbe5d50ad03320377aa6f67f7bbc0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174979, "uuid": "ea2a4c26-8870-4d60-834b-a1ce9f5c1c56", "comment": "Malware payload (AgentTesla)", "value": "9b5c43527990f98ed308c1010cfab792e422c9d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174979, "uuid": "393d34b0-95b7-49fe-9ee0-e329032bc458", "comment": "Malware payload (AgentTesla)", "value": "512ba99931560cb1c82f24838d0a902900c588174156d2b0afb77cc9b1e83d5a2901eafa82feb989a47f3790ad7d9eaf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174979, "uuid": "de7892f9-8fab-4448-8820-22eb988a6150", "value": "T1E2158D456D9B607DEC6ABD3A91FEEC27D62096D1035FE530D0E61DE888AB281CC44FB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174979, "uuid": "98668d3d-1bdb-4a1a-8e16-83a4b741c70f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174979, "uuid": "d6b031af-5443-4f23-80dd-a39b96fe03a5", "value": "12288:3ZFa2iN1OZEc8EPfiRcAO1zGGii7z4I4zISBetoVnjarkrhFr2HboZMEJmbk53jA:61j4AE4cAaVii7kDUYYoVnmAr3uEZM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675174979, "uuid": "f67fa3c3-4ab3-49d2-8892-a387d3c583a7", "value": 901632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675174979, "uuid": "88370a7e-400e-42e1-9a5f-a8b589b0c705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174979, "uuid": "3a165e5d-c66a-4e33-affc-de4ed96d6b47", "value": "Project Tender Proposal & Drawing Specifications pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d9b1af-a149-11ed-88f6-42010a9c006e", "comment": "Malware payload (FormBook)", "timestamp": 1675157369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157369, "uuid": "92586307-3971-4282-ab83-3dbad0ab294f", "comment": "Malware payload (FormBook)", "value": "27cc1e52c4ee58d03609c8acd0b5ef48", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157369, "uuid": "cff2d12d-9f0e-4173-82b5-845faa32341d", "comment": "Malware payload (FormBook)", "value": "905812fe6ba672f12e7820d11febaaa84d046e8dba59d38147ea4330624aa932", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157369, "uuid": "c0d24798-083e-4a05-86e6-d5050abdaff3", "comment": "Malware payload (FormBook)", "value": "8ed728e0fa05ae2010c9b431e613717287d69c59", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157369, "uuid": "9a6084d2-e767-4d00-b3a4-ff7997f65dd2", "comment": "Malware payload (FormBook)", "value": "6dc1bdfb18683d0d383b8e504ecd128b31773904d8fd1a26143bff777978ab0a667fbaf4b550d5273009c616419d84b0", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157369, "uuid": "17a6180c-350a-4b0f-847c-df55776310c0", "value": "T1415423A6FD57F8AB99860EBD051DD390410A2141F8EC8C4EDCA19DB6FB460BF6A0D631", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157369, "uuid": "3cc2359d-0fcf-4bed-b062-db8b67f4b257", "value": "6144:ZId4gORVA2k9cO3B1qTeTubhVPgoQqF0Ms0sBOQu6VPQ9gncK:K2DAXSgqPbnIoXPrsBTyk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675157369, "uuid": "068e34a2-d15c-4042-b42a-66c1985aa02f", "value": 285113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675157369, "uuid": "1a2e2706-7365-4e03-9d9d-27e0a07396c5", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157369, "uuid": "70819143-369f-4997-bcd7-049895864612", "value": "Paperwork.pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60faee85-a179-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675177820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177820, "uuid": "3f9f57a6-9e52-4125-a955-a831241cd047", "comment": "Malware payload (AgentTesla)", "value": "1cce91c32aa41200d5e1b635d7821f9e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177820, "uuid": "1ab941be-d03d-4aa3-99ce-e841c59619fa", "comment": "Malware payload (AgentTesla)", "value": "907b52c6e9a4b8fd598266e523ddd1dc11b7e2a9cf7898b896d7039f8b45dda4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177820, "uuid": "b89e4982-fbeb-425d-b79b-99d5c9ad66e5", "comment": "Malware payload (AgentTesla)", "value": "c1e800c42990352ecf452507da6ec0ebd9ccea72", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177820, "uuid": "d89f1b98-7d2b-4d81-864a-0b16797606a1", "comment": "Malware payload (AgentTesla)", "value": "2b9f7fb9b2f05a38aac583f227853ec7e729ac3b2a6211417692252581573e3faeb9629a24ed3dca5b21b7954dab9bef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177820, "uuid": "a00f35b8-130b-4fbc-b6b4-6eabdb6aa7df", "value": "T1B5C4232221F893A9C77D07FD83F3582052BC5F64AE4BE7095E4961FC091770A5B62BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177820, "uuid": "4ec21632-4dcc-4483-91ed-eaa038ffc3c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177820, "uuid": "e73d79dd-b68b-426e-97f0-147b6f598567", "value": "12288:AiXgM6dnn8qTvA/hlzx9X3FXUQUqGFr8z9i7+pv1CWtO:rXJe1DmXzvVXU4GFr8zw6R0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675177820, "uuid": "63d1d93e-d161-4b3a-a886-9c19e06f4a65", "value": 555008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675177820, "uuid": "18ffe06d-b9ee-4c6c-abb6-a9f75e4afc01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177820, "uuid": "cb418f7b-e430-48ef-aa54-639d8d9620bf", "value": "DHL Documentos de Envio Originales.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "515795db-a192-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675188532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188532, "uuid": "e3861d15-dd28-49b2-9b8c-cf7569771e39", "comment": "Malware payload", "value": "2440a04729b9bd1f677f83d326b37898", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188532, "uuid": "a0cd95a0-40cf-4cf1-83c1-a4ae03677ef1", "comment": "Malware payload", "value": "907e75030b0e09cec6524f612f1c7439b5260b57b43d515968f81ba69278ba77", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188532, "uuid": "399b85dd-5357-40a1-8bf2-d61f813f50b1", "comment": "Malware payload", "value": "1f971cc88897965f337e516b693820aadd3acde7", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188532, "uuid": "4f4a39b7-9597-4550-b02e-7c5ef37245af", "comment": "Malware payload", "value": "d0038cfa9aef2a6731854d897d7e190424a4c3cbce86f37b2aa78120725966c0e45b742450dbcc35d3972a686fd2fc84", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188532, "uuid": "96229db2-ee42-4f83-abcc-cc93a49b3e69", "value": "T12065E0134817C01BF58BC57A4B18B24975A6914181A35750383D3FBFBAAE48F9EDBE2C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188532, "uuid": "570349b2-dc47-4217-be8f-a7b966fa4e24", "value": "24576:EPlRg+gvPlugUPlcgiPlggrPl5glPlDg6PlLguggPlugOIp9gZLHBFM13HoHqDi8:E4dvDUhixr8l26SNgrRp9i7EayI4N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675188532, "uuid": "dd43a737-662c-4076-98b2-74c58a654913", "value": 1515280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675188532, "uuid": "4dd99424-8579-4f2b-9fad-6e1194103db7", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188532, "uuid": "240ca8cf-6516-4724-a3bf-30792af5ecb8", "value": "test.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0edf0846-a156-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675162650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162650, "uuid": "3e26b5de-1dcb-48d2-a429-630fc52ff096", "comment": "Malware payload (Smoke Loader)", "value": "c8558073caf7732e00775c381de062df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162650, "uuid": "e63ab1e6-3709-483d-9672-d07204259f32", "comment": "Malware payload (Smoke Loader)", "value": "907e980b9def683645f455e71b2a8fd35241147257481a9181a698b8f86ad9a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162650, "uuid": "1c801a8e-fb97-4196-afca-5329c053265c", "comment": "Malware payload (Smoke Loader)", "value": "c5c51097f6957cdc2feef36d40929bf5ba54cbd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162650, "uuid": "bb172287-fdc0-4375-8eaf-5ae33efb15ac", "comment": "Malware payload (Smoke Loader)", "value": "8ebacfd274c2b43401d411ca372f71c1d9a75107d654c184b5d503614be6ceab658c527e220459fcde9ed37980d6c50e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162650, "uuid": "7adfa19d-d85b-4b52-9e7f-e4eab1ba73b8", "value": "T18F548E02F2E1BC41F96686759E1EC6E4F51EB991CE08B76623186B1F25B33A7C763301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162650, "uuid": "a3c5c0b2-d227-4d53-a82c-fb372e0db863", "value": "a2c8bd590ac12702f85d4107db46f8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162650, "uuid": "b7290b21-2dd8-4ccd-b85b-504d9acd901f", "value": "3072:EPuAdceL+0d77R4YZhyy7gNGsG3MbknhnISLKV7f43H7BFCRgt0JRCDR1:zEceLXdeGEyMNXG8bknNG7f4VQ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675162650, "uuid": "82040715-a2c4-4066-b4e7-5ce7cd9f8a85", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675162650, "uuid": "885a8be3-0ed2-4a97-9360-729e6fee824f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162650, "uuid": "91df03f3-299b-4ead-a995-2e2d0e7d914e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c840e88-a1ac-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675199717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199717, "uuid": "68990596-47cb-4c40-87bc-20f9e8c9f2a9", "comment": "Malware payload", "value": "41aa687eb6c51c5f5e7c8a0b1e80e0fb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199717, "uuid": "cdf978d3-6e2b-4520-9f68-3566c42dd6fa", "comment": "Malware payload", "value": "90a1b15428b574536da235f4995bed8a44b40899874a2fe7adc42bdcd50f6e70", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199717, "uuid": "27b63dca-54b7-48a4-89c4-172065e82dfc", "comment": "Malware payload", "value": "3d0382619f8cdc2a8aa5b24218720d29831cc6a3", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199717, "uuid": "f4538550-6bca-4586-b718-a137ed4ca393", "comment": "Malware payload", "value": "ed3635135a285fb2526d1fa3422fbc5b80dca576ea55f5c72babad82b90db960da686bbdaca1f9bb8a5390a380b94799", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199717, "uuid": "e49ac074-6c29-433c-ba4f-9bf87a878d3b", "value": "T13C6633596505009FE9ED013435FE2A8B21CCF0A924A79A4B53C3F10AD1DE8D67EBFE49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199717, "uuid": "0084a4c2-7aab-4f52-8c6b-6536c645a0b0", "value": "4d17be67c8d0394c5c1b8e725359ed89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199717, "uuid": "01d29c4e-2e99-43af-a451-73201a63f0d2", "value": "196608:fpvwnl9hRcuFz3UsENFgUNiw/uuOVM3GswxOGOz8hA:flwnhrU9rgUNbSVHJ/hA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675199717, "uuid": "444b7379-7008-4136-837b-c8c47d7e8d52", "value": 7067721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675199717, "uuid": "18c422c6-01b4-42c6-9223-102ac8e7e436", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199717, "uuid": "87761041-adf3-4224-a288-4edd0a18ff6b", "value": "installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b7d666c-a17c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675179046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179046, "uuid": "48347d9e-ab09-4665-ba9a-74d21a94d392", "comment": "Malware payload (GCleaner)", "value": "3b3c77aff4f3773e7095331ad38d4cde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179046, "uuid": "ebabbb87-ee3e-4263-b695-e40ed770edaf", "comment": "Malware payload (GCleaner)", "value": "90ef62f1fa283c97c9e36b1a5603d380442ddbcd0fe4c6b81d6e02fce5f11cf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179046, "uuid": "89cea8ec-bc27-40e0-bafe-50d6effd6747", "comment": "Malware payload (GCleaner)", "value": "1a98401752c396bcc0b1989343058280ee3c0503", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179046, "uuid": "bfd96252-16b6-45d4-9318-4e20f40c71c6", "comment": "Malware payload (GCleaner)", "value": "08f950e045c0c794bcfcb239655f27112440252d1be9003da9041ddb09027264a65ea6aaf6df90e78a3a05b1195b6898", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179046, "uuid": "3c9e179d-e24f-4d45-b023-0230edd2517d", "value": "T192A5330BF6B95675D2520F38372C9E82ED37BC7E61B95707380C820E1B3A68678587E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179046, "uuid": "a12c7500-2e61-4a32-b613-c037ce0a9171", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179046, "uuid": "38112da3-d490-490c-bae9-c23cd479b904", "value": "49152:C2Ik0/AYNJQvaK4K578O5LN9nnQdUvhi3LCgv2MR:dIVYntZ8O5LrDvgDv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675179046, "uuid": "76893ac6-8e37-4c55-bf0e-9f3efc8c20e8", "value": 2178794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675179046, "uuid": "6b8edfa3-4fa3-4cae-9bd3-4b750d9d6a95", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179046, "uuid": "4bbf45c6-b52a-41e8-a3bb-0c314c6035a6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d9a101-a17b-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675178694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178694, "uuid": "7f691fa9-8594-4497-8517-62fc8362727f", "comment": "Malware payload (AgentTesla)", "value": "6b8c9f1aa06f8587edd290f3d0188359", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178694, "uuid": "e3e978b3-c2f7-40a6-bcda-66d9e18c473f", "comment": "Malware payload (AgentTesla)", "value": "91f7c342ce163fe12c018a5068f921b5b78574cf05927bb85876be8484a2c237", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178694, "uuid": "ee5e9d58-25ec-4e84-ae60-e58d9ce6fd52", "comment": "Malware payload (AgentTesla)", "value": "e893cb5944cb149f77ea53900bae972bd6c9e531", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178694, "uuid": "4b358a29-9193-4df4-9bef-6585a82e2b4e", "comment": "Malware payload (AgentTesla)", "value": "4fb4bd470c53a40a3f94efcc90229e04c8e851c36febf2d8d2da2eb33f3339a449c316d9798bc15c05d841a32534c09e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178694, "uuid": "5278f074-2cae-4de0-bf45-0aebaed1b8e0", "value": "T10A64122033F4C22FE0E269324EFBDF586FF9F02265A0876707415A4ABD529D1971E3A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178694, "uuid": "d96ebacc-db6c-4c4a-987e-d435f8538d44", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178694, "uuid": "45ac7bba-27cb-4aa4-ac88-59504aec85e6", "value": "6144:/Ya6MvLBCyy7CpvnutlJJ0UoBeZJtKXWM/UYzBA21:/YyzBby7kvG9cexWWM/USf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675178694, "uuid": "097d5f1e-5244-414a-ab0a-4a7e53eb0fbe", "value": 312034, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675178694, "uuid": "15cf9006-bac8-4fb3-8c06-44fc9ea93a23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178694, "uuid": "119ab039-c6eb-4e91-ad18-d3f0fa51dbf8", "value": "Urgent Price request. P.O1672891.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c394d76-a117-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675135641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675135641, "uuid": "f2752e26-047e-4052-bff1-d366aac5667e", "comment": "Malware payload", "value": "a890b050f54ac8821fa40c7d032f827f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675135641, "uuid": "6e91fe89-a7a0-4ff1-bbcc-943ecf4dbd32", "comment": "Malware payload", "value": "924be9075502bdf70794a1bc37236277572ddbec1c9fa72fabd27865c34bce73", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675135641, "uuid": "247afc74-7824-4765-bd16-ea07891ee22d", "comment": "Malware payload", "value": "e9034b83c021fd2d83eea36cf00d2b94d2194812", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675135641, "uuid": "15ba4985-3943-4b7e-a4db-1c7294258ff2", "comment": "Malware payload", "value": "7283be43b78f48bf2e3e872a3d716fd14dd3218190800d4305a5debac6a802849ace8b622664c4ea19c64cb1f3384b5f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675135641, "uuid": "1a432f73-71f0-436b-9d10-8dd0b9b972f8", "value": "T16562CFC5BA01EAA9F5409CB27D2C45BC449FF6AF0AB730718CE9B94DC6454AB085F3C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675135641, "uuid": "fdaa06f9-334c-48b3-8c5a-8a65b43f357e", "value": "384:flzEBkDOvTCZuQEkymy/Gf+3pK9pGr39KKD6sq+GJ4/:pwkyTc9pHiGJK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675135641, "uuid": "89c4a18c-c01c-4145-b4b6-e065839f0b6b", "value": 15840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675135641, "uuid": "4f6074e0-4c8f-46cc-bfff-506c5933fd81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675135641, "uuid": "c991fa6c-9f8d-47a0-9405-d160a8dab17b", "value": "SecuriteInfo.com.Trojan.Linux.GenericKD.50294160.28817.10565", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a1a368d-a16d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675172709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172709, "uuid": "5de8ad84-255a-4638-85cd-930585c861a7", "comment": "Malware payload (GCleaner)", "value": "4a2e30f620d63a8dab1a8dc64c6fa8ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172709, "uuid": "b4aefd07-c227-46ff-b4c3-3cad1bdf598c", "comment": "Malware payload (GCleaner)", "value": "9271dc1f4b0e48960bee6b35f6aed8e204a1af27b00a0968b8022ecc72510772", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172709, "uuid": "bbad1d80-164c-488c-b0cb-ebdaf632f634", "comment": "Malware payload (GCleaner)", "value": "7613a3019779c4a98a4db7511d3ce33b41e02312", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172709, "uuid": "1e2d7a87-ae15-424f-8dc7-dfb387ddace0", "comment": "Malware payload (GCleaner)", "value": "ab8139ae8445f75b065aa6a4b0c85adea359eb0a50152766f32cd82ca222fc07eeffb9763ead882051ca519fcb9de4ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172709, "uuid": "33e8b580-430f-40a3-a88d-a4b7de38de20", "value": "T119A53347DBB9D137E100C6320E289960B4A9FF595071825EFB6E631B5BBA3D0E80DB35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172709, "uuid": "306fd8d6-bef5-4b73-81f3-40a507b44dc4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172709, "uuid": "fb86559b-7b55-406c-a292-02ae73978021", "value": "49152:C23UOK9StWH9B4fntDy8Z/SfVtPpNMZxDTgLCgv2MR:d3UzctWH9B4ftDynf/PpNkIv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675172709, "uuid": "feafe87c-03fc-4ef0-8c8a-ed591ebaba01", "value": 2171083, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675172709, "uuid": "e0d6d0bc-54e6-4122-95bf-1e75f43979aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172709, "uuid": "f29f5789-d7b2-4c6d-90f5-70d9ebfe55be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4b76153-a149-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675157345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157345, "uuid": "b3bceb2a-1c46-491e-a96b-3a13db33d2a7", "comment": "Malware payload (Formbook)", "value": "cb7245f821aaa97b8e6493e5cc5a8596", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157345, "uuid": "9a0ece9c-e9c2-4a6b-823d-e1850eddd289", "comment": "Malware payload (Formbook)", "value": "94c082ec29d284b51c37637f7032140d138533a9c0e79c1de8f99b3511948a4a", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157345, "uuid": "fa7ec494-964d-4e67-9d29-a17191dcd6e9", "comment": "Malware payload (Formbook)", "value": "bb4fad9ca434f25809723bc79905c5b264a9d2e2", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157345, "uuid": "fd439c67-6edc-4b37-99b0-12f3909ce340", "comment": "Malware payload (Formbook)", "value": "1dc025c247b63c17f6fd2ac5a18f1567e62cfd94eb91cd36801b8e7add583779d8f036d37f3b85a67d49d7fb8c1e6cd2", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157345, "uuid": "a3cacd8d-84b8-4271-b931-aa5b5d437290", "value": "T1587402086185C167D4E206F049342A7F66E2EE12A4B5D7173369BF087F77B01AA0B3B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157345, "uuid": "e4913745-a220-4905-8f30-3a7e3ba2fbf5", "value": "6144:WYa6TgoxfclokC7mu8QzFbwHSZBjzDGH6tLJfU2gIB7vZpf+b:WY2oxfKt9u86tzDGG+27TZpg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675157345, "uuid": "ebd6990b-4fe2-4cf9-a1f5-92da35aa256d", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675157345, "uuid": "abe07de0-fdb5-451a-94f3-136ac5045fca", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157345, "uuid": "a64f5536-f274-4fdf-a2a2-16e8064018df", "value": "Shipping-Document.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cfe4cae-a146-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675155936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155936, "uuid": "c0e9781d-bcac-498c-8321-45aa88a5d1c2", "comment": "Malware payload", "value": "fa213fb7cd93eae05e971750b38dbba7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155936, "uuid": "b1673f02-08f6-4a36-b2f6-7e8f3b857c51", "comment": "Malware payload", "value": "9589a350843f9c5d3bdc6e7bf380e7e33b058956205551512dad7b87acb25cd5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155936, "uuid": "6b475f82-3b52-4ea9-888f-c9bd243d27b7", "comment": "Malware payload", "value": "361572eea2646b77195da8fd3ddc17a14624400c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155936, "uuid": "19ecade7-767b-4fd3-97bc-53c6a4954b08", "comment": "Malware payload", "value": "10e25a96deea4d778faf533ba5ab0d79f992da383e20023ffc0d4bd6366c05343534d88256f68cc106036d79dc2d25b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155936, "uuid": "49b45217-0d25-4a51-9912-6bc4c5d9c055", "value": "T117D4C43D19B613E6C338FA7186E18420F6EE61923703F968DDE65AD14F02582BECE51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155936, "uuid": "312b9e18-eb08-4aad-8a33-cc8286cb6ec6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155936, "uuid": "de8f965a-071a-44c2-9fd2-cccbcf6e4974", "value": "12288:7o6+C+2SlLVseHKNTn7tunA+/kSzeljwXqErzq3d7w9Vyla3CpMeGaR7cN:7orjseHKNTn7tunA+/kSzMKqWON8Vylo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675155936, "uuid": "7a370462-4631-4c56-835a-2c016de5288b", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675155936, "uuid": "323ec5df-779a-4cde-9622-51b5ee69c5eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155936, "uuid": "e51301f9-6453-4a56-95d2-83e817220931", "value": "STOWAGE PLAN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2464ddb-a184-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675182681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675182681, "uuid": "483f1877-c0b5-4651-a36e-0ef2eac4aa09", "comment": "Malware payload (RecordBreaker)", "value": "6b69f86587818957a6b146081ebedab1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675182681, "uuid": "83941587-7d4b-4fd5-b2d0-7afab45720b6", "comment": "Malware payload (RecordBreaker)", "value": "95ca92390fd1d80fbc56cf3a163545cf484a84a29d459697a3a54ba2b2ce5dba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675182681, "uuid": "c590e391-a969-444b-93bb-c699e46ab65a", "comment": "Malware payload (RecordBreaker)", "value": "1398496669ba7cccfe983c6be4c1f34307137197", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675182681, "uuid": "ab7f786b-0103-4ca0-8a28-0507415dce08", "comment": "Malware payload (RecordBreaker)", "value": "6b5a5007da97f795e6a21edd0e6d65dafac067ae9f7138056066f2809897dcded46db20d665831e4bbc62f0c10b1aca0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675182681, "uuid": "655a2db3-8f9d-462e-aa11-e437ef1286d2", "value": "T17F548EC2B2F27C62E9228A31DE1EC6F4751EB5534E597766128BABDF16B00E1C5E3310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675182681, "uuid": "05b06272-a3d7-49a8-8787-33274358aae7", "value": "4aae5aed0c3540c5480a5674492f1494", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675182681, "uuid": "917b2730-28b4-4d55-a130-361e0afa4374", "value": "3072:5puuSSLipRA0jiJ3ELiSnhQ5Ivim3JMimqPUx6WfQz86MWYs3MMs:6uSSLiY0WM1Q5IvimuimqMoI3Rs8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675182681, "uuid": "395e7124-93ad-420c-8988-d0cf59d4681b", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675182681, "uuid": "4a1711d8-1f45-4d12-a4c3-cd3f18e3eea7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675182681, "uuid": "18035117-dfc5-4157-a3d6-3c5528e68288", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e717cb-a156-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675162922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162922, "uuid": "1cfa412f-d2d0-4290-8aa7-576570ef9292", "comment": "Malware payload (AgentTesla)", "value": "f696ba2710cadce82ae23e72904f9c25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162922, "uuid": "0a3c86ea-be8b-47dd-b72d-3016d1f958be", "comment": "Malware payload (AgentTesla)", "value": "9848cbed714fbf0ecdc2b288b9ee6dedc8a6d314f44fbb1e86a7726d785c4d6f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162922, "uuid": "8bba9af6-77f3-45d7-85f2-bd48faa466a2", "comment": "Malware payload (AgentTesla)", "value": "c658bf8a9ebaaf13f292209c2367db603d4ed94a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162922, "uuid": "cf0b5fa4-e666-42f4-83aa-45c80932a9ac", "comment": "Malware payload (AgentTesla)", "value": "1dab4bdb3e9f9eeeb118b39f795c0369d05d5063419d6c2285a4d02e69406007fd4f8447f9a772cc0a654017b7c68766", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162922, "uuid": "2b877c8e-bc04-4365-a5be-883d9228e5cb", "value": "T1A972D0FD06C3A62CB8BBAE2B5738790D09C621BDD3240BD47A64180A5E1F13717AD0C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162922, "uuid": "663134bc-f281-4d48-a9c9-f7e8812cbaa7", "value": "384:INn/O0zx2Xn8qSsL78Z3s4aAMpYP9FH1kXAD1WPm:Id/QSsL78Z3sHAM21FH1kQRWPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675162922, "uuid": "04cf7c5c-ad8d-4787-9028-e4e237550726", "value": 16003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675162922, "uuid": "847283c6-f404-4fc7-925e-2029cb95bedf", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162922, "uuid": "0d9e3be1-aa8a-4a5e-ae69-180be7ea639e", "value": "TT PAYMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a83078e-a18e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675186909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186909, "uuid": "c21485b2-7044-492e-a09b-aa9526196478", "comment": "Malware payload (Mirai)", "value": "feadeb55bde35b1cdd89d95ccb912d3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186909, "uuid": "602f5ce7-c0e8-4679-adca-47863f6d1cc9", "comment": "Malware payload (Mirai)", "value": "987ce0e963fccb533c7b160b4749549c95cd44bcf5f6b94106cced2c88176cdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186909, "uuid": "f6fd85e0-b245-4557-8dba-92176b0282b3", "comment": "Malware payload (Mirai)", "value": "a0d5ffbd2065ae4beb28ef2a01f299c9ab7bb427", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186909, "uuid": "edd97310-fa6e-4c08-a759-db750720baa5", "comment": "Malware payload (Mirai)", "value": "72c44c3df50b8611b115fea8f06a43a8f239a0fb73f888eca477c42197eca4f804893bf605e8800edc9ceeffce5095a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186909, "uuid": "1e589b44-a659-4f2f-bc96-c57d66305222", "value": "T1E4A3E70ABF610FFBD86FDD3705E91B4529CC651A22A83B357934D818B64F24F0AE3964", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186909, "uuid": "ddfdd817-5cc9-4901-9f1c-19953bf91035", "value": "1536:xCBWOGH2eVKKaxp0pvHnA/B9lMLDnDQZLiFfzFSE1uk:xCXGH2eVlnnDQZLiF0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675186909, "uuid": "6d53df28-cd96-4c26-b33f-5ba2ad83eef8", "value": 101568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675186909, "uuid": "2a9e5d2b-d6c9-493e-9fa9-f8094cdf835f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186909, "uuid": "935be383-556f-45ca-a602-897a6a9b8455", "value": "feadeb55bde35b1cdd89d95ccb912d3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a58e096-a141-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675153623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153623, "uuid": "062f7128-a1c5-4291-ba22-2576c5d4a783", "comment": "Malware payload (AgentTesla)", "value": "d4aa9bf9ebf818fd6c605d241c64e78a", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153623, "uuid": "6aa3a509-d210-4bd1-b3d0-db3e238da5b4", "comment": "Malware payload (AgentTesla)", "value": "99f9ad0aee5de3d6d68fb7fe0e86428f39e47fba716645fb52a5a72cae2a0de7", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153623, "uuid": "727adc82-2af0-4210-8bde-40e98e8c64d2", "comment": "Malware payload (AgentTesla)", "value": "a8da8d6b610a09b5180251a043fefb90df66af52", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153623, "uuid": "b1f8c8c6-5b52-4ccc-a279-1b0469f06874", "comment": "Malware payload (AgentTesla)", "value": "8c00c7d69f0794d99286b960def76ff067c1e510754d24354d4711f03c4ebeabb950bd967019d02c4b439fb64ef10a8f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153623, "uuid": "0c693e81-a4d0-4099-9e26-41b039ca743c", "value": "T1E4B4235F451A358430B2A0A538544540654E176FF225B0CAB7ADAF2F3B03B866CAF7E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153623, "uuid": "249af352-5d60-4788-868e-0a4726a2730e", "value": "12288:BJ34HyFqhSRO+dHtZXHblsya2lsbv7qMmJbi1yIA1AwsXF:BB4JExJZsZgWTXmpiwCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675153623, "uuid": "3dc19ade-1a25-4484-950d-ed14f65eb2c9", "value": 527166, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675153623, "uuid": "408bbecc-b45a-411e-8238-120af6cafeee", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153623, "uuid": "eb9719dc-4b8b-4dfb-ad14-38aa3853c3a1", "value": "SOA.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d38c865-a136-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675149038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149038, "uuid": "4c0afa50-371d-4cf2-9704-fe1aeb4e364b", "comment": "Malware payload (AgentTesla)", "value": "55100a8d6ae752eca45f42145582142c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149038, "uuid": "3d5dfa3b-fec4-4861-8f23-7470430c435e", "comment": "Malware payload (AgentTesla)", "value": "9a5fbd93d713b7b7c1554e4157c12cfbd5e2644fccc300c77c087e430d3a1441", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149038, "uuid": "b7140965-6246-49b4-bec0-c831c83db144", "comment": "Malware payload (AgentTesla)", "value": "fdef3d5df2b61b3be48ec74fc936c5afa816fb10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149038, "uuid": "2b2e417e-116b-405a-91bc-05882ed0c5b2", "comment": "Malware payload (AgentTesla)", "value": "c028ba0c0010d0b47bbd492efc3fb2038a77dc07c2aa2eb04d477e76807b647a27b450366a711ee80cf46b33a7bed171", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149038, "uuid": "4fd05320-f4f4-4336-b3dd-8f42c25940e3", "value": "T1F1F4026883A8CEFAC2A583BF65B514145B7235AAF16ECB0D1F6FA0DD489630045217FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149038, "uuid": "ff3f5165-f114-486f-a8e0-b5217634a5ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149038, "uuid": "d6f7754a-28d3-4dc6-9c50-268d9ed272db", "value": "12288:BSQ3XjK0fGFmW4z8YaRvN3OVOObUVHdcWeh3ih9HfAsZC:vm0uD5HObU9WBYT4sZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675149038, "uuid": "56a0a553-9740-4b7a-a46d-d0765c5f9460", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675149038, "uuid": "0092e947-e80a-4505-a659-00fd9c0e4eb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149038, "uuid": "c2f84eba-5b31-4e66-ad3f-12bac97ad1f6", "value": "DHL Receipt_AWB#200458298922.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2cdf8c-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140475, "uuid": "7a21bc96-da5c-45c4-a8ac-67cbb23a0d74", "comment": "Malware payload", "value": "28930e028f3d2d5bea8cdc86cff09dec", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140475, "uuid": "4d5bc29c-ef30-4eb1-8427-619d167cf6dd", "comment": "Malware payload", "value": "9a692e43a473614e0143eb7cbacc7a15136041e8e7e8c092cfa225abf4057b4b", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140475, "uuid": "1b52f4ca-670f-425e-8bd1-f233d449d266", "comment": "Malware payload", "value": "75b31c06dd1677886d2b1095e83b496d392e2767", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140475, "uuid": "5d7caa5d-46bb-493f-a1a2-675d63fe7f25", "comment": "Malware payload", "value": "2b7dcce8209b914d04c914f3ad88468b93a4fc9d6c384963a4bde8963b87b1e7078320cb90a341038b402e6be642e1fc", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140475, "uuid": "e550b78d-10c0-4926-91c4-ae6f85ee2ed3", "value": "T10E363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140475, "uuid": "c4d62efd-0f1f-4935-aedd-a4696ec77398", "value": "98304:Vv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXD:VvpvFa+g8RWLdPk/84tCEr0RtNiC5eSm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140475, "uuid": "0cd1acf3-d982-429b-91d1-04f801a99c48", "value": 4993536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140475, "uuid": "d956e2ee-fcf0-4910-b95a-886fe5af384a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140475, "uuid": "6eee8f7c-e6f9-4649-8e3f-cb0c7c4bb67f", "value": "9a692e43a473614e0143eb7cbacc7a15136041e8e7e8c092cfa225abf4057b4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ac3889-a15a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675164640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675164640, "uuid": "a351406b-844e-4c1a-a8d1-d24ffa7af39d", "comment": "Malware payload (GCleaner)", "value": "77e3613075743dc684d75b7f391f572b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675164640, "uuid": "366c3142-8aa4-4e6d-ba79-afa499013f9b", "comment": "Malware payload (GCleaner)", "value": "9b379bace2acbae703f4d67e317a05b03d0272fcafe4ab789ff867bbf99eab19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675164640, "uuid": "091e786a-af0d-4165-ab82-567a7ebeb80b", "comment": "Malware payload (GCleaner)", "value": "7335aa95ccec4b127dc141fd717adb315ffac688", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675164640, "uuid": "8ce37107-903e-471f-aed2-91aa8a4b3730", "comment": "Malware payload (GCleaner)", "value": "99086901553583a6fea47b375c2d940e24001f34da761fdffafe07672645b31bd67b8d415c029090ae794bdce2c13faa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675164640, "uuid": "b63a472e-f22e-495d-9d18-a36132f70272", "value": "T1CBA53361F4A2DA3FC3829EB88A3A55069FEC7F5238750054B01D7B6E0F635D9186B723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675164640, "uuid": "8e2e197a-140d-4cd4-82fe-f8cd07f4c543", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675164640, "uuid": "b005cc7b-ce14-438f-88e0-7f6659a3b369", "value": "49152:C2JQumgA53crkt8C+ISzDVw5E2D0U8RQmrMCnmV3RQu28gLCgv2MR:dr6MPW5E2YXQmICnQE8Iv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675164640, "uuid": "e9b15773-f4d2-444f-beaf-395671f56601", "value": 2197785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675164640, "uuid": "1b82edde-8cd1-4b8d-9c9b-43392610c189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675164640, "uuid": "27c132d2-710b-4e91-97b8-7d337cd06f4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01b7153c-a146-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675155756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155756, "uuid": "264c1929-e90f-4334-8d5b-c83b28d08bba", "comment": "Malware payload (AgentTesla)", "value": "de942c79941e1c9a1446e30d8d8c570c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155756, "uuid": "6d495008-6974-4020-a8f9-5f95692cf236", "comment": "Malware payload (AgentTesla)", "value": "9c2a4b70bf191376e0c274db03110bb536add938a19f7a726e90d1b12a36faa5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155756, "uuid": "e91f20bf-f1cd-4c49-b512-981e3b7b5360", "comment": "Malware payload (AgentTesla)", "value": "1f4fbbd0ba8bb808975f31e95b935840b277a441", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155756, "uuid": "78fad305-907d-4d2d-b11a-5501227bb38d", "comment": "Malware payload (AgentTesla)", "value": "0126171863bce85be1aae6915ac464f6f8912ec55ca856445bba5d0eeaa57cdad6c5d0a864587ed836d18e39188e091d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155756, "uuid": "aba55041-916c-4906-8258-31b90cd3e795", "value": "T187D4230211F4967CD17A87BDA837982463BD5ED51A0BE7181FACE8FD1857B480733BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155756, "uuid": "3e49f918-02ad-41b9-a958-1f3af0b76249", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155756, "uuid": "4a5363e4-0c3d-4a9f-8101-cf2d0b72363e", "value": "12288:liJmOQ/LfgjsALAKiEHHZIPGKtE52LU7mYr8z9i7+pvHCWtO:+ofgjs0bzHH6Pzm8LUyYr8zw6Rih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675155756, "uuid": "f41c1272-7873-4203-8a5d-3e45674ea678", "value": 604160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675155756, "uuid": "558eb314-0d49-4e3b-bd2d-968cebb25302", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155756, "uuid": "9c53388c-134b-4ad7-9072-53e2ea74cac0", "value": "2023013150028399456770010.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a48527-a11e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675138667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675138667, "uuid": "ff062142-a134-4f07-95b4-ebab3361870f", "comment": "Malware payload (AgentTesla)", "value": "4bbb886c4d1bb4f32c0a22640d6f4ad9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675138667, "uuid": "d5480812-3b3b-4dbc-bbb5-3ea5d9e45aff", "comment": "Malware payload (AgentTesla)", "value": "9c3660ffe5ce0c638949f25a1a1adc5d7ab366824e46d6ea3064e8c7426730f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675138667, "uuid": "57bc483c-b8ba-4c70-8c7c-558febb3eaf7", "comment": "Malware payload (AgentTesla)", "value": "447c9f29f60624a4173a4dfcd5513e6bac6e64f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675138667, "uuid": "94fcf2f3-944b-4e0d-8a3f-d5d880e3c1c7", "comment": "Malware payload (AgentTesla)", "value": "0027d6d6953fcb1a5d463a26b069fb4c82741a3a4a757619b2696a0f83d5db765bad8d337fad37ef7226853e20c73990", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675138667, "uuid": "193a8c83-add6-417b-b576-deb5beaa7c8e", "value": "T1DBF4273D2D7797F2C534F97292D1A4A0BA9F8192B36BC999D9D61BC04F012823DCE11E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675138667, "uuid": "94c7a07b-3713-408b-a031-4c2d7f25848a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675138667, "uuid": "5f0c5b1e-e570-4d81-858c-cfa000072bca", "value": "12288:X+d22z7sWyOeq+pXp8irmdjXHNOrAe/IuMmBDC9y6YUjQkUPYXtD4orWBfbJOLZA:u1OT8irmdjXHNOrAe/IuMmBDCk6YUcDS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675138667, "uuid": "311c440c-2db3-48fa-9b11-176007ae1d45", "value": 777216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675138667, "uuid": "302c5ab9-e688-4709-a099-ae1c419541f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675138667, "uuid": "d848bba9-76f7-400a-b267-807b37cb7fa9", "value": "DOCS..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1d5e88-a168-11ed-88f6-42010a9c006e", "comment": "Malware payload (LummaStealer)", "timestamp": 1675170673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170673, "uuid": "5eae07f0-de0b-43c2-9924-5112bcb3c302", "comment": "Malware payload (LummaStealer)", "value": "34608fcb252b57e7ad01b6bf920de05b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170673, "uuid": "5d48f37a-28bc-4c10-8ec9-531eb7b62f6d", "comment": "Malware payload (LummaStealer)", "value": "9c6206f3443cb54e5df56b6958ba5e16925c8be706dc4cde5728b4351dfde15f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170673, "uuid": "db1877f5-0c72-4e14-8f38-b757e894f6ac", "comment": "Malware payload (LummaStealer)", "value": "503d3a937e734a7d145a71ed09d947af9f58e9c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170673, "uuid": "28e34bc6-6659-4cd2-a3a6-0dea6ca29ce6", "comment": "Malware payload (LummaStealer)", "value": "005fac9f9c59af7d4d1f15dcfac11f86369cb8533694d949fc59f9f986c4fd91702ef503c468a8e8ab156eaad10908a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170673, "uuid": "a002243c-4c37-4a69-9eb4-2ec7b6533a4c", "value": "T1126623621371000AD2F7CD3EC5677EA932F7037B4B41A8B879DB96C139578E9EA12903", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170673, "uuid": "78c194ba-c000-4beb-ad7e-1add1e0ab124", "value": "de12abdbd84b3d27dd49eebc3491abf8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170673, "uuid": "bea73dc6-2617-4897-9e0b-f8d3dd313377", "value": "98304:yPAaRcGnYmexrS0M60BMA4Df8witbDNqLfLNVgY+7HlqiiwFBSTpa0tLLSG:UxYmexrnm4IEnCF5iwLkUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675170673, "uuid": "d82ca4f5-6e75-4c00-b489-1a364b9f92da", "value": 6606848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675170673, "uuid": "a82b6e0d-4237-4f1a-ba74-e1487a3c144e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170673, "uuid": "e0264732-5b00-48c1-aa36-3e419e88aa1f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc0e37e-a13b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675151372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151372, "uuid": "50010a3e-b8fd-4dca-a6c0-720bf745c024", "comment": "Malware payload (Smoke Loader)", "value": "4a3092d13c54b0b8de901c3d4e461bba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151372, "uuid": "2a75cfcd-27fa-4873-97f1-81e3edc5e715", "comment": "Malware payload (Smoke Loader)", "value": "9c770de7138aafd9fd7d9639932171fc06a386c483667c949171da0fc307c562", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151372, "uuid": "6f8bacfc-556f-494d-bf0d-13557e757052", "comment": "Malware payload (Smoke Loader)", "value": "126c60abea1ec11c8e83cad3847d562be6e6269d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151372, "uuid": "facd7ebd-d8f8-4682-bb20-16982ead3d45", "comment": "Malware payload (Smoke Loader)", "value": "d598742645e8dbdc5b6cfff6a2eca1383db9f938a8e37012da43dc2caaf4069dd52b38621a26921f6893545061aaa384", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151372, "uuid": "98c3adb1-d7e8-41ec-a94b-7085c7ddfd6c", "value": "T10B549F02B1D1BC41F5768B728F1EC6E4F51EB591CE88A7653318AA1F29B31B3DB62311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151372, "uuid": "27cba2a4-9037-40d6-a32e-40a5570723d3", "value": "a2c8bd590ac12702f85d4107db46f8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151372, "uuid": "0f4d6953-f3cf-410b-8df0-055608d2b0d2", "value": "3072:6UXBumygggxLoI7R4J2bKW/y80RLQ8T7LRp5AIC7f43H7BF7RCDF1:dIRoxLoVJ21y80RBBpK7f4VT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675151372, "uuid": "601176fd-cf54-4294-aa73-c7b8017f0ab4", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675151372, "uuid": "2ca71cdd-f36e-46d2-bb99-4b3c908aecad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151372, "uuid": "6a8c6357-063d-4bf5-890e-9088822aea4a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5f7050-a156-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675162862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162862, "uuid": "a326070f-e1ce-4d0a-9ea2-22b519d9b829", "comment": "Malware payload (RedLineStealer)", "value": "072e2b8ef14994cea5f7d729f61303b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162862, "uuid": "9cc42d1c-4cfb-4257-ae88-ca1a8e0bb22f", "comment": "Malware payload (RedLineStealer)", "value": "9cde8516e9dffdfbb2c1d84beb12ce8cf6e0de2f297c63c7f24a73e9c3e8a1f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162862, "uuid": "9bf55180-aa4e-4f36-9df5-54928b79b217", "comment": "Malware payload (RedLineStealer)", "value": "1be529a269eca235b82c89727c058f666682b3ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162862, "uuid": "91aae859-c1c3-487d-88ac-f9883346c7d2", "comment": "Malware payload (RedLineStealer)", "value": "ecf7c4ad721fb249aa86f2b7cc659953d3b5e30d2b5e4d450c9e58e09c526feeb5ae7d939a7cc4bd422288462ee9f477", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162862, "uuid": "29c93785-7333-42da-bd13-ee2aae7d0740", "value": "T16A84BF46B295BD40F5668B35CE3EC6E4F51EB981CE08A7262318BA1F25F31B7C762311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162862, "uuid": "1f2696df-a0f3-4b20-9fbc-548f43144a32", "value": "78339dc1c5de0e493ea2b28607ce356e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162862, "uuid": "c59300ab-cd7f-4535-ac60-6d47f65a6919", "value": "6144:DuMOL9Q7v83vt1OAHf5kMszFD6J8zoR3+tam7f4V/f3:apJRfX5hsz0J8UOtamzO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675162862, "uuid": "bc6076e4-18d0-4412-acd6-4fd85ead0305", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675162862, "uuid": "5348a8a2-c504-4cc2-9371-f3c7deed7f08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162862, "uuid": "e539ee8e-d268-4298-a352-d5d0353dbf78", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3659e488-a1a6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675197076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675197076, "uuid": "cd1e1a1f-28df-4057-9f22-5616a3c622da", "comment": "Malware payload", "value": "33ee7e424791c3d187a015290ca76cc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675197076, "uuid": "76cce895-8e5f-46b6-ae3e-23c6d2d5db44", "comment": "Malware payload", "value": "9d437d09774e25e516419357e58f53aa1ce65dbd67ece26bae3aa751605eb76d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675197076, "uuid": "ad5cf1b3-b04e-4b01-a7f5-00bd74490373", "comment": "Malware payload", "value": "23ea50f4d19ab18512a94b6e0d2d9f4071971ea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675197076, "uuid": "6b738fff-64d2-47c6-a5b6-80f119331694", "comment": "Malware payload", "value": "34703d778e2c11a5555d36a6d0cb829c0519b29a2e44e0cd112ec69a1403de217d2194d44eb29b3907c7f09b71e36be3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675197076, "uuid": "343d1dd4-e807-4a29-bfa7-e90cb9d75033", "value": "T12AA53316B6E0497AD533EBB9682ABA90BCB07B566430230D204E335D3F331B4655DF9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675197076, "uuid": "19504807-22de-44fe-b4dc-ef230e5a30ec", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675197076, "uuid": "0f1436d3-a926-4525-9e8b-04b880bd8a0b", "value": "49152:C23+J2Bo43hx0Ftq7I2KP8aG847EBizrR5SsVfbCErZQxH6mHgv79Qs1+1ivLCgt:d3+J2u43hxqOD88fQiis56Avhc1iLv2Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675197076, "uuid": "2176c1fb-807b-44b1-8f65-935a6aef634e", "value": 2190369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675197076, "uuid": "2a3eeb49-91f3-4b3f-bc91-973efef94192", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675197076, "uuid": "2cf377b4-13d7-4704-81c0-2cefd032d30c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8306944-a156-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675162907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162907, "uuid": "f1d5a6ed-1893-45cf-b2c8-f2aaaff010dc", "comment": "Malware payload (AgentTesla)", "value": "9e631a5fa5204abd46257da5000926e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162907, "uuid": "b7922f45-da9d-4ced-92d1-bfe003034317", "comment": "Malware payload (AgentTesla)", "value": "9d58b6f6afb9a8237df181b9d0e1a250d122acd5d36208a3d2d7368bb9d25984", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162907, "uuid": "6eb9aa03-787d-4cfc-b153-f997373926f9", "comment": "Malware payload (AgentTesla)", "value": "8ac06686f7e9a9c998aa6819d589e8eee181db7e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162907, "uuid": "0cdff85f-64bd-452d-82c1-98d91e5e5b9b", "comment": "Malware payload (AgentTesla)", "value": "f04f409fb33662f9d2a5e8a4a56f90f127eb89d7730a4f8e6e5fd924bf7a280440744ca7ace06fc51ae7c04d984cad7a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162907, "uuid": "538923fb-9cda-46a9-87c1-d0d34a602ed5", "value": "T118031994A6AC8733EBAF4B7D58F9958247BC5173A405EB0D388C50DD38D279303A275B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162907, "uuid": "4f49be0b-04ec-45b2-9660-fc5590ebc72a", "value": "768:9aVg5P5X/bWWDAYsAYaWBjZViqCp09VCBJiffi/30NZXggoX:9a+1KG3s3aCjZViHp0zgJifK3CZwFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675162907, "uuid": "5277c55c-0156-47ef-b9a9-08d8d49ecba3", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675162907, "uuid": "bf2105f9-f72c-44ea-878f-c2a5ef3e5f19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162907, "uuid": "aeaaf7ea-fa5a-4a65-94e7-18a990c88ce9", "value": "PAYMENT SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ababa43-a1a0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675194426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675194426, "uuid": "1bf12edd-6ef0-4fa0-bb6d-045513ff605c", "comment": "Malware payload", "value": "959f089583804485ac51c620ab73ede7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675194426, "uuid": "6c544d0e-6c7c-4b10-8c97-7961fee42d79", "comment": "Malware payload", "value": "9e7f9353ce20ec8542a401c7e87b3da83eec6c2c7de2bddf06125b2d7755ac22", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675194426, "uuid": "d13f9652-0c42-4946-a251-88ff1c6596de", "comment": "Malware payload", "value": "5589b592d85a6f67bdcd0ff7c9fb34d8963e0f51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675194426, "uuid": "d7775ab6-ba1e-4c14-89a6-1cd4cbc8bb94", "comment": "Malware payload", "value": "6b4552372c0fa85e19bb3f6a98feff51e1c7c4394ad00cc89f188fb7ca007e798ac60b55ccd3ba9a9355b4bfc5ec7934", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675194426, "uuid": "96457944-9e03-4bdb-b426-096dddbc5058", "value": "T1DC548EC272F17D62E92E8A799E1EC6F4761EF9424E087365121B9BDF15B02F1C1A3318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675194426, "uuid": "1c5dd4ef-2adb-4d74-bf12-82305b86611b", "value": "9c039baca0968dd2f90042d865dd6c2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675194426, "uuid": "f8194f4d-34c2-41d5-859f-d3a488e8e7e2", "value": "6144:hZNqrLebzcNPhcSQOvL0/HTiLH2mqMoIEL8M:jNyyPcNJZ9geD5qMeL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675194426, "uuid": "94fd37f7-09a3-45dd-ae8f-146484a20c90", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675194426, "uuid": "c06716ce-fb4f-4d14-872c-aa1a9330c390", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675194426, "uuid": "ed52538b-1a41-42d6-86c9-2266a9b226bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad88f1b8-a170-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675174083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174083, "uuid": "5b42ade8-dd9f-47fb-9a27-e7899bfa2701", "comment": "Malware payload (Smoke Loader)", "value": "80dce0e25c4ae0cb47c96795fea91a53", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174083, "uuid": "38fd2aa1-1054-469b-ab23-e6e08c1789c2", "comment": "Malware payload (Smoke Loader)", "value": "9fd30388fe3c1b70b923b6d53c65952a1fe19b8508f08b10d8269584852d18ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174083, "uuid": "35fc56af-779b-4218-9dd1-74351e2fc39e", "comment": "Malware payload (Smoke Loader)", "value": "c051c5bd4dc9f3e061ed56d036cf7fa2ae703ea8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174083, "uuid": "96318ae0-049b-4b92-97b3-5e8fe909a924", "comment": "Malware payload (Smoke Loader)", "value": "4cc41bd493a2ddc5566994e4ef5c1e9fb6aebb9e6b76d4865d84f6a75b5ff8d80a4f4eb90c575b030cc646911d00f774", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174083, "uuid": "d7104fa0-43c4-46f5-ae09-9a1012347c23", "value": "T1B9548DC272F27C62E9228A719E1EC6F8761EF9534E1877A6520B9BDF15B41E1C5E3200", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174083, "uuid": "7fe97832-8d8a-4263-8b46-7cc15d3d2e9b", "value": "e73db8d7bd9f9f6b2076d026a8fb8fc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174083, "uuid": "87146dc3-f260-468c-a7bb-57d3bd06cd24", "value": "6144:7PpW0Ll1pPBdUmYRrKAkcmqMoITim8Mu:rpxRrPBGKqMkm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675174083, "uuid": "b4940556-6084-47a3-904b-5c7bc8ec0ebf", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675174083, "uuid": "6dc8b3ad-7e64-4365-81a4-bb4e89b1a126", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174083, "uuid": "6e2f881e-b19e-4f43-b951-a2f98fe277bf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d9e6b98-a1bf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675207879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207879, "uuid": "942ff1f3-2897-4f5d-8744-3d72dfa6bcd2", "comment": "Malware payload", "value": "59ed270945fad4ec125167a083f43990", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207879, "uuid": "0c76f109-a3b1-4a4b-b4d5-c954d0bd3e8b", "comment": "Malware payload", "value": "9ffb020c78f8ff1df1572833bee213e3a0298f304b3d6187a7f0151568352ad3", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207879, "uuid": "d019cc7d-e213-4abc-8dff-cae0bc1bdd92", "comment": "Malware payload", "value": "d85cd7fb4002deed79f677e8a446a5ac56932da7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207879, "uuid": "0cf1d577-a398-48c0-9080-596e97b1ecd9", "comment": "Malware payload", "value": "ac2c4525bf18b1bd6b42435d6eaa5eb93b26f52d5cd7ca27d598a0a9706658d80405f6046bedbe564f9d5d8870fe07b3", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207879, "uuid": "cb9d49d5-8298-4ac0-8a06-2577b2e76791", "value": "T176D6222275C5C633EA6F8330652ADB7B51F97AE0377380DB53D8992D0E719C08276E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207879, "uuid": "0becfd67-0a9c-4ab0-a67f-2fe76d620d60", "value": "393216:CFwmf6wAMQ8MLCCBtBOy2suKLRyfWVC8:CFwyh3wBtBXruKLgWVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675207879, "uuid": "b6ff4fdb-7e6b-4c24-b97e-7c44e260b7d9", "value": 13090304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675207879, "uuid": "97cb02db-923a-43f4-948b-22ed07eb7990", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207879, "uuid": "80f7fbc5-ef5e-4eba-b4d5-e05ae3beb9a5", "value": "SecuriteInfo.com.HEUR.Trojan-Downloader.OLE2.Powedon.gen.15770.29220", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f48b96a-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140478, "uuid": "6559fbab-fc07-41db-866e-1ffee5c4b7b0", "comment": "Malware payload", "value": "a983ba5d4b954bfe19b3437b4dc06b93", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140478, "uuid": "6288c46d-f135-4318-a403-b1155606f97f", "comment": "Malware payload", "value": "a000518d04b2364f365701f9dead5798f6f39df66b1d97e9d10525b083caa2ee", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140478, "uuid": "7b9cc3c2-b84a-4922-8946-5a080cd906b1", "comment": "Malware payload", "value": "7884b2e8a38b0332b8953caaa47211fe9085acec", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140478, "uuid": "32a71b2b-109a-4c2a-a42b-83a2f05bde69", "comment": "Malware payload", "value": "c4fe4d8ec118b94d864e85f11a6c4d47f9b037320d26d6ea92eb7c84e4d3becf72fcf459731f5aa38d50715f63bec19d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140478, "uuid": "6dd0d952-f8a1-4ef8-8476-5df3aad8a817", "value": "T177363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140478, "uuid": "50ca41c5-7607-4140-8639-a6846a10080d", "value": "98304:Hv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXe:HvpvFa+g8RWLdPk/84tCEr0RtNiC5eSr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140478, "uuid": "2dd44215-22e2-45a6-b076-6479b52952cc", "value": 4992000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140478, "uuid": "3184bcc4-1ff0-4d03-bf7f-e1ee4d94d8a8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140478, "uuid": "1585c320-0748-4dc3-a12e-ec0ab2cad876", "value": "a000518d04b2364f365701f9dead5798f6f39df66b1d97e9d10525b083caa2ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d94a16ed-a14e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675159554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675159554, "uuid": "f505f334-ec1e-4698-bc8e-f2649f9475f0", "comment": "Malware payload (Smoke Loader)", "value": "d16cea99b4a19710dac37d241589967b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675159554, "uuid": "a781c139-2c9f-4d34-8661-7e6f1cc896c0", "comment": "Malware payload (Smoke Loader)", "value": "a0416199d042634a3e1f117ad0fdcddc13c54dd1ad7e681fa3958efcd5f05f78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675159554, "uuid": "c6af1fbe-301e-4600-b017-fb0c7dc6453d", "comment": "Malware payload (Smoke Loader)", "value": "d13b4f523056ccd4924566c0bcb08a55bd7b2e2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675159554, "uuid": "730b4a5e-810e-4b1a-9f56-856c9c4d8790", "comment": "Malware payload (Smoke Loader)", "value": "2f034b4586524dfb81e1c112fd22fdf81477f3851e1d62a2f83f62a8d2d2ca0a75a9001bd5478c8059f7954362095292", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675159554, "uuid": "f8e910d6-56b1-4a84-a116-935ec1684adb", "value": "T16A548E02B2D1BC41F5668A76CE1EC6E4F59EB5D2CE08A76623186B0F25B31B3C763711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675159554, "uuid": "27934838-aaf8-49f7-a40d-128e7588a61b", "value": "a2c8bd590ac12702f85d4107db46f8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675159554, "uuid": "5c74930d-2645-406f-993c-51bec004a626", "value": "3072:1GuIvYcLtS0h7R4zc98+hF4iadTAqX6DSeCrm7hZtS/7f43H7BFX9PRCDJ1:T+YcLtBgzcFhF4P3XWKSNG7f4V195", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675159554, "uuid": "3fc9a9a1-34a3-46da-b7e2-4eee4fcacaea", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675159554, "uuid": "dd2efd64-91ef-48f0-b532-76318aa17d09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675159554, "uuid": "37ad6904-4ed9-4f97-be29-a278110d76f7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d110864-a18b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675185572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675185572, "uuid": "e3d3b058-e019-4558-a714-9af19ecea5d6", "comment": "Malware payload", "value": "83875df1ddf8a47531e763f5bc140691", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675185572, "uuid": "baceb752-1274-40e5-b2c5-7e815f387bf6", "comment": "Malware payload", "value": "a15f29572a149a04d45b8c01daa047ec9f517077a507f8d53ac9b8a8ceed4a34", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675185572, "uuid": "0f859e0d-2ad4-47a0-8b6a-c6528eaa5933", "comment": "Malware payload", "value": "8d1bc0c5bceedd229b8faaf6542779726188b145", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675185572, "uuid": "9e48061d-7d63-473b-b7c6-89b30b7ad673", "comment": "Malware payload", "value": "75904b50d665fcece97fe9b091cd7559b00f3d5a02de995425ffefa0d0f3d2f3fff49aa15457263e539a4e7dc04c10a2", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675185572, "uuid": "a73e6d39-0d32-4e8d-9b0c-55bee03437c6", "value": "T19833E01F879B1D3EDBF5BEBF852DE561F20115C3066A47D8A67D92C6E63C3248B90028", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675185572, "uuid": "b83ce5d2-cef7-4480-b053-acdf09dc43f3", "value": "768:xZZOUUP++sgCpDgSE2WPENq+qrD/PESqitk3Spn1eqy1nUNamt:m+qCNgNgqdj1qitvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675185572, "uuid": "ce77635c-069f-44f6-8055-5e2ffefd954e", "value": 50174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675185572, "uuid": "40b8a50d-7bce-46b3-9d0c-2d3d289766e1", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675185572, "uuid": "5e30d149-9d9b-446d-8198-2d7ff98d9cb2", "value": "payload.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a01d298-a146-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675156012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675156012, "uuid": "3a591e48-8d87-4fde-9c5f-6d0b85272084", "comment": "Malware payload (Mirai)", "value": "6ac1e528ca7104790a975fb7912ba035", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675156012, "uuid": "1753b104-291b-4716-9727-d224289f0f3c", "comment": "Malware payload (Mirai)", "value": "a17fc550de9227acf2bd3ed88e55b53538bbe00d034928888a7376ea0c245e7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675156012, "uuid": "558a7d15-7c72-43b0-b34a-338bd0898a08", "comment": "Malware payload (Mirai)", "value": "f6b0a03047ca0d4d05de1f2afca42b88847d3e56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675156012, "uuid": "35f7818a-af09-4779-b85e-468816e2c6b7", "comment": "Malware payload (Mirai)", "value": "2fb51631f41976bc1287fdb00c9649e21669f3751a54ef7e07cc9332c001f9aad20dcae75319fa66d63abdef579705f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675156012, "uuid": "7959fcdf-0794-44d0-a971-6564dec1a6d8", "value": "T109735C99F4018E3CF85B95B994160F05AD21A3855BC30F2BA7AAFEE37C731547E42D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675156012, "uuid": "554c8e1d-274b-4a88-aa02-4d39ebe0a8c7", "value": "1536:YeCLYMhbnVo/rFVuamw8D97PQkvYFmtMII:9CLYmnUFVupD7iFkMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675156012, "uuid": "e8db1dfc-3492-40e4-a095-2bf54ad7e629", "value": 78428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675156012, "uuid": "f9d96038-a1dd-4c44-88d3-2fc319bbf96a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675156012, "uuid": "cf152f42-eb89-46fa-a296-977a031cd429", "value": "6ac1e528ca7104790a975fb7912ba035", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49454ba-a140-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675153479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153479, "uuid": "c63c2f41-90a4-4652-ba84-4d87a6181bba", "comment": "Malware payload", "value": "103df7dafa71099da6d5493644d6dd90", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153479, "uuid": "aa24dda9-2bda-453a-bb31-4e32106ac556", "comment": "Malware payload", "value": "a221bf2f1039804dc2f064ad09b86d9eec9c41c6abb9f9ce7360d830ff37060a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153479, "uuid": "1616f65e-20fe-4897-a0ad-4768363b72ff", "comment": "Malware payload", "value": "bb4c6ce3aefe03c57cba2fb70967d497f1a8cc90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153479, "uuid": "45ddfd56-7e1c-4059-b688-f76f7e353b3a", "comment": "Malware payload", "value": "70b9a68c2e58073e6dd0bd97856a65e6206230d3075e35c1b1c2850e5cce3332cf3fc265917f94bb6cfd0e376b7fe7a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153479, "uuid": "bd3a7f6c-ae77-4642-902f-a4c7079f89d7", "value": "T1F2E4E53D29B717E6C338F93186E18420B6EEA1923703E969DDE61AD14F026C27DCE51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153479, "uuid": "534971d7-f0d9-4ec1-82e0-ac252a809192", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153479, "uuid": "bc57297a-8f1f-4b3f-a723-d1486e1e6ec8", "value": "12288:z4+C+2SlLVseHKNTn7tunA+/kSIlljwXcd7wJErzqczJQ9tm5yA2oIgQfo30AIl1:zZjseHKNTn7tunA+/kSIbKIiWOeh5tDC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675153479, "uuid": "7e01c19f-93dd-4966-b9a0-20a1fcf8185c", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675153479, "uuid": "78c5eb7b-8ec8-4415-b5fb-547c9db14fbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153479, "uuid": "8a34f518-e151-4f74-801e-d7158d14775a", "value": "Payment_31-1-23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e708ebf-a1bf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675207881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207881, "uuid": "bf6fa6bd-c519-460d-acc5-03bcf86dcbd8", "comment": "Malware payload", "value": "2bf3c2f928474b80eaac31fa953113f6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207881, "uuid": "225ab1ee-a91a-4139-9ef4-b0871241ec25", "comment": "Malware payload", "value": "a274e2ade352ec745e33f63b958d287e29c3cd01de5bfe3a1fc34db144b5c8f8", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207881, "uuid": "ad27b9fa-86c8-419d-b488-3d65c693dc54", "comment": "Malware payload", "value": "48cd0329551417e74fd8f34a873f38856f75e8dd", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207881, "uuid": "190c4500-4a84-470c-8b0d-b755325624aa", "comment": "Malware payload", "value": "681dd1e9e2594e1d745f284026d8fad2f76873598cb50fd415cdcf07b1aa496bc333fd4365c59ed5265edba29b0634da", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207881, "uuid": "d9bd7cf8-457f-4343-9be8-9b936cd651e2", "value": "T1C1C59D2275C5C233EA6F4330652ADB7B61F97AE0377380DB63D8962D0E719C05276E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207881, "uuid": "350086ce-cb54-450f-89be-c9f8ea3ec5a8", "value": "49152:BZEYUMV3eVougTCAFPsJ6ma8zotlmfwrgxMy+y29IAan6DrH4vLNgmUESIEjPMNO:MYUMV394AlAfwrty04veHjPMNac", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675207881, "uuid": "4dd462b5-2ff6-4e1c-85f2-1f9cab90f3f2", "value": 2517504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675207881, "uuid": "0b485345-1111-45eb-91ce-1147c37b09cb", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207881, "uuid": "dd418fdf-3a70-4d12-b8ec-ae37eadf433e", "value": "SecuriteInfo.com.HEUR.Trojan-Downloader.OLE2.Powedon.gen.3637.8442", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f726b5a1-a154-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675162181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162181, "uuid": "eba8c554-4c9b-4358-8fff-234a9a7f3e32", "comment": "Malware payload (AgentTesla)", "value": "cc3759ee11aa0cebcd2016c7a1687672", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162181, "uuid": "3eb47588-104e-4347-8707-270586670225", "comment": "Malware payload (AgentTesla)", "value": "a2fe346e65147f59589a574631d05f6604cc8c9c2af984e8f40729b58428ab8f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162181, "uuid": "906cc6b4-850b-4819-8b82-dd28c1d6b564", "comment": "Malware payload (AgentTesla)", "value": "772db6c38fe602140b65f1c3d6dca3cd2ae3876c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162181, "uuid": "42f0618b-1dae-4d60-819a-ef31097154a0", "comment": "Malware payload (AgentTesla)", "value": "85014033850c8a0db4b2cd0ab79e8a9fe5fcddef1e0c0ef6105e92228d179929fdf48c30a926d8067d50a3b510fa9412", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162181, "uuid": "1103f699-1739-4759-b058-9247772b508c", "value": "T11562D08B14360A0CD44BFF97C5A874B9D12286228A57C65DF6FF0651B0484D7B8B7043", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162181, "uuid": "5390067d-b2cc-4e72-952e-afb1872d216e", "value": "192:WBXLFvEaTuO5ZUTTYVK5g2T1YALyGJ9NLf4rBEGGfX0HypSPUeNVSiI3IS+XCsjw:WBJ5ZgrS2GGR4affXtpKJSiI3P+4qQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675162181, "uuid": "7ac1d65b-041e-4c21-86d5-39a8721c97cc", "value": 15489, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675162181, "uuid": "bd4bd9fc-6a38-4115-8f6d-dd611bcc11a8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162181, "uuid": "750bdcc6-cf03-464f-a48e-34dafa8a920f", "value": "PAYMENT SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ca1d00-a18f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675187143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675187143, "uuid": "991a251c-42c4-47cb-b82a-4798f291de38", "comment": "Malware payload", "value": "105794d788242b0b0e9a4dbfd0441335", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675187143, "uuid": "05993bd7-34a8-40d7-a6f0-565d28634c36", "comment": "Malware payload", "value": "a324c01ff3d422f7b2bde19998c49ea6f97703051380432fc3a3b7541b03e7b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675187143, "uuid": "020887ee-81d1-4dba-854a-709021794c8f", "comment": "Malware payload", "value": "def1d7e30fccff362b14480087f0a181522ef097", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675187143, "uuid": "89f6c75a-d9a5-4ab0-a6b4-871d2326792f", "comment": "Malware payload", "value": "15788669ae6b4fd16f17f8f10129b7c41ca0db2f0adaff46dbb4c972c1cbdb486b8aebb967ecb1b8519e5c7464790636", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675187143, "uuid": "c8902d5c-200b-4001-a43d-0ca014245121", "value": "T164A5336BA4D5B072E0729E745E20DC40F663FEA7A5303319306D75CE0E6BB929C89F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675187143, "uuid": "e3d711d2-3e1e-44ca-80c5-c6fb2d4d3286", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675187143, "uuid": "bf3d41b6-c639-467b-ba8b-068fffd529f5", "value": "49152:C2M1VLV/m25jb0aTJJMPjt3izWT58OLnIGvGikLCgv2MR:dm7m2Nb0SMxSzWT5LhvGDv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675187143, "uuid": "078a191b-f139-4e41-bc09-5704c5cd8969", "value": 2180107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675187143, "uuid": "b29c053c-59a8-41b7-96b5-e38f83e4c511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675187143, "uuid": "0ffc19e1-ec5b-4534-88eb-cef4eba40fe7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75cca13-a19f-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675194367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675194367, "uuid": "4d8ac9db-f9e1-47ce-a966-3d07e03327f1", "comment": "Malware payload", "value": "8f7e2bf98564e0155bbc7019383e712e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675194367, "uuid": "26cd697f-5581-4dd0-b2dc-0e73f8ef91d6", "comment": "Malware payload", "value": "a43dac88e4fcfdc539cfedb879e9d6e6cb435e930218faa02f485fd09543c4cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675194367, "uuid": "950a5afc-5521-43a9-9bd9-2040e483823d", "comment": "Malware payload", "value": "eb01295c402c371e1c5326665ca594daf48ff3c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675194367, "uuid": "d4d710a5-6441-42f8-b006-e0f7ff9ac199", "comment": "Malware payload", "value": "d83bc2e9e060de9bb5d168d1cea1589eb4b2d27ff0ba3214e43d9bd40fef94a947d043a2d27643acf52e0b5017c898ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675194367, "uuid": "d9aeccce-04cd-49bd-a198-f58183b79aa9", "value": "T11BB533D0E05AA076C1A1CC3ADF222266B6393779973145087A7DA71E7DA61E1E00F7CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675194367, "uuid": "d64f55b2-f3ec-41f5-bf1d-1cb5d3dc7d24", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675194367, "uuid": "972c2abd-67fb-4f1d-be25-fef9adf9bf17", "value": "49152:C20AMNwcUoi1PP1avhVC+LYl2LA63D5XbIKgeHTWd+dBuur9LCgv2MR:d0AAwcUoHzCL2LA63ZEKbU+TuuBv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675194367, "uuid": "f2aa2e91-c220-482c-8add-baf3ce124e2b", "value": 2353183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675194367, "uuid": "1d7eca0d-c774-4bb5-beb6-24f398609605", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675194367, "uuid": "e5740bf2-f0b4-4469-a682-6983f8199905", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7dbb8f-a146-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675155994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155994, "uuid": "cc7f7b2b-6f27-464f-9acd-fac154d256d0", "comment": "Malware payload (Mirai)", "value": "8efd94aa75988cdb3a342a3fa296dcc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155994, "uuid": "f352e91c-901d-4dbf-a1ee-31f31282dac8", "comment": "Malware payload (Mirai)", "value": "a455691fb3d3a31b7f5412e270ab7e5c39efda30fbdb7821ecef87b572047789", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155994, "uuid": "8c6a4bfb-318f-4eca-9922-7d39d15c2a83", "comment": "Malware payload (Mirai)", "value": "92b609de5fba75276cec6007d60d87cc52c59dda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155994, "uuid": "c0965d57-277a-4804-9e1d-58b21973cb89", "comment": "Malware payload (Mirai)", "value": "6755f780939259f796807e3f99c6b8554a8421c68b68b90302c12d166a7559a1978d02186497eb7ecf54bbc55f6c3497", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155994, "uuid": "f660c0f8-f332-4032-b544-94aa22649a27", "value": "T1A3639D76E009AFA0C5410734E0E6DE341F63A4C562A76EB69ED545B25083EECFC18FE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155994, "uuid": "4c8bfd02-367d-4688-a078-a662cbc1e788", "value": "1536:aawaEc+MwrwtFvEcpSqS7pGR/NtcQIkMec0Cw1Tv:adRXMwrSE2SlkIbec0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675155994, "uuid": "1e82bde6-03ec-4ca9-8e41-7584ea466ed7", "value": 73104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675155994, "uuid": "b5b774f7-f309-4c02-a5d4-581363683b89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155994, "uuid": "4b1d260c-e252-4694-bd58-476eeacf5113", "value": "8efd94aa75988cdb3a342a3fa296dcc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db67655-a123-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675140798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140798, "uuid": "b4b012cb-a70c-4ba9-8b15-b7c82a95e684", "comment": "Malware payload (AgentTesla)", "value": "d5f2f246477c3be16555e92ccab7e936", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140798, "uuid": "30747f50-d342-42a5-9760-52ea7a90b35d", "comment": "Malware payload (AgentTesla)", "value": "a46c5cff0996f7577d553c47f320ef079864527d266802f35a7d032850d9bba3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140798, "uuid": "bdf010a7-6c05-4ade-9fe4-bd49cf69c92e", "comment": "Malware payload (AgentTesla)", "value": "a40e0a5983b60104eb7c582e1e1378084894171a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140798, "uuid": "7cb961c7-b1b5-4c1f-b74b-81685aa2617e", "comment": "Malware payload (AgentTesla)", "value": "a31001c247382ef9e7096de9578ccb6145eb16393268f9ec7c0ca0a88f6a8c2945840082a37adf9601a23b453fece7b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140798, "uuid": "b2c2013f-80bf-4732-b769-af7d703e1882", "value": "T195E42201B7E88359CC990A394DA45E0847B46C94F8BBEB1A3DC174DE9937BA0504EF9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140798, "uuid": "f9f63157-8db7-4ac8-806f-38892ba5845c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140798, "uuid": "a05cd7c9-c219-432a-a41a-1c1178ede028", "value": "12288:Qs9BFjCfuXdm4S4w1gzs43aIJjahSy9xmJriRy36QAYEZA9qlbCd2oMI:jXYw2I3Qmt96QAUdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140798, "uuid": "eb927cc8-eee3-48c6-92ea-91895ffb842f", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140798, "uuid": "fc87bdc3-858d-4988-801a-06eccfaa26c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140798, "uuid": "1a9b8c40-7937-4cf7-b1fd-ccb958c36531", "value": "nm7b03DFo5JLtbV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d84ffedc-a182-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675181886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181886, "uuid": "3173de76-6ae7-4352-a61b-bba09a3ecc2c", "comment": "Malware payload", "value": "71de8d83ef24e873b29035dcfe81fdea", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181886, "uuid": "2cfbc279-3f35-4261-9327-5d0dfa0f615e", "comment": "Malware payload", "value": "a4c5ce40579c310f27d9e3cd8de778a1a1029229f5324bb1b394903189dc6381", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181886, "uuid": "95c60655-df08-439a-9111-638d548d1d50", "comment": "Malware payload", "value": "ad82a22009fc0d9fa8fc3a27c7678b0580f132c5", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181886, "uuid": "98eb27c6-87f7-454b-8ee8-6db223afa150", "comment": "Malware payload", "value": "3665efd262219acf0ceb39fb0ab787bc19d8048a231c50eff34e8d9473445a3fc43d4f16ce6b26a9d94a73517a3f7b63", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181886, "uuid": "ed8d7895-f561-4f05-8cc9-17fa1f2bd753", "value": "T1A25156CCAB2AE8DA49A9414C619FD9A44265CC1023F6F3A42E4D34F3E994BB4F95D31C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181886, "uuid": "16ba7ec5-331e-4148-9484-edebc1e9091c", "value": "48:srcHRJ+qHS+3pNxHKol70h+uSLayZqASMP0h+kIEZ39XME7TyMaE9V/y6n95ppl:soHRJJHSaHHKode87Pkv7TyEq6Lpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675181886, "uuid": "73fe4070-6e27-4e59-9d80-b6bf44e078be", "value": 2641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675181886, "uuid": "7840aef9-dd67-4082-9a2a-a5cfd46061dd", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181886, "uuid": "327298ca-7f62-4d75-a2c7-46e502a8bc85", "value": "payload2.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18f19a82-a17d-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1675179417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179417, "uuid": "98c4daef-08a3-4737-bef6-4ddc196ebc39", "comment": "Malware payload (ArkeiStealer)", "value": "996a9afca7ebed4ce1ac3f22f2f8da51", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179417, "uuid": "505426b8-2864-48ec-840b-675467c8ce83", "comment": "Malware payload (ArkeiStealer)", "value": "a594a97b66c29d9128d7757f71650c91575f1f32033f4cc56b49e8f5e1d4cecf", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179417, "uuid": "ed9da97f-8f54-45a6-9e84-06b96331f077", "comment": "Malware payload (ArkeiStealer)", "value": "bebfc60a7b1fa8e493a458d15331907233f0e928", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179417, "uuid": "fed82416-7e0c-4e8f-b258-bec55c857b66", "comment": "Malware payload (ArkeiStealer)", "value": "a3e41ce968653872f5f69da5fd0b6a7065579bd07bad0a93473ca559e8a2e4025c445c636874a6b785c89f2c02073808", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179417, "uuid": "2530ed6a-6390-479b-a042-a687f75bb9e6", "value": "T18D94BFC272B37C62ED268A728E1EC6F87D1EFD524E587366120B9A9F14B01F1C5A3741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179417, "uuid": "7bc0b827-037f-47a5-a91c-e747f83841bc", "value": "e73db8d7bd9f9f6b2076d026a8fb8fc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179417, "uuid": "bad7bbba-2c7f-4c44-a6a5-04acb6d8b57f", "value": "6144:rkgYDLQMDGDJyzP+Bpitd5QHiIuTWuej7bwtRaamqMoI/wr8Mu:9QcLDJwyWGCIuTPGbzqME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675179417, "uuid": "e0657f27-b3ae-4acc-b803-418b2f335fd8", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675179417, "uuid": "4e487e4f-010a-4d49-b56f-3dc5f7d28a2e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179417, "uuid": "da770b96-59ab-4c6e-8a31-a93afcef971d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e235e6d0-a1b2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675202518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675202518, "uuid": "42d4f28c-e916-42d5-888f-0d5b90e03b70", "comment": "Malware payload", "value": "330846f9ee7235792f46a53b57ad2654", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675202518, "uuid": "d4647c2f-b893-4196-b977-d6a499a02ae2", "comment": "Malware payload", "value": "a5bf97d2e228cd4ebeb835d844a3949867a703bc874f06d9ee461c24a2b13adc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675202518, "uuid": "f064d9a8-9aed-4010-8bcb-1d76bd685b70", "comment": "Malware payload", "value": "87ac046d460a1de177f31c616226df2ab8d3e656", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675202518, "uuid": "f1809e82-1c10-43fe-b7f8-1a1047a3a385", "comment": "Malware payload", "value": "2729e5f6803497b1574ac3c93326c7c7b6ba0f03e709fc79370e87aaddc7c3ba28dbf56ba23819367d8743d889f39af1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675202518, "uuid": "e2b708f0-422b-4e88-9b1b-74747058459c", "value": "T1DEA53309E0F5943BCA655F38770643033A397EA65036282D718F7A5E8BB73E0946DB36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675202518, "uuid": "15b8dae3-8637-4e62-be10-3a309d6ae726", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675202518, "uuid": "2af7a22b-b9b2-4540-bc57-d16e24e8d0fc", "value": "49152:C2NQ8xlWwcU1VsVPMvWoY1Tb1NPRPxNwZJLj6F+oLCgv2MR:dNrMUDw0uoY1VNpQZVj6Mgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675202518, "uuid": "0aa926f3-985b-4ceb-8fa6-4748f38f4e93", "value": 2208279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675202518, "uuid": "b8eb4cb9-68b7-488e-8f59-7331788b6c7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675202518, "uuid": "772c5ffc-c1b1-4d68-bf50-1ca0d2b02178", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64129d2-a141-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675153938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153938, "uuid": "660be040-97de-4ca2-a11a-391f8086fda6", "comment": "Malware payload (RedLineStealer)", "value": "a2334decbc20c6a6f33fe2da2600a59e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153938, "uuid": "936e1fc5-9ecb-4171-9bc4-bf7402a5d1aa", "comment": "Malware payload (RedLineStealer)", "value": "a712d5c80ae85810cb593fecae145cbde3616e9272563cddbe3b5ee215f054e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153938, "uuid": "d9270e05-83b4-4c94-ac4f-3d4acc9677fa", "comment": "Malware payload (RedLineStealer)", "value": "ab1ecaaef56a3b694a55e68abd46e8c954a3b639", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153938, "uuid": "ec62fccc-593e-4f60-8a0e-53a15e207956", "comment": "Malware payload (RedLineStealer)", "value": "5c9bfdbbca9fadc9dcaf90042a83ddb6b68e60ad4d6220f7a1a26edb46e85b2c7bdd809ae3e0abe6fbe869881a3cdb7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153938, "uuid": "57ec69a6-809c-4632-8da7-6a69cf2f5e68", "value": "T12C84BF02B2E1BC50F5658A758E1EC5E4F15EB8D2CE18BF662318AB1F25B31B3D772211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153938, "uuid": "6793cd0b-f485-40d7-bb8d-0d9623c9dc90", "value": "a2c8bd590ac12702f85d4107db46f8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153938, "uuid": "e0bc2c51-b751-492e-85b5-b8eb39d73429", "value": "6144:7/MILImjdRmq1NIwel7Cxtu92036Z+m7f4VE5Tj:DbcumYIbCxtuX6MmzOu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675153938, "uuid": "66be5360-1af9-417c-9bfb-6a6b15f951ae", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675153938, "uuid": "62abd139-42f3-4c7a-92a9-3d59ddf41148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153938, "uuid": "d3c35bf0-4dd1-4c17-aef9-068ab9cc3756", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732c7050-a189-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675184723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675184723, "uuid": "90e208fb-4155-485e-a179-78be784876b2", "comment": "Malware payload (njrat)", "value": "515df3126f3f622f14266d65eba4c84d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675184723, "uuid": "18453d41-95ff-49e6-bad8-1bf7ce075854", "comment": "Malware payload (njrat)", "value": "a7ef535b5011cc362ae4b48c75e83cf50c6a1ce9862d5871fb4177fcfa0fa692", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675184723, "uuid": "ccaa9587-36f9-4458-847c-68116b807869", "comment": "Malware payload (njrat)", "value": "e889a3ce02956b276996436b5397ec3e42cf8c51", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675184723, "uuid": "66dd8b5b-29e0-4198-a2a6-b040980d7264", "comment": "Malware payload (njrat)", "value": "dea6a1ea1322da76e6c6c15797d38b222381de4af9c8903a72af8043b34c62ff449bfd50acecb06dd7e59987f9212d79", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675184723, "uuid": "94019085-200d-4488-9d70-27ffc6cb69b2", "value": "T15B13E74CB690E175D6FF8BF1B4A2B2890B71A01BA902D30F99F154D94B73EC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675184723, "uuid": "c8356002-8c63-4516-965a-7380b3980e64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675184723, "uuid": "d1807d6e-816d-4df2-be45-3e80b016921b", "value": "384:KZyhWg98NaIyrXLb3GHaAmE9iE7azsIij+ZsNO3PlpJKkkjh/TzF7pWnH/greT0k:IOywFr7b3w/fguXQ/oS/+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675184723, "uuid": "624f654b-aceb-4788-8d50-109928f05349", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675184723, "uuid": "1194cdb3-f81f-46c5-8488-f069be97954b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675184723, "uuid": "1300852a-bc67-4ea4-b57e-654be0334182", "value": "515df3126f3f622f14266d65eba4c84d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18fe9a7-a1c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675208530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208530, "uuid": "933f1d3d-f643-48e8-b905-8106ebfe6848", "comment": "Malware payload", "value": "9e0b8936842bb13d91c2543ded671828", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208530, "uuid": "f9a9e1b6-72dd-46c8-89aa-91544309a593", "comment": "Malware payload", "value": "a84ab76e28de5edcedaab2cb2565662f9db203e95650e1d78144ac5cf531c7c1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208530, "uuid": "a8c4102e-9da4-4932-ac5c-809cb9e0f273", "comment": "Malware payload", "value": "a1fcee4c13cf29e385f72d8c647887269c9a28d2", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208530, "uuid": "44360673-aaee-4ab3-a851-eb573dc9c1e5", "comment": "Malware payload", "value": "80efe52c528e2fbbfe3450dc37221a8671ee743b1ca36353f1aa4c301b505bf6ab5ebfdeabfef6a561265e113d2e2cc0", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675208530, "uuid": "66d4e097-9afa-47eb-88a1-a94f1aa4062c", "value": "T1F2F002081BC93D8ED1BA4731605A6309BF38CA7812271EAB5805A7497C90CD538C31DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675208530, "uuid": "fd323375-51c4-4fb0-9f69-b696dfd0d94d", "value": "12:5jnL/aTkpHjqCjRoudrbF2rdQKgSog4z/arai:9nraTOXjec8dQKgBg4Dab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675208530, "uuid": "202693b3-f3bf-488d-85b8-179d785111cf", "value": 591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675208530, "uuid": "ac6831f7-6f16-4b51-b448-22747772f5e2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675208530, "uuid": "5134e346-bca1-4b6a-b372-183432483e5c", "value": "f3c3d2fae15f05589f8860df40d0533165484fb2975b2204c2f7cca750eb7b51.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5342779-a12a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675144085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144085, "uuid": "5b069c45-2de4-46a3-b542-7c87638383e1", "comment": "Malware payload (Smoke Loader)", "value": "103293c5dcea4be2a9672323225a5140", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144085, "uuid": "de17e2e1-f604-4709-9d3f-ea39c1f80359", "comment": "Malware payload (Smoke Loader)", "value": "a882160949ca79fc5a1a4ea9d8631581cee3ff257396dc92c28456da8f3513e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144085, "uuid": "75051e6a-d5d6-4d31-b916-b569f79c031e", "comment": "Malware payload (Smoke Loader)", "value": "8c2223aeda95d8d1877c7d88c851af00ef723063", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144085, "uuid": "834b57c8-6081-4efe-85ea-8424615659e7", "comment": "Malware payload (Smoke Loader)", "value": "295fce0799d6c738bd17ef8914374a849ce357bcdedad38fab247051baeb3ed712daafe86a4ca4232457b7298062dc3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144085, "uuid": "76f9f1ca-e9a9-422a-ae01-7288ada26da4", "value": "T187547E22B291BC40F9668A75CE1EC6E4F51FB591CE18A7252318AE1F25B33B7C763701", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144085, "uuid": "64164372-2f87-4892-ae0b-ee47c4fd9113", "value": "a2c8bd590ac12702f85d4107db46f8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144085, "uuid": "725d159f-dd36-4e1e-896e-da7cfa794b0d", "value": "3072:9aukeeVLdI7R4NdtbGma2dFGNPNKQDY0ImKR7f43H7BF0S3ORCDF1:XDeVLdVN/laUIPMQDYqc7f4VZ3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675144085, "uuid": "6aef0e7c-5fc7-445e-a7d4-eff962181286", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675144085, "uuid": "c36476d8-69f6-4cf2-b887-58f29bded481", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144085, "uuid": "280ec1f1-a55f-4a9d-8ec0-34824bc23664", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "611b2e53-a15b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675164936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675164936, "uuid": "e5cbae3e-1596-44af-b0f1-1ff4a7449175", "comment": "Malware payload", "value": "749e027b37a2c28e1253948fba50836a", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675164936, "uuid": "dbda4de8-af92-4e9c-8eaa-fc37c09511bc", "comment": "Malware payload", "value": "a8faf6829caba1dd3845c26fb920edbc350cf2d0ee3b87972daa7191649ed8b1", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675164936, "uuid": "638c7909-d5e2-4824-9ea5-05510efe3fee", "comment": "Malware payload", "value": "5d052e8d5eb9977b3c80a69e835e1f3dbeb6184c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675164936, "uuid": "7d4fd36c-fe9b-4eab-80b9-853ccad0e95b", "comment": "Malware payload", "value": "31b34df365edd3300437b53db7826ce2a6b4226fcbe39f2da6af5fba56b0d33a16a0bb177f7e00a756749ef6dca470a6", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675164936, "uuid": "5c533d35-8b4b-49da-9f4b-e128987e986b", "value": "T126412B91C02191AEC608BD2D463E4BC41A72376F4D77954A0D246F826AA3EA7143FE9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675164936, "uuid": "ece38b2a-05b3-4dc9-a14e-511cf9058e23", "value": "48:DIcZTLWM6TXz1XZIkjonF6sDVtDIKfgMGM0HtFqwvb7BNZVkvWDIwkn:MATLqXz1ykjYTVtDIKoyCwkBNfXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675164936, "uuid": "0059237f-e2b9-49bb-928f-01d41ed1b6f9", "value": 2284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675164936, "uuid": "60ab9b10-042e-44fb-9dae-3675c6202180", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675164936, "uuid": "d49f95db-c9ff-43e2-957a-92bdfbb1eb92", "value": "mal.ps1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb076742-a12f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Ransomware.LockBit)", "timestamp": 1675146216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675146216, "uuid": "7f49cb15-a38f-4e42-95fb-f1e17126f625", "comment": "Malware payload (Ransomware.LockBit)", "value": "2bfdea16cf53002cbdf993cdadf7cd97", "object_relation": "md5", "Tag": [ { "name": "Ransomware.LockBit", "colour": "#790797", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675146216, "uuid": "2bf07999-8d2c-44c1-aa9e-59e631a064eb", "comment": "Malware payload (Ransomware.LockBit)", "value": "a8fdc3e6deb605a52095c0b7726aa097e97a2285acbffea80c2bd4935e8b6055", "object_relation": "sha256", "Tag": [ { "name": "Ransomware.LockBit", "colour": "#790797", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675146216, "uuid": "d3900ab3-05e7-484c-abbb-4ca0553b285d", "comment": "Malware payload (Ransomware.LockBit)", "value": "80892dbbf6702160e863eb4a9ca0fc1ca196da98", "object_relation": "sha1", "Tag": [ { "name": "Ransomware.LockBit", "colour": "#790797", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675146216, "uuid": "a35fbea4-21e6-43b3-ba4b-bbb6e43342b3", "comment": "Malware payload (Ransomware.LockBit)", "value": "511ed9a85956599c069d0ee18d3826e6aeb5af1b0494554f73cf93c6e6d13d91ef2359ba0ec190a0939d224acdb071b9", "object_relation": "sha3-384", "Tag": [ { "name": "Ransomware.LockBit", "colour": "#790797", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675146216, "uuid": "983a4522-e4cd-487a-a382-770ae351879b", "value": "T17EB313BCACEB4083F191683BD446B83A5C716EE98F55AC61B241C385DDEB4D6C4F28C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675146216, "uuid": "4a2f9100-c82f-4933-8ec9-beb7ed6f68d7", "value": "3072:3IFcx454zN5jEgnu5D94qZqIW6LhD39fDjdCTgq0Lsu/:Mcx45q5jEgn4D94qIIW6L93hDBCTgfLH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675146216, "uuid": "661abe9e-6dcc-45cd-b1d9-cff103cff296", "value": 114496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675146216, "uuid": "bc10a480-83e0-4d8c-b255-7f10858b9678", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675146216, "uuid": "0d1e8fee-0851-4839-a3d9-77eef10510e9", "value": "230130-w6rp4abe89_pw_infected.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0ab9db-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140639, "uuid": "e9f46e21-792c-4827-af27-37921d4797d6", "comment": "Malware payload", "value": "6e2ff8046e5fc76d9a97630147d82bec", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140639, "uuid": "b4672820-7286-465e-9801-f6409da8c884", "comment": "Malware payload", "value": "a96c1790a836799583a85429e0e25163cb8f1b6634d5545cbbebdb10a235d1d4", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140639, "uuid": "e5ef1161-e562-45f6-97cb-b26a57ab3f79", "comment": "Malware payload", "value": "9fceb90714cbe975042f4326ede5626e55419642", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140639, "uuid": "e74c496e-b296-4cef-847a-34f304072166", "comment": "Malware payload", "value": "94306f00ad428ef96e6190f307c030996a622c0f2e1ad9eafe5dd99e99233a05bd82e66cda1f26ecb726cff44b78080b", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140639, "uuid": "240d68bd-d434-403c-93dc-53c086ea12e2", "value": "T169363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140639, "uuid": "14f23c74-4bb7-4b8f-96f6-6c905f67a6f0", "value": "98304:9v4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXg:9vpvFa+g8RWLdPk/84tCEr0RtNiC5eSJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140639, "uuid": "1051271e-6221-41eb-a7ee-859070411482", "value": 4992512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140639, "uuid": "52fc4ecd-6845-4659-8ecc-880ea2ed7c65", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140639, "uuid": "ebef96c2-dc0c-4e74-aa03-e416b07ad9f8", "value": "a96c1790a836799583a85429e0e25163cb8f1b6634d5545cbbebdb10a235d1d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d1ce102-a178-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675177250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177250, "uuid": "3a9054f7-c90a-4250-acd1-b411d50c6857", "comment": "Malware payload (RedLineStealer)", "value": "05bba7515ce6c110bd618af7ca702975", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177250, "uuid": "56dd6394-ca28-42f7-94b2-e6126b7f4772", "comment": "Malware payload (RedLineStealer)", "value": "a9c35a6deca60c452e067faea1b55f5e16d934d1f90c361008bd66fe7a2354cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177250, "uuid": "dfbf2339-4b55-48ea-b2ee-bc1b9ad97dee", "comment": "Malware payload (RedLineStealer)", "value": "21c42c8bd292a9bbb6c50c5657fbd758cdf6e563", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177250, "uuid": "3dc813d9-0f3d-4808-b461-0e7cc2ddbc78", "comment": "Malware payload (RedLineStealer)", "value": "b89a2bbed627238169f71212197fcf03158288c7f31f3ec9d0463da08191e02a6c383cc944e1f9aec854b9aca1938871", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177250, "uuid": "e01e10f5-2db4-4174-a459-e57a734535d6", "value": "T1D184BFC662F67C62E9218B31DE3EC6F4766EB5524E187366220B9BDF15B01F1C6A3340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177250, "uuid": "ff965540-6bdb-4f3f-875e-b35610da6c24", "value": "e73db8d7bd9f9f6b2076d026a8fb8fc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177250, "uuid": "cfea8f68-dda7-4a6a-81e8-3e786f10feed", "value": "6144:q2cqLk/TODmO9EKVIjJtqjEYcq2KQzosOP2m7XuhhbPTPNmqMoIqN58MK:NVwCV9wFtqBNIwPEjbPDgqMK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675177250, "uuid": "d4176a92-c3ef-4509-b486-c4359fa583f6", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675177250, "uuid": "73cb939f-7df7-4a25-ad3e-383ae70a4f9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177250, "uuid": "55d51811-09d1-4646-8f7b-c891254e2785", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "becc4070-a150-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675160368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160368, "uuid": "d97b51de-f455-414c-9698-1eb2a61248f4", "comment": "Malware payload (AgentTesla)", "value": "b28805a91c77bd56fb47307477c522f8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160368, "uuid": "56b82f93-0d6a-4740-af31-0d806accd693", "comment": "Malware payload (AgentTesla)", "value": "aa4046ab8b9a2566c1a35d827ed97ce8f15e0254727d270807505f47d53aaeff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160368, "uuid": "289ee286-c69d-4429-9167-bf8d963ad262", "comment": "Malware payload (AgentTesla)", "value": "2fffb9e3cef7f3b779884b4d690137c10b266b56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160368, "uuid": "eda5442b-8788-47a5-8a3d-732ec15b2fec", "comment": "Malware payload (AgentTesla)", "value": "fad925b03fe0e0eed917a1e027322965f0b77a01587f875f50be9640b0f5c2e470778e3fe704f4ff97bffc1d13a17d6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160368, "uuid": "a1ec689b-f562-4937-b750-fae4d55475e9", "value": "T19EF2095877ECD733EFEE53BC58B425824BB2A937A601E7082DCCA8E955923C74650723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160368, "uuid": "388f3ce9-c2f6-4633-a189-28d2cd2dce97", "value": "384:kOhNuCCfNNrQKvPWXwEwZhI6hlhxggKWJUw34KljAAlGOBN3z7E7H96vEPnKvFU8:kOWNrrWXnohVxKWaihMbKW+k2RH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675160368, "uuid": "c3c46992-aa35-4fea-b672-41af18b3fc2e", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675160368, "uuid": "2d374d85-03a7-496a-a3b6-af65a2c080dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160368, "uuid": "acbf844b-75f0-4081-b785-73d38ee8951e", "value": "URGENT REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2ffd0e8-a153-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675161664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161664, "uuid": "b4d3e9fb-8d04-4c97-9456-5e44453736d4", "comment": "Malware payload (Mirai)", "value": "3b828ca5d3648dc5c07f5cfb2a796f75", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161664, "uuid": "2259c8b5-7fd8-4bde-be8a-e0df50a66d2c", "comment": "Malware payload (Mirai)", "value": "aa6ae0cc348c2c269380e9e06b309d84e247176dcdd8f27bd0172b19d1068e36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161664, "uuid": "dda94f83-a0e6-47e4-a6ed-1039a9eeae18", "comment": "Malware payload (Mirai)", "value": "3a2986a819a11432ddae8e7fe296af1d73320e13", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161664, "uuid": "05bcedac-9426-4799-90a3-0d99ae82d17e", "comment": "Malware payload (Mirai)", "value": "acc5cfb9d5ce5cb0a8091e85b8ec45411b3d2493cf520d6baba618ce5009ac51c1957d7ca520b125a4f4394ae2e60425", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161664, "uuid": "e809ee2e-cba3-4e29-81f9-eae17c2468a6", "value": "T120732901F7090843C2631AB4253B17D5D3E6BD9120E8F68A7649AB4ECA72D33E54BDCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161664, "uuid": "c5ee05e5-d12c-40e8-85fb-23a7edf20292", "value": "1536:1d/5F/MB/ETcCxond7DcVPiDE1jeha3jadhmv18I3+axurbr9a:1d/5y2dmNXDI6hsv18IPur/9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675161664, "uuid": "11223ef9-44ca-4b8a-b441-13eec7a63c72", "value": 75432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675161664, "uuid": "00a8d438-3465-4c0a-b1fb-c6541eaa39dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161664, "uuid": "98817407-b877-4172-89c8-474513a65c77", "value": "3b828ca5d3648dc5c07f5cfb2a796f75", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e262ece1-a1c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675208532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208532, "uuid": "ca80b843-3494-4354-9085-d3a68dc253af", "comment": "Malware payload", "value": "1201deb725d512a6c0e2b70799115be5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208532, "uuid": "451a0a40-385d-4ce8-a3a9-072ee734970d", "comment": "Malware payload", "value": "aab8df87a73b764c730a21d70e8f689a3c8fa1c760eaccd482e5fc4132798ac5", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208532, "uuid": "eba274cf-ddb9-4ded-93ad-2cafc0b92e3f", "comment": "Malware payload", "value": "2b4e3a273d568550e45aadec125b980d8eeff3bf", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208532, "uuid": "52cee818-3ad9-4c2b-a55e-c01ac65c35b7", "comment": "Malware payload", "value": "44bfe4f269d86223e3a13faeb0c481fc423194a64d4a76722f7a65d20f3f577cf1156bea85b09b438e2c05356cdb6dc1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675208532, "uuid": "4a5aea70-1cb9-46bd-8b0b-fcc43ac39ddb", "value": "T1652302389BA16726E213AFF408BB426279208C5591AB9404D970F386F479EFF6770E58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675208532, "uuid": "f9c7b418-9d33-4a37-8bd2-25f114e9a4b0", "value": "768:R30a8E0uM/PNyqUpQnyqufd79Lq3BmOpNJa1e7yCo40tzgI3UP6F2mbjDov10nkv:RkaTfQXsfWBbpNJaU2C46t6FbC10nkIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675208532, "uuid": "57e45cbe-e674-4712-8cc2-071f4356b320", "value": 47404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675208532, "uuid": "b9ab46ea-2219-4b5e-8e76-1ec946641c80", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675208532, "uuid": "2613afaa-87da-484f-9185-934cc5381c22", "value": "fc83217e920d36d6b322812d129919b67c7d241a7c77111ddf24d49b4c1b8cec.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28867ce-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140645, "uuid": "9b35771d-761e-4c8b-964d-04cc37c52f44", "comment": "Malware payload", "value": "1864daba8e2bc3d17e4b7c4d0eb13e60", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140645, "uuid": "1da433ba-2277-428f-b08a-b41eec3d13b7", "comment": "Malware payload", "value": "ab34ccadba65436073c0dcc52f5f615fc2f2f9e83d766073141223f0d09317c1", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140645, "uuid": "89a4b3db-b9ca-4eca-9939-bfdb471c6fa5", "comment": "Malware payload", "value": "2f7ceb2fdc8c7db9a71566028de6628aab15ea4b", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140645, "uuid": "28747bd0-a1ca-4853-a358-94ac780ed8ef", "comment": "Malware payload", "value": "3f7d971677018d679c7e05bf79317590f83e2bae5d046ac34fb0ee104c028db5dace3f3790b689dfe18c6280633e4637", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140645, "uuid": "49c77246-d6a7-4577-9e43-089c5ea9c9f3", "value": "T128363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140645, "uuid": "a149674f-c3cc-4baf-9265-6fd6f9757c02", "value": "98304:Bv4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXH:BvpvFa+g8RWLdPk/84tCEr0RtNiC5eSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140645, "uuid": "5670d760-92bd-46ed-9e46-a8c5a597094b", "value": 4993024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140645, "uuid": "af45ea40-e284-48e2-aef7-e3f222deaf08", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140645, "uuid": "6cb76096-daba-4b34-80ec-063e2a1b4ec0", "value": "ab34ccadba65436073c0dcc52f5f615fc2f2f9e83d766073141223f0d09317c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac6c73ff-a160-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675167210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675167210, "uuid": "ca62b98a-eabf-4391-923f-8c5a864ebc52", "comment": "Malware payload (RecordBreaker)", "value": "465334c2b23d57f4db274488dd9f279b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675167210, "uuid": "a73814fd-b625-4b7a-a9ad-67f8e1a75da8", "comment": "Malware payload (RecordBreaker)", "value": "ab6514aa27db11b62a1926a12c5e0b464a42689b6e1c45b8760ca55b04f0bf16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675167210, "uuid": "81bb6c07-5314-430d-b12e-e178f4de8514", "comment": "Malware payload (RecordBreaker)", "value": "42983b3bf96d8fb4c8e1a2706cf89e55e66a6a16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675167210, "uuid": "b851bf57-62dd-453c-8fbb-81ed04b79ea6", "comment": "Malware payload (RecordBreaker)", "value": "abb030fd80a759b4999a8c935a676332c532e3269712f6ff44c80a0e00a2c397f907ae5a4f6e0bbe439023fefc38eddd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675167210, "uuid": "c2f36ace-0543-435d-8062-028157611000", "value": "T141F635DC72A0B2EFC857D4729EA81DA8EB60747B831F5203902715AD9E4D997CF580F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675167210, "uuid": "be6de8a3-2009-4545-8b1f-fd0c1ecffcef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675167210, "uuid": "934f3585-7c69-474f-b6da-c76ca6ac6af9", "value": "98304:SIAzUE2bRCunvAdP4lLBYHHm/+MJXzdG7cLwE0xYhrRx4S/HzL71hY:SIKU4uodQjAUJxG7c0EIYJ/4S/TL70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675167210, "uuid": "3682e647-2c45-4bee-a00e-ade41b65be6e", "value": 15764992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675167210, "uuid": "7110f7bc-f31f-4282-a18b-416b3985b723", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675167210, "uuid": "9c27a7c1-e991-488d-a896-abc632c16a32", "value": "setupsoftapp19.0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5927720-a176-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675176754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176754, "uuid": "398774cb-2e90-4274-a94a-29855ac305e5", "comment": "Malware payload (RecordBreaker)", "value": "230d9421f84f0be0a8bbe86bd03e9629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176754, "uuid": "ecfc6f7f-1eb7-4ed4-8650-de07adffae39", "comment": "Malware payload (RecordBreaker)", "value": "aba176220478b64db54ec6caf7cc46df9703c32e94273aa0368fbe65ce6f5aa6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176754, "uuid": "5bb48182-3889-4332-90a8-d35f3de7d140", "comment": "Malware payload (RecordBreaker)", "value": "8e04318e54e37e23625a608daf39fe058c02690d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176754, "uuid": "71017518-effe-4be1-9071-4371ff0d5487", "comment": "Malware payload (RecordBreaker)", "value": "9a4ad3339837aa2b132b165a724c1db7a4a5bb5d4ac849752dd29d287c3c3e7c27856831a59edaebdb00a35f6531f39b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176754, "uuid": "2ce9fdf7-c8ce-43e5-a1a4-49c6e9f00280", "value": "T1C0548E02B6D27C41FD628A76CE1EC6E4F51EB5D2CE18B76623189A1F25B31B7C762301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176754, "uuid": "63c8c096-a1d1-4f15-a2cd-b3b59b2f2f71", "value": "a2c8bd590ac12702f85d4107db46f8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176754, "uuid": "e92749b5-066c-427f-9932-1c6d0232cd01", "value": "3072:Y6uIHYbCLpB7R4WQh57U+RUySs3nci7iEOp8c0ADHS7f43H7BFhiAIBRCDR1:sOYbCLpAWQjzRjb3ceku6S7f4VRIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675176754, "uuid": "9d709783-b027-4389-ac49-e806be73f68b", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675176754, "uuid": "f17b59fa-5950-4544-a3dc-5c87c486904d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176754, "uuid": "46989c61-4e7c-4d6d-b0b6-62568c43de21", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99868081-a100-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675125946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675125946, "uuid": "6cc2f726-4f2b-47bd-859c-826a60d66395", "comment": "Malware payload (Smoke Loader)", "value": "31c432c2544671672cc19f4330b1f548", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675125946, "uuid": "e68b96de-9110-4e82-85c4-38c48dc885c0", "comment": "Malware payload (Smoke Loader)", "value": "ad823c3fe333416ad08d432f923dbeca80942f67a9c8d70c7155964519bbe7ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675125946, "uuid": "2e0ce18d-5aa7-468f-b0b9-701dea4442ff", "comment": "Malware payload (Smoke Loader)", "value": "f01cabd3ddd1a6822f5cb161e5f3da4fb7cb690f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675125946, "uuid": "ba05d77e-1eba-4bfc-9a84-ddd870c7a506", "comment": "Malware payload (Smoke Loader)", "value": "a5988d4140a66800428d8fee6a156b25514728fcfb654dc672f90571dbf568423989641bb85f96c325a30168b5ecf12b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675125946, "uuid": "9b93fd66-56b4-4489-beb3-8bf2d78729cb", "value": "T15CF3E0157990D033C04917B15978D298AB3EBA320EF69C0BB74917EE5F722D2663E327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675125946, "uuid": "21d1759f-f882-4afb-89c9-3af1e4d48f25", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675125946, "uuid": "f0c9071c-be82-465c-91d4-daa28bd682a8", "value": "3072:8j1XEzLFpipvsZG5j1GKIhBu9cxa56NgfWTN:dLFpipUZYIOcomg+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675125946, "uuid": "f71b7aa2-2455-4ea1-952c-9e50220e0139", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675125946, "uuid": "e9be38a4-e0ba-4073-ae8d-819863247bc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675125946, "uuid": "4c2b6ec8-9fc3-4b3b-b75a-c56a3e865642", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19e51a32-a15f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675166534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166534, "uuid": "1d390d89-265a-4072-9da2-0512df7a5a2e", "comment": "Malware payload (AgentTesla)", "value": "ef6918b487facdd63bba6fa5d8850919", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166534, "uuid": "25030b81-a9f6-4db2-86e0-901e39389956", "comment": "Malware payload (AgentTesla)", "value": "ad91d9c25c37a161fe7634058d8b18347f0aaf97e26e3596f745dcadc47c906a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166534, "uuid": "b27bc6f3-1238-4c4e-b140-e39f4f24339c", "comment": "Malware payload (AgentTesla)", "value": "6d00761248bed857b4308342e961051a0c0d1729", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166534, "uuid": "5e073dcd-d049-4ba7-8f8d-9eb8d095c585", "comment": "Malware payload (AgentTesla)", "value": "0436012e5bb3e07f793e4ea5654d00b5e92716c081130b0ea552409bb067e6cae80a63629717a2ce316e8586630e1a0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166534, "uuid": "ce6ab8c1-6e39-4f4d-9d37-c26b7923e476", "value": "T1ACC4231129F867BEC23E03BDB676B83147359B951603DF44AFC454ED2A6BB0A1A20773", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166534, "uuid": "4f6423f5-0d18-4793-aff1-56227f275eb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166534, "uuid": "26fa78f2-8f68-43a7-8661-3479cc3c30dc", "value": "12288:fr80FsGpHwMJe8TFGMI7rQV+xTV4gYv5klA9i7+pvfCWtO:fr8MlpHw0e3brRxm9BJw6RKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675166534, "uuid": "55262832-69d8-49e6-8b25-d0681cb6d940", "value": 556032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675166534, "uuid": "e6fba433-3175-44ba-9766-eb348f4c3fc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166534, "uuid": "8408fe0e-eb4d-4bc7-89c3-c841e82689bc", "value": "ttref01312023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab8179e0-a19b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675192548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675192548, "uuid": "c2f53a77-8af2-4394-a75b-53f1bfb66a48", "comment": "Malware payload", "value": "03fa72928fb008fe0e172be94d039909", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675192548, "uuid": "184c452d-02e7-4a28-859a-a34469ecb8ac", "comment": "Malware payload", "value": "af031d18049e0b9604fd678c6c39cb4ac3b822c5ee5d04a7d391b1f9b96e7ef5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675192548, "uuid": "09760c17-cc02-4bd8-ae84-535ef4d2ee87", "comment": "Malware payload", "value": "fb569a868b6ee84467a8c72c558d62d12a4a9158", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675192548, "uuid": "58562638-adfc-4d1f-b49f-522836df2687", "comment": "Malware payload", "value": "21f8a06f6b30dc0bcf5f14049793dd088eda8c10f546b4fec23092065ebf6c3d6740fbaf24d473c18a9a9ec6b1a73e1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675192548, "uuid": "fdbfb838-7163-4aec-936c-a4c616455475", "value": "T1E6A53343A9E651B7F0BBC634090512136B733E29083A5156B8BD778F3E3B3D9697B098", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675192548, "uuid": "8328796c-1499-4617-9b36-5161a9b37b49", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675192548, "uuid": "b10b7e6d-1c9e-463c-9bdb-0a53214729b5", "value": "49152:C2rKcT/hogNJzhcG8G+585tv+zkZ7GtoP1PnSj14z+3Ft9Hi0jLCgv2MR:drv+C5tv+AZ7h1PSj1rt9HBv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675192548, "uuid": "8ceaa534-97fa-4d2f-a580-baf948bb8ec1", "value": 2203420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675192548, "uuid": "b18f4d4a-e13e-4315-9760-d87942e25b16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675192548, "uuid": "5d01183c-65ba-42d3-bc8b-0c3a1e959ad5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26d68390-a178-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675177293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177293, "uuid": "99d7c198-135e-4b78-bd1b-8561ac2a328e", "comment": "Malware payload (GCleaner)", "value": "98b171e6aca14843de76775002c9fd34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177293, "uuid": "d36398f5-07f5-4ae9-a0c3-9fe59ec50dcd", "comment": "Malware payload (GCleaner)", "value": "afbbdba3263528f0cfb229363e43b49a60e600986fadcb3d8be72eb9e28973a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177293, "uuid": "505489e7-0994-451c-8bcb-686fd6d569e3", "comment": "Malware payload (GCleaner)", "value": "93bf74baf2e06c8d6b65021bd7c35aeecdce651b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177293, "uuid": "e71a71d2-febe-48d9-976c-df21cb137291", "comment": "Malware payload (GCleaner)", "value": "bce025b4d9cbac58f314f0f453ae77c2d3f99426adf97792852faf051c20d256da324f2d69648487f1f45c34a54ef471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177293, "uuid": "9a084bb9-72f4-4865-a060-1f33fd018ba3", "value": "T190A53343A46AD472F2A2D3784E5619B66F71BE7A38318004318D76BB3A3B7B0170537B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177293, "uuid": "0dab3b8d-a1d4-4bf6-a72a-da710699ddff", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177293, "uuid": "f13fc811-08ce-4fbe-8cb9-d8e82f035074", "value": "49152:C2jSfN2MMr3t3zBwnegMFVKgKUxZ6JoIiBcLCgv2MR:djSfNrMTt31SMF9KSUetBcv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675177293, "uuid": "151a09c6-65bf-4fb8-a243-9e03c41a43f6", "value": 2196108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675177293, "uuid": "1efd16fd-3f5b-4a54-9afc-199a7c28b1e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177293, "uuid": "2aa7d9c7-7c46-45c0-a791-71eb927a7022", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dd1abfb-a141-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675153629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153629, "uuid": "e19bb445-3e71-4349-999f-ca60f554c926", "comment": "Malware payload (AgentTesla)", "value": "bd9177cc4451c7614dc5ad3d793aa71f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153629, "uuid": "8cd22153-1339-47c0-9889-1381cdb27c2b", "comment": "Malware payload (AgentTesla)", "value": "b1df719e729c278931dd9c1012e4a6906f90364053ea25770712444ec21535ce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153629, "uuid": "a753b56f-6742-4020-83f3-fef5dec4997b", "comment": "Malware payload (AgentTesla)", "value": "1331882491ec58f3d324a64d245a487b396587d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153629, "uuid": "669902af-8ee7-4146-8755-6a4e044156f4", "comment": "Malware payload (AgentTesla)", "value": "5aa8cbac6daf5f7ed67c2a3142a212244056bb2921481a4dbe27121e392e6be5762b0e9e7c448bac117c172ab9837fdd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153629, "uuid": "bc9b557e-6e52-43d2-99ac-5dd6a97efeb7", "value": "T108F4D33D99761ED2C23AF9B1C6E1C420B2AC81C23313CB5DDBD61AD84F056926EEE55C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153629, "uuid": "32890642-c089-4ebe-9d5d-f23c25fe703a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153629, "uuid": "db75e3ab-6b05-45cf-9f92-2deeb26d744c", "value": "12288:yS4FR40+w0DtzsROLdrClNDndaIuxAe/CE1OOGOO/OOJQ2R3BDULjR/P3Y/UOHJG:zhzsYxcNDndNuxAe/CEqv03wJfPKIiWO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675153629, "uuid": "e57a2638-8f07-49da-a783-73e0b1e06271", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675153629, "uuid": "10416295-7754-49df-8c43-26d869ec6a9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153629, "uuid": "ded786cf-bf8b-415e-8c17-42e05fbbe4ca", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b607b1f-a16b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675171771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675171771, "uuid": "18300fb5-2ff1-4834-ba28-53183acb8e0f", "comment": "Malware payload (Formbook)", "value": "512fcd3048ecc3311759e82e00c9888d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675171771, "uuid": "e183a51e-2286-4a6a-a47d-02e90e9d605d", "comment": "Malware payload (Formbook)", "value": "b220568343b62f6a4bb4abc001ddfd4a00b66c9debe0542c55f6f2a91cd832bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675171771, "uuid": "7c71fefd-f463-4ae8-b27f-5390329b5f1d", "comment": "Malware payload (Formbook)", "value": "be45965664140ed3a03236605f4b8c9ed7bfcc47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675171771, "uuid": "03e0dc40-ea17-4276-928e-3d9ca62a39b4", "comment": "Malware payload (Formbook)", "value": "94fec2a88a7b38aec7299e9b6fa2f60a6d3002af0656a3aa5cd3d5c8a0f071e0a1b56fdca4d0ce36bded73c8a822a308", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675171771, "uuid": "fceb9748-1add-425e-bd06-7a4d371134c1", "value": "T13044129433B0C4BBEED127345ABEC3EB4AD9F51905A8871B1B019F0C7E71950990EBE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675171771, "uuid": "da373c98-073a-43fb-8593-90af4280f000", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675171771, "uuid": "5caa29ad-7fb4-46ee-9f2c-726942141234", "value": "6144:/Ya6Wa8RQeZcz5jHeU1NNWGYugdRUPmzDq9I+H:/YoaKcz5HeeNcGFgdRUGm95H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675171771, "uuid": "45ee1309-f7f5-435f-9282-9e54a9cabac6", "value": 268310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675171771, "uuid": "7e0063f1-3169-45e3-8d93-a4f7c3a5578c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675171771, "uuid": "333dc07c-56d5-4ac5-a3eb-94420475aa5b", "value": "512fcd3048ecc3311759e82e00c9888d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd16c06-a162-11ed-88f6-42010a9c006e", "comment": "Malware payload (VectorStealer)", "timestamp": 1675167859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675167859, "uuid": "4cf3b607-c5ee-4d76-a6ea-f01796a78958", "comment": "Malware payload (VectorStealer)", "value": "a82a2ac85720c6a44708cdbb2a34aff6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675167859, "uuid": "dd028093-5335-414c-a8f1-e49640081c21", "comment": "Malware payload (VectorStealer)", "value": "b2b2fdc1fa30fe44d242eff9a393efcc4ed15ed61a36efb33f7e06812065c9d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675167859, "uuid": "58dbe3e8-bf05-4ee3-bb17-02344159aeed", "comment": "Malware payload (VectorStealer)", "value": "2d70c71305695796c54bd7196d29cd14c0e1b8dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675167859, "uuid": "d63aa724-555f-4847-a7a5-bfb7b72ea425", "comment": "Malware payload (VectorStealer)", "value": "8eb99c5d5b3c6985f3b6638fa8eb1a8de6faa68ce77fdaf3808fcc10122bc82dc7776c9e2dedba48e1944dfcb21a4a26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675167859, "uuid": "9018da12-d2e1-46fb-80c8-dbd11d542ac8", "value": "T19105014823983AAECBBEC679FCBC6D24D734A47B0543E367658350F62ED52829E011D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675167859, "uuid": "0a469ba4-a3c9-41bd-b079-42a633b55c5a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675167859, "uuid": "08730cb3-53f1-44fe-828f-c5b00e051354", "value": "24576:wm+Rz6OuN6nLSgg/vW1FeUXDOH3SIGIz:wmsuN8fKvVH3SI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675167859, "uuid": "34d1749c-6380-4633-983e-80e864e8d3a5", "value": 842240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675167859, "uuid": "0e644ebe-8298-462d-a89e-2c9789e89687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675167859, "uuid": "91e25fee-b822-4a80-9d5c-febf379de2b0", "value": "PURCHASE ORDER NO. 0028175.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15213ca-a12a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675144025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144025, "uuid": "520fe814-701c-498d-8980-d6928ea8a9a6", "comment": "Malware payload (Mirai)", "value": "5e4be23aa6803b44bc8fd1e74daf5783", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144025, "uuid": "c6253e91-a958-4429-a965-0fe3d01aee03", "comment": "Malware payload (Mirai)", "value": "b2be3c40a62da999078aa2eb8c6c60e180fe82e790c634f82e158335c1bfb6a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144025, "uuid": "8f778b70-2626-4e28-a5ad-22b3bba0b0d1", "comment": "Malware payload (Mirai)", "value": "eac89680be13792b9005b14b79849b4ac36c44d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144025, "uuid": "4ee5e57b-c3e9-4767-89dc-d65a37d10ed3", "comment": "Malware payload (Mirai)", "value": "be5807a1d87a2358477d19d7df19444ff19e7fc817b7609effce5d0cc3a3d1ab324d55fbcae936951b93824b92fe9fbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144025, "uuid": "9fc6a4a9-a7c4-4677-a5be-e5a9e21a6b91", "value": "T10173A80E6E618FBCFB5A823487B78E20A65833D627E1D541E15DEA111EB034E741FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144025, "uuid": "f4b7f978-7601-4bf0-987c-458e8b228d96", "value": "1536:YZIJO4rSB6x0qzEITCRIxuF9IJajZvGIyv:LPOBtqzE+xxuF9IgNvde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675144025, "uuid": "cd4c0e20-17bc-4974-9248-e7f5a4cb8f32", "value": 76612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675144025, "uuid": "dd05d357-ad64-4b1d-b67c-a88cf480e545", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144025, "uuid": "19554071-de5d-4a98-a935-3dff23741514", "value": "5e4be23aa6803b44bc8fd1e74daf5783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e8b8bb-a149-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675157354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157354, "uuid": "8e5efbc5-4165-4f3a-9da3-127cfab30533", "comment": "Malware payload (Formbook)", "value": "dc61611fc32d4cf284569fac59a6df05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157354, "uuid": "a62adf5d-d3f3-4af9-abff-e03b30be930a", "comment": "Malware payload (Formbook)", "value": "b2edb64ef798a43a9135ba4d0fea509e72e7d640bcc7e64cfe6b6203a4b1d837", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157354, "uuid": "269d2baa-2ad4-4ca0-af4f-37c78e590384", "comment": "Malware payload (Formbook)", "value": "8afccd28dd1c2b7395de393bd8eecaa62155477c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157354, "uuid": "4dd24478-eb6c-473c-808d-b12c2dd37fc3", "comment": "Malware payload (Formbook)", "value": "b2f4f97cd3070d35a6b3f4de61d269138acc6a575119e573bee430548e9aadaf4d5b0a555e6120c8cb0b7a062a3cefc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157354, "uuid": "a3d9a4f7-12c2-47b7-9f83-3ab1eaf2dda2", "value": "T15B5402086186C167D4E206F189342A7F66E5EE12A4B5D7172372BF087D77B01DA0B7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157354, "uuid": "da04da7d-bfd6-4ac4-b8d3-3fc74c224ce6", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157354, "uuid": "3c6b786a-f154-4b60-91fa-7c22d287ef38", "value": "6144:3Ya6TgoxfclokC7mu8QzFbwHSZBjzDGH6tLJfU2gIB7vZpf+bP:3Y2oxfKt9u86tzDGG+27TZpgP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675157354, "uuid": "50957344-5ff1-4a9a-b755-8cd2f334fa7d", "value": 305850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675157354, "uuid": "9b35a130-b7aa-4921-abcd-4938c17ee687", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157354, "uuid": "9b634aab-949e-4893-bbbb-cd7858937a7b", "value": "SHIPPI~0.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bedeb76-a149-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675157116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157116, "uuid": "295829f6-5622-408e-a437-57f689e8cee7", "comment": "Malware payload (Smoke Loader)", "value": "1856081465c1086a731d416c16902ae9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157116, "uuid": "dd83a7b7-d6a5-45f2-8aee-9eae7dc231b4", "comment": "Malware payload (Smoke Loader)", "value": "b334f9faf13bb7a096dddd11e6f2a1ba5a93b915aada857c59820829901eea81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157116, "uuid": "e5dded97-ca7f-4162-a48c-d9faf5b015b6", "comment": "Malware payload (Smoke Loader)", "value": "bfb890e7cfb7b7f7394cf51ae1514f27d9ce2bef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157116, "uuid": "04215b31-de9c-4760-8959-8d03c398ddbe", "comment": "Malware payload (Smoke Loader)", "value": "1fc92bd9726b2db72c6f989794b41392c3353449a48fe3ebd763991f37e46d9a701184d7bca00491307c52825f9c516b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157116, "uuid": "a5dd21ea-083b-46a4-bee8-46c45d267b3d", "value": "T1B6547E02F2D1BC40F56646758E1EC6E4F59EB5D2CE18B7652318AB1F29B31A3CB63312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157116, "uuid": "c3e53611-e63e-4af1-8a76-4226150e28fc", "value": "a2c8bd590ac12702f85d4107db46f8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157116, "uuid": "09f59170-5aac-4f89-9353-3c3daa2a1f0d", "value": "3072:7uDuAFelOLJb7R4BcehCPJPx0NWGljvSybGB7f43H7BFsAkRCDF1:yCkeOLJ+vhCZxMWKjHiB7f4VJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675157116, "uuid": "3a05f2e4-dbc4-44eb-a560-2b2f36f65d73", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675157116, "uuid": "3d931b30-5c22-49e0-a05c-f40cec32d8d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157116, "uuid": "0cf71269-8151-4353-93c1-cfe68ed325e2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "889470cc-a169-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675171015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675171015, "uuid": "38efbb48-b3b0-4406-9972-475bd31e043f", "comment": "Malware payload (GCleaner)", "value": "e83c45d33d687230980c9d328e9425e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675171015, "uuid": "b3b129b9-5197-4394-9c45-e23edfd95b72", "comment": "Malware payload (GCleaner)", "value": "b39cd21a264dada1d118f7c429f2609fb37f4d52e47cf87bc157d17c5164b24c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675171015, "uuid": "e7da2b3a-1ce5-43a8-9547-6503bea0db70", "comment": "Malware payload (GCleaner)", "value": "5bcf597ff3031680ba189b364e3735c5f8a77532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675171015, "uuid": "d48fe042-7e09-46d3-b480-99f189ee1156", "comment": "Malware payload (GCleaner)", "value": "397550c527f76856270fb6e86d3297c67dd815caa9fff54362196cd0c3d3ee793cd1bd87107600fc2d9fcbc01adc82b8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675171015, "uuid": "0918394b-1cec-47a9-b127-c2777a8b6d57", "value": "T142A53342E33A8677C2A20F716C315765EFA72F5BB4A88145785D264E3F737E22D08A34", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675171015, "uuid": "6e766030-f4ab-4443-98bf-bb3e44d9f5fa", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675171015, "uuid": "d256c0c4-e1a9-4661-9a39-c234b63ec657", "value": "49152:C2htuWOe0rID4rJ0+BIZGXutgDNqlr+DEnJgBfOGLCgv2MR:dUjrw0xBNW+QEO2v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675171015, "uuid": "24cfbff8-2b94-411c-83d3-96c2767a6642", "value": 2161070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675171015, "uuid": "fa6f5e16-4c1f-445e-a29d-106d7c40c31f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675171015, "uuid": "0dfb1854-8506-4ce5-8e72-2e20f0e65b08", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371ca5a2-a131-11ed-88f6-42010a9c006e", "comment": "Malware payload (LockBit)", "timestamp": 1675146826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675146826, "uuid": "58719573-0cf5-4bc7-b7c6-833c8364c15f", "comment": "Malware payload (LockBit)", "value": "37355f4fd63e7abd89bdc841ed98229f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675146826, "uuid": "ad4e4687-ca3e-49cb-a290-20ca5c9201c3", "comment": "Malware payload (LockBit)", "value": "b3ea0f4f442da3106c0d4f97cf20e244b84d719232ca90b3b7fc6e59e37e1ca1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675146826, "uuid": "0d2c7ef3-d20b-4a81-add3-d24668429952", "comment": "Malware payload (LockBit)", "value": "a8d46a042e6095d7671dbac2aeff74c7bb5e792a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675146826, "uuid": "bb6cd62d-182b-46f1-b040-aec3f70674f6", "comment": "Malware payload (LockBit)", "value": "310697651069b921c5cdff1d6aed346f57696fb869bbe5005561227c7bce0423162f0990622153bee9572a6012f4c859", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675146826, "uuid": "06f5733e-9356-47fb-a6bb-b9344d6f2adb", "value": "T17C342A00B95FCBAAD58303BC4953A602FEF7369067248EE793844A701D0B6D676BDF91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675146826, "uuid": "57ac1f8f-bbce-416d-9849-8376640987d4", "value": "6c7dcad9de2389724268ab9b2efad94a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675146826, "uuid": "41e8974c-601a-44c0-875a-021f5b4dc9ee", "value": "3072:s4WFqwI3hbcVWJO5trDcEZn7YhX7wB0SZk5MVMvs4tL7wUQk3lFjMXV:B5MMCtroEVYB7wqMVMIGA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675146826, "uuid": "d49d25c2-4c7c-4722-ab34-f48c9fd04ebf", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675146826, "uuid": "c90dbcc5-89ca-41ab-aefe-90c9aeb56ee2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675146826, "uuid": "eb6b00b9-95b5-4572-ad10-0194c921a632", "value": "b3ea0f4f442da3106c0d4f97cf20e244b84d719232ca90b3b7fc6e59e37e1ca1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f9300b6-a190-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675187723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675187723, "uuid": "4452e5eb-f9cb-4de4-91b7-613c06d5c2f9", "comment": "Malware payload", "value": "502682c47631413b0c02e8f71dcd4f54", "object_relation": "md5", "Tag": [ { "name": "obama234", "colour": "#59AA11", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675187723, "uuid": "1d3fd9ab-2225-4f4e-97eb-477759d0d835", "comment": "Malware payload", "value": "b45ace5a35914dcd4beb7486f3ddad4bbd84be245d403b9e6a3f1b907aa4ae03", "object_relation": "sha256", "Tag": [ { "name": "obama234", "colour": "#59AA11", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675187723, "uuid": "b539908a-f78c-44e0-a36e-14870f260b1f", "comment": "Malware payload", "value": "f0d9dfba9d954fbfd212d96f6c4fa88ce4efc3fa", "object_relation": "sha1", "Tag": [ { "name": "obama234", "colour": "#59AA11", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675187723, "uuid": "aaff761b-227d-446e-bec2-2d6d70c57728", "comment": "Malware payload", "value": "0824ea874516b15e3ec4b5d4002cab917fb4a504880883778ef1128fec34f933b40c75b7e83837b240b3a567ee2ba32e", "object_relation": "sha3-384", "Tag": [ { "name": "obama234", "colour": "#59AA11", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675187723, "uuid": "bb1b1acc-b808-4682-a9df-b774fe8f1297", "value": "T17A04D013BA9F8D15DAAE51B04AB26F9BB7616D33F3E29327977131DCAD12280C84105F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675187723, "uuid": "3acde8e0-2ca0-48dc-a80d-66b22a453844", "value": "3072:R1lg8QPXTRA2P/7dq+Jj29Ua2+jYFisa6ILWtmJkQD4:eJtA2PRNJShnjhLWtml4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675187723, "uuid": "529eef9c-66a6-43ea-9170-3eaec8153e36", "value": 185680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675187723, "uuid": "c49ab05f-6c11-4b6d-855a-ef18f2be3c78", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675187723, "uuid": "97835e85-058c-48a5-8c0e-bb3923d57afd", "value": "ApplicationReject_49333(Jan31).one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78f395b-a192-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675188810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188810, "uuid": "19cf4c12-ac2d-40c9-bdbd-d0fc79ff0905", "comment": "Malware payload", "value": "27deb438a9f271797721c92a58b8eaed", "object_relation": "md5", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188810, "uuid": "b171690e-5f85-470d-b643-775cc84d3bee", "comment": "Malware payload", "value": "b4e52fec663a9c2feaaea4db0c00160e415db35d7a916b9d6524f31c7133ed73", "object_relation": "sha256", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188810, "uuid": "77eef6eb-ff13-43fb-9e46-7cb0dd4b91fb", "comment": "Malware payload", "value": "14d31ee4fdf07a3aee9bf2ce62011663690176c1", "object_relation": "sha1", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188810, "uuid": "126a72ff-fbe1-4afe-a9ab-8b1b008b02d0", "comment": "Malware payload", "value": "c2afd7a399a83d441e9a32e6fc51ba0f69d58f9caf12c3c545e639d26e24be9cecf20b302fc9dccc1e0a2ea8590986cb", "object_relation": "sha3-384", "Tag": [ { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188810, "uuid": "a6659c64-9d4e-4ae5-90f4-d293b262d068", "value": "T1062523088F3C6E9F09A851BC857B0E5F1BF9CA896444D9EED7C1FD4F8D2AB361245058", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188810, "uuid": "db8888c1-c5ca-4840-9fb6-dec31c0b1625", "value": "12288:8ppYXT60Mv5a8kebcetZ3Aq74GA19Td1JplTmu5jP+D/43EeI1MIuDfr6vAU1a+W:fXWZ5Pbcq92zjP+sjI1Gz6v11NA6fbXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675188810, "uuid": "199d08ed-292f-408e-a44e-5104f6823ddf", "value": 997255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675188810, "uuid": "2059f856-fff2-4a67-a081-bee5c0c6dd47", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188810, "uuid": "7899bec3-01e1-4a23-bc8b-ac63eedf23a6", "value": "pdf.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0563cf69-a1b9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675205154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675205154, "uuid": "2f21b701-b832-4a1d-8389-38329dff1cdf", "comment": "Malware payload", "value": "12f97cb6d4099a0654557fd2fc271837", "object_relation": "md5", "Tag": [ { "name": "ASPXChopperWebShell", "colour": "#6C642E", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675205154, "uuid": "331589a6-c4dd-44e1-bd2e-31e94c7906b4", "comment": "Malware payload", "value": "b5598bdd09a7bee3aa99e39da6a4b18225a4be18c937b8f9b72bff66b11f7c03", "object_relation": "sha256", "Tag": [ { "name": "ASPXChopperWebShell", "colour": "#6C642E", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675205154, "uuid": "783dfc66-ddc3-4677-bc16-add336551885", "comment": "Malware payload", "value": "404efc1ebba91af6707545e1331149674f1bd7c4", "object_relation": "sha1", "Tag": [ { "name": "ASPXChopperWebShell", "colour": "#6C642E", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675205154, "uuid": "db3eec15-a0db-46d8-918f-5ac9e675e1f2", "comment": "Malware payload", "value": "452db70bbf25837a19ab7a613b4f5246087ad8bc77394f1b48b1f69c9475c967db64f65a4caebef688f4d17787c18aca", "object_relation": "sha3-384", "Tag": [ { "name": "ASPXChopperWebShell", "colour": "#6C642E", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675205154, "uuid": "cc4d0680-e35e-4e14-801a-a9c8eb741c4d", "value": "T12DF0A212BF28E90807004D903C4CE8C47B3927BC6970BDD4A5C75818C91EAD623F77AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675205154, "uuid": "19bf9478-e439-499b-9899-e178f6830ea4", "value": "12:XS7HLgyacwVwQEKIKF2MTCHCaHzLgyacwVwQEKIKF2xGZMjzLgyacwVwQEKIKF2A:iTLDwOQEKIKF27xzLDwOQEKIKF2xwMjC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675205154, "uuid": "ad1be3fb-4c6a-424b-9fb2-c178a81ccd6a", "value": 629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675205154, "uuid": "19530de0-4db1-4ffd-bc2c-86bb849c625b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675205154, "uuid": "718fcea3-7c71-4197-9be8-3567f4bfd82d", "value": "M1H5eW9T.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "367bf0c0-a16e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675173025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675173025, "uuid": "16177214-3aca-466f-be79-092cf2cb1290", "comment": "Malware payload (AgentTesla)", "value": "66d9be0911d76a81023425de72f109dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675173025, "uuid": "b10487ff-2956-430b-82d8-e61c78ed687d", "comment": "Malware payload (AgentTesla)", "value": "b6369635796fb8c318edbd1daa3d74816587157bf8b762c2d785ea7ccd10ad4c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675173025, "uuid": "cb4d09f9-8934-48b6-994e-40c9eeedaf14", "comment": "Malware payload (AgentTesla)", "value": "7d2108216ed6e41a2eb8448f462f7d03e7ccab09", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675173025, "uuid": "30da3757-0eef-4fdd-8792-b90b80d434b9", "comment": "Malware payload (AgentTesla)", "value": "e68f2d02da41f06755d056ba2aad999f61cb7df400d40de028d8c583dbc032a5eb953e77b6da695c49e3c213c19ec0d3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675173025, "uuid": "c773385b-3998-4fec-b917-e91e46f94bed", "value": "T18064120837D6C063E55A03311DB81BB36FA9C133A971F75A0B716E7E7C242D1A62F661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675173025, "uuid": "10623e6b-24e2-4b88-89a9-01eb28608079", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675173025, "uuid": "b417d8e3-7e78-40ba-b80c-dad33f9fb05c", "value": "6144:/Ya6jmEX6zkPvbjVRK45wtXrqUWmnWrY7JR2UoUOu05zWAFCFA:/YZmEX6avbj3KVtbVFRHz0ZWAoFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675173025, "uuid": "5c70c342-ce13-4655-8e7a-98f3c7d74207", "value": 328226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675173025, "uuid": "97ed5aa8-ad6b-4ea5-aa06-fd9a4f6f4e59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675173025, "uuid": "e169640d-9aa4-405e-92e5-b039bdd7c4f9", "value": "fik.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724522fd-a146-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675155945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155945, "uuid": "62ba7f19-5966-4c6f-9cc3-a90eda88e76b", "comment": "Malware payload (Mirai)", "value": "f7379f6a9fb53fd66db7bdb7f100c3d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155945, "uuid": "d2481c74-09b4-4f4c-85b7-d86c716c55a7", "comment": "Malware payload (Mirai)", "value": "b689d8980e0f27c01e97d6a6d0f72b68168afd5622f06d2d2c4043e24dcea34b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155945, "uuid": "2658b47b-c748-45fb-8435-15e1c9f10d7e", "comment": "Malware payload (Mirai)", "value": "741e5a65a913c4fbc7ac2c6edb9bfe885805c3e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155945, "uuid": "83f3ec4e-addf-4631-abb9-374c8b4dab0d", "comment": "Malware payload (Mirai)", "value": "979d964851de323c57882efc5b13dd989b95d706921af1c47fe64ba24a749ea28f39ea3da1dd81eafb2b93fae78e317c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155945, "uuid": "5a634c37-d507-4f55-a297-259f674a3415", "value": "T1ED43C794BC824D2AC5D813BAF97E12CD332073E9D1DB7223C8155B547ACAA1B0D67F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155945, "uuid": "ba2016d6-1450-4a7b-a0ad-f25910d7976e", "value": "1536:DplaXWV5NGPR6aTRMbpmVMEweQfb9ZIf+E3Ok+mDy515Cv:GULGZ6wRQqhwlxZIx3OkVe5bO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675155945, "uuid": "6073e3d9-32ba-4ac8-9158-17dc6cd9436a", "value": 57568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675155945, "uuid": "5a7a7d55-590c-4462-86a3-9433671a66c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155945, "uuid": "e25630b0-612f-4aeb-83b3-25ec17801ef2", "value": "f7379f6a9fb53fd66db7bdb7f100c3d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0763308c-a13f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675152759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152759, "uuid": "0b37b6c2-a59d-4d4f-9ea1-fab1271e850d", "comment": "Malware payload (Mirai)", "value": "707aa371c64972d6c41685ee3d23c607", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152759, "uuid": "17c20ed8-45c1-407c-a230-91174b0b3694", "comment": "Malware payload (Mirai)", "value": "b75dd001d275ee7a1360a0266e155e02cf86b09b77b4907fa392657abdf58c79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152759, "uuid": "ecb8deb4-423e-450a-8dc8-d8ca9496af6b", "comment": "Malware payload (Mirai)", "value": "e0024587232e23a7c4eadfb41ee8f638188b8b45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152759, "uuid": "ceedc814-4683-4d83-87e8-75214cbb4c90", "comment": "Malware payload (Mirai)", "value": "c599df4bf570c1ad4f0f149d9f4cabed784d167eb57493733021e3bbb4bf08c06adcbf48f6b471f2c493c1248abba7f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152759, "uuid": "203a10b7-9c99-49f1-8d2c-b43cf1b440f7", "value": "T1CF33FA8EB8029D3CF91BE6BE54164E0DB93177C152830B2757BBFDA36C721A45E02E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152759, "uuid": "810180be-79ea-416c-a260-4bdb56612ec8", "value": "768:gduPBFnHooqR8qOCKq2cH4Fje+TK806MMUVjzMfQXOtHud2oG0:r/hqaJMcjeqK806MHdMfQXoHuC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675152759, "uuid": "5e101453-42eb-4693-a332-435caa283038", "value": 54932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675152759, "uuid": "a19fbc8e-9413-4ccb-af54-70e1d5052a24", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152759, "uuid": "898c71c0-e5d4-452c-aebf-d0e3119baab2", "value": "707aa371c64972d6c41685ee3d23c607", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac25d083-a14d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675159049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675159049, "uuid": "cc54eb20-d262-4ff4-9888-284d432a702c", "comment": "Malware payload (Loki)", "value": "a314ce7487b212479be25e543f52cfc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675159049, "uuid": "40b47f6b-e9c7-45b9-8bf3-1a63fb69c66e", "comment": "Malware payload (Loki)", "value": "b792cface19177dcf7adcf819da233c86442dc1eade7fdef334de8bc4c96f7af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675159049, "uuid": "12e81ecc-f029-4ed1-90a1-7f447d8e4256", "comment": "Malware payload (Loki)", "value": "33537fa5a86a7c8c7af1873c74b6aa8d0dadb827", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675159049, "uuid": "d5b2051e-8b7c-4916-a185-559cde491b4d", "comment": "Malware payload (Loki)", "value": "3a2c634bd3d495e44aa15c4865c3aa742ae2d1ee1d614d9ed19edb0208add783faf24f144a3d72fb2470afac6de28a4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675159049, "uuid": "1f380235-35b7-4b37-bace-7f69f057da25", "value": "T126D423643AE9D3ADC04C467A9C746E0023B5AE01BD97CB2D3EE639CF59767900489F87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675159049, "uuid": "a9a2257b-7af4-4d8d-b60e-fa1b82751fe4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675159049, "uuid": "083c3e2d-d2f8-425f-9058-4817f6551f4d", "value": "12288:o5sBFjCfuXdm4S4w1gzs43HBbXiP3xN5hMNLpKqntbIEIMI:7XYwlEn0N4+b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675159049, "uuid": "2e84c318-4b34-417f-91c9-7912d046958e", "value": 629760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675159049, "uuid": "f614e445-52a3-4af3-ac56-f7620ec18853", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675159049, "uuid": "86b0543b-72a4-406b-ba6a-2de9d848ec15", "value": "Ship Particulars_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84be06d1-a151-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675160700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160700, "uuid": "f683ebd6-5846-46e3-b199-90d4c43155ca", "comment": "Malware payload (Mirai)", "value": "5753b52a6be75a7753354f77cfa25938", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160700, "uuid": "6caf2425-95c4-483b-8d7f-49b1f8af4fa2", "comment": "Malware payload (Mirai)", "value": "b7f85dbea395e82449ee865736ea9f4e454ff43bfac500a1b83145975a6e853c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160700, "uuid": "b5ce9f17-aab6-405e-b7a5-30ceda55b54a", "comment": "Malware payload (Mirai)", "value": "8361f4e77fd66c10ef54af05388937706b7628ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160700, "uuid": "31e5263e-eb4d-4141-bc3e-5a3ebad2fa92", "comment": "Malware payload (Mirai)", "value": "18b4990011053d600c5110b6487c704501198afa8c4f7f27da363686204d559d40e56760233ff1096818eaad89f807f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160700, "uuid": "e86b4271-7ec8-488e-9dd8-fe9e840a2f52", "value": "T133731902F31D0807C2731BB0693B27D5D3AAB99221E4B389765DAB4EC531D37A54AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160700, "uuid": "d756b916-16e6-4b7e-a996-84c4a60f06ea", "value": "1536:ZLRlFI4aavpuqZZwPCJftvm0xvZroDqSu2y9QTegQIRkic9LyF:ZLRfIj2kDdzggQIOicxyF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675160700, "uuid": "8553eeaa-7d85-4667-9afe-593327d7d26c", "value": 75380, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675160700, "uuid": "f2b54481-654f-435a-9135-4330db793f1e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160700, "uuid": "1a552e8e-1182-46eb-b7da-601dd346e668", "value": "5753b52a6be75a7753354f77cfa25938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba43ef2-a10b-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675130459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675130459, "uuid": "d9915f4f-76a6-4923-bd39-8eeb2c319c52", "comment": "Malware payload (RedLineStealer)", "value": "1093f665e50cf7c800fefede10a1e3b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675130459, "uuid": "47366b67-5675-4349-90a0-40d99f3a7afb", "comment": "Malware payload (RedLineStealer)", "value": "b8ffb1f4ec3006ecde89e6bc20265e78c829d0ce77d4f7c3714fc173f1c82ccd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675130459, "uuid": "6b7eeae2-254e-46d6-957e-b31451eaf5d8", "comment": "Malware payload (RedLineStealer)", "value": "3945c69c6add23c39fd561c0f181c5548cfa564f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675130459, "uuid": "7fce7044-6b17-40f2-800d-7cd051341af0", "comment": "Malware payload (RedLineStealer)", "value": "913f09231952c7945d8d4c62465b3f0c677a7a04e5ec72c9e8f9875ecb25eb7ec0088aee8811479a1ba4fae389b06c32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675130459, "uuid": "af82c44c-280d-4aaa-9d92-326ed669f7aa", "value": "T1E55401126DA0E032D35699741124C78439796E335D7A984BBF891BBE8F711C2BA3F34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675130459, "uuid": "a80bd7e1-1ed4-4e53-a011-22b6f9902183", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675130459, "uuid": "57079491-b2fc-40a5-b4b9-785ce226eda7", "value": "6144:tLlyQxSZXSP8A2KLreOQMHDEjEzLlvXyldddd:twQxSd82KLiO/DGEzLlfyldddd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675130459, "uuid": "98b99580-fe72-4e7b-ba1e-ff5b5c5e3d62", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675130459, "uuid": "f073507e-8170-4f68-8a05-ea0e9e4ddcfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675130459, "uuid": "a3cc7ca5-210a-48cf-82a3-f2cd239642f8", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25c8cca4-a161-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675167413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675167413, "uuid": "ef1e3a46-fcd6-4cef-ab71-aa124e5dd4d3", "comment": "Malware payload (Smoke Loader)", "value": "d99dca3885150ea6716daad2c02cef31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675167413, "uuid": "bf676745-d5c9-439c-83ba-3dd6141ada09", "comment": "Malware payload (Smoke Loader)", "value": "b9493a3329699111125c969bb751e656163fee37c9c3d43e1dbb5811739b1ee5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675167413, "uuid": "16bf933b-f42b-4588-afde-4ac2e8903bed", "comment": "Malware payload (Smoke Loader)", "value": "8248bf7778b09e9979d04df196ae6d01d9c07161", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675167413, "uuid": "7bc14ab0-a745-430e-9076-38dc9a445d0c", "comment": "Malware payload (Smoke Loader)", "value": "fd2e1a14a3aa78244c7eed709d6641bfaa5716b532e99259bc51f5bae87452e6739bad12d50289bace97015ed01a8366", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675167413, "uuid": "9d1bf2f0-3b50-4e59-bbf3-795bdcd5388b", "value": "T183549E02F2E1FC41F5668A72CE1EC6E4F51FB592CE18A72623186A1F25B31B7C762711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675167413, "uuid": "e6978bfd-c1d7-432f-bc96-66a71e34c20b", "value": "78339dc1c5de0e493ea2b28607ce356e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675167413, "uuid": "859f8c3e-479e-4686-a89f-26566709038a", "value": "3072:tRuFJNvLv6RoTYG0sXC6TMe1AuqInG9FeMGZ+7f43H7BFYApmRCqx:SrNvLvPEGLpTMe1AzeGTcZ+7f4Ve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675167413, "uuid": "9303b9d8-925f-4561-b319-b85fa38dff86", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675167413, "uuid": "cf3564e8-83ba-4ca0-ba69-62047390ad86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675167413, "uuid": "c6d7575b-6b6c-4c27-985e-e08742a857e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9d2370-a172-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675174944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174944, "uuid": "aedb0a8f-8a08-452a-b3ea-5794af2576f6", "comment": "Malware payload", "value": "7f12c58a91debf1467e85070733e27c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174944, "uuid": "2e8c5e1c-c787-4cf2-a4dc-30071b596208", "comment": "Malware payload", "value": "ba4e4b3b18596bc24bba361c555f3d7bf49222c6de710a277cf6874b194070f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174944, "uuid": "625f1aec-5541-465b-b0f9-07310b9d3c98", "comment": "Malware payload", "value": "b9999a8d9538d7c4e1131bc008b720f375c3cc1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174944, "uuid": "bf70152d-6a83-4607-ace3-76d99c5c089d", "comment": "Malware payload", "value": "808cdc3e4e519c85e69df87bd025e64b3b19b0fb5efdc9df0d216021f67073ed531a01d22408f0830317a8f3b165e5db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174944, "uuid": "b80c18ab-9ac8-4829-98f4-d568909106b1", "value": "T1B3E1E610E3AC4633DD6A0737AAF713415378E3A169D3CBADDCC9185BAD062C49B627A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174944, "uuid": "d7ab9691-08ec-426c-ab9c-26c1b9fd5c4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174944, "uuid": "a9645fea-af00-4143-b93c-52b7fdbc6dff", "value": "96:mFp1IkpZM5IKr68vsLzJt2RZBzu0gNU4et2fbCkNjt9kzNt:0p2IKKL32TNu9tNbvTs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675174944, "uuid": "c006f4ed-9f6b-453b-8d7d-9d09d2bbd5f9", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675174944, "uuid": "984f69bf-5d47-4532-84b4-1466305f8e79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174944, "uuid": "bd4c7b2b-4ee9-4876-a95c-8c18b0e006fa", "value": "Quote Request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8093a3fe-a1ae-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675200637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675200637, "uuid": "e861c27c-d453-4fc0-820a-f3d04d5b0ad3", "comment": "Malware payload", "value": "c540d12e23c0d14510f31c606dd557c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675200637, "uuid": "0fe662a9-5cb8-4af9-97cd-b1950824d6a4", "comment": "Malware payload", "value": "baceadb0245d919a458edaace177a7be556261704d8959014aef8325d16e5b1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675200637, "uuid": "c4fecb46-79d7-4a6a-adb9-418da8ed6d49", "comment": "Malware payload", "value": "8e96d3b0c729b9568ebdb7d349b3c9574c874539", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675200637, "uuid": "6d6caef5-bbff-4d85-a375-2bffe4d37718", "comment": "Malware payload", "value": "c294e2ee4ff786844481041509dbc02f5d1beb6d78e40f2daf3a8552c21c53bf86855dd8abd06e8d7d245a4f98fbc831", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675200637, "uuid": "2d1b204c-9e27-4483-9682-b30ca0df1e14", "value": "T16BA5331A95D68079E223D53454792820E9B7BF2B17AAF4D2646CC07F0F6B171F8CD32A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675200637, "uuid": "3c1084df-2e76-4659-acae-fe54b7b2d257", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675200637, "uuid": "62b98841-9b7b-4e1e-87d6-ee0b4fb1df54", "value": "49152:C2IuJnOWl5f8zEjCiOQelTmJCJCyFQiFZ8RE8cO2CCi9LCgv2MR:d9nOa6iCVpmkJCyyQuNcO2CDBv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675200637, "uuid": "f51f711c-16ba-4f5b-84c6-905041ad6939", "value": 2173316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675200637, "uuid": "2b189992-6ce9-4ab6-aa01-abf1b4137b92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675200637, "uuid": "393f097a-f16c-4212-978f-2da7cb148968", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ea3aa34-a1bf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675207935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207935, "uuid": "8c3f5c51-108f-4bc1-99c1-7a8b7d5f5195", "comment": "Malware payload", "value": "75ce84d2cd9de4500ba05ac2e48a9c67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207935, "uuid": "ee0ef9f3-ab31-44e1-a73f-3b2aab612731", "comment": "Malware payload", "value": "baee8d4c7699739995f240d497d0ccdc1dcc0045dc545ea0a45b8f773cb20583", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207935, "uuid": "b17fd361-5224-47f2-8b72-c5fede926da6", "comment": "Malware payload", "value": "7b42e0f072e4bbce429e0c92dcd0930678440f6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207935, "uuid": "e00168a6-852b-48e4-9d6c-698542cbccb1", "comment": "Malware payload", "value": "6247dcebd01aa069bc60e5506f0b74d4e8ab8179c19d9cf3491b6d1609cc89ae4dcbf0527b1684571ec3c13fc4e03042", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207935, "uuid": "32541ebd-9d0c-4ec1-8538-6124a59658cb", "value": "T1B6548EC2A2B17C62E92E8A719E1EC6F4761EF5434E487376220B5BDF15B01E1CDE3249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207935, "uuid": "3521eaff-63a2-4945-8b25-5041492ca293", "value": "d84aba910fd98bff40c3867e1dd713e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207935, "uuid": "c3a53fa6-2806-4d71-9775-18defb325612", "value": "3072:iyuenmmLotRs0YIwcOzxZqxGuhHSK461j9HmqPUx6WfQz8609y73MM:CenmmLoArcONZqwUM6zHmqMoIt9y78M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675207935, "uuid": "6d0d9380-929c-47a7-ba70-56e0c7d6aa74", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675207935, "uuid": "0f326c93-3046-4c21-beb4-07614bc5ffab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207935, "uuid": "86cc6f87-4939-47c2-81ed-4b93cdd05cca", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee73808-a136-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675149202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149202, "uuid": "4c068c0c-a2db-44d7-a6f1-88ac733a8d65", "comment": "Malware payload (Formbook)", "value": "9e1a7f42527891e28292051bc53b4c34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149202, "uuid": "45858fad-9c33-4b3f-950c-500da1a5685a", "comment": "Malware payload (Formbook)", "value": "bbcb225a7c276aeb6f8dc8126d020327dff57ef23a80ff47eaba2cd2392c7f25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149202, "uuid": "55fdefb6-0f36-44c0-81c6-25945a761abf", "comment": "Malware payload (Formbook)", "value": "7349dd97f1b92fbf746f3097fbcfcfbaf2f00df0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149202, "uuid": "fe19818e-4a97-4fec-8f89-8b0049f2ca70", "comment": "Malware payload (Formbook)", "value": "a36bf950391ad34c3dfe5d1be606655a3bc6a7fa9d5e9dc6f0a608f8951e1b5e8e0c343fc34a20de93dca2a49bb0b78c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149202, "uuid": "26919ed4-cb89-4cf3-b6dd-f882cd317cef", "value": "T137F4126983A8CFE6CA6803BF19F164585BB12996F06FE70D0FFFA0DD4886742511139B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149202, "uuid": "b0262274-117d-4b27-b4f4-b5afadb1d487", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149202, "uuid": "272a386e-52ec-4994-8d7b-014ebaef6dd7", "value": "12288:vSQZNcQOst8h787EBfiSNlEEF5mJgeCRBYJhfgH8iaxeWeh3ih9HNA:XNc9s2YERie2E7ney6zgcXUBYTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675149202, "uuid": "f190ee73-9392-472d-a5b8-c56347c0414d", "value": 754688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675149202, "uuid": "21ec2d86-7356-49a8-ae3c-bd23e7dce3cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149202, "uuid": "ce8cece8-d6f9-4d95-848e-241be7850e4e", "value": "Payment Notice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47060051-a115-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675134827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675134827, "uuid": "c091b992-e73e-4d62-aa77-bb9ec8b5b198", "comment": "Malware payload (Smoke Loader)", "value": "796eec633508016212d9c0fba6ebcb34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675134827, "uuid": "57b8bd6b-14d3-4c9b-b937-22b716cc9151", "comment": "Malware payload (Smoke Loader)", "value": "bc5787aa7fb2fdab0f1e0f100a548d116805dafd60ed94244312425da5bdcb70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675134827, "uuid": "93ca6a4b-3b77-4f30-a93b-13516dd01631", "comment": "Malware payload (Smoke Loader)", "value": "6f7f80791fe510406e741aa4e857311119135424", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675134827, "uuid": "dbea1f49-422c-4ffe-b16c-d145d097ab25", "comment": "Malware payload (Smoke Loader)", "value": "fab8feea4c1ddddf94f08e28d768a64d00c5da247d150549a3d30536b36725cd3c557eacc123afd51114dbb2dd168562", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675134827, "uuid": "4786711d-281c-416b-aa62-4dcc2fecc83c", "value": "T146F3D0157990D033C0D616780925C291BA7FBD321EBAAD0FB7881BA9BF322D1572D35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675134827, "uuid": "840e2a4c-35de-42aa-87d2-cca91470a224", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675134827, "uuid": "e469af80-a3b8-4541-98ae-0a2d2b6cc125", "value": "3072:bjLMd8LVM6xxogLW5KnpSdQSl8S0lDoSApw9+cBr:7LxzogL3pS1lP0lKS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675134827, "uuid": "743132a5-e7b0-4335-a3c5-bd1322efc6d8", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675134827, "uuid": "67aa0812-8c91-4c18-8967-7d2d838de06a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675134827, "uuid": "cbc3e8d3-6a3f-454f-951e-91f82b9444f0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74569cb-a186-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675183522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675183522, "uuid": "502fb674-4571-4945-9286-14d8d88c0533", "comment": "Malware payload (RemcosRAT)", "value": "27cef70a62f86294bd81b32ac6f96890", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675183522, "uuid": "a977fab0-f0b4-455a-884e-4171359d056f", "comment": "Malware payload (RemcosRAT)", "value": "bc5e5b32cee20470d93b3152c3cb5faeee1434a11e07b5ac5efaa76fe1221034", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675183522, "uuid": "e9accc8d-a359-465b-89ff-775d33ff0fb7", "comment": "Malware payload (RemcosRAT)", "value": "b45279594d4d7f9b161458593ac5d007d8758afa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675183522, "uuid": "a05eed6a-b27c-433d-906a-0177a5335dcd", "comment": "Malware payload (RemcosRAT)", "value": "a6c81fd5311333e0f7f7091edd2d18591b406db73dc26c70e4bc2a594be6b3647ad59950ec55690f5b59250dbe052b31", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675183522, "uuid": "46d889e0-8be3-4732-90dd-c8dd4a8d9328", "value": "T1BBF48CAEB2B4C433E03317B59D6B57E98832BC215D28D8476BD678CCAF3A7453429193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675183522, "uuid": "6b84dbd7-7773-4253-9fb9-55f030c5bb99", "value": "f0165a9d7bcfb8fa29fd32e4d73bad5d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675183522, "uuid": "e2051261-4d48-495a-a7fc-889baaa7b6dc", "value": "12288:nXCSJ638aXV+o1zl3qJVkdRTYJO8t8q0NVlstZo1NkB0lEKjh4jieNt:yUk+o10JVE+Jl8FNHkmNkBPKhheN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675183522, "uuid": "309ed57a-483b-4725-87d8-87056b39a1ba", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675183522, "uuid": "7172f49d-eac2-4e9a-9f5d-8642bc51dddb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675183522, "uuid": "16e0c6c4-831c-4485-8764-937008794b93", "value": "27cef70a62f86294bd81b32ac6f96890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1983d8-a1b9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675205380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675205380, "uuid": "c9cf026a-8c71-42ed-9626-d0fbb554e3f7", "comment": "Malware payload", "value": "cb3edcd7505b4fe9a628bedd6b29d262", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675205380, "uuid": "0e4cbab2-dae9-4206-8f6c-c1237d8a769c", "comment": "Malware payload", "value": "bc6c1ee2b06d35ebb30a7ee02c682c6b72e5b3101cfb47e551301d2cfdc74ac7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675205380, "uuid": "2d53768a-0e44-420d-96a0-da860c727eb4", "comment": "Malware payload", "value": "0949685cd63a81de270b979013c5e5d906d84a3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675205380, "uuid": "3b00924b-6146-4da1-8fd7-a946661bf257", "comment": "Malware payload", "value": "0f9ea2f0e385930ade4eb01aa909025a8d04ed1e89ee12891cdb08a36dcd3581a03e4aaea0f3e26545ddf38490d761b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675205380, "uuid": "3640ece5-5b43-483d-85b8-12697e5919d5", "value": "T1A58208A842DC9323FFAD1BBD54B562C35BB2B633A401F61D388CB0D929C634581A5B1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675205380, "uuid": "cbdc2337-2124-4020-ab8a-89ea8001fc9d", "value": "384:P2qZbVxZ4gddXpjHMP7S3lg9Hok0NGHISSNPZTQLH:+IowdNH9xpG+cb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675205380, "uuid": "7e32973f-5c9b-4cdd-ac0a-a6fc2b2d4d3a", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675205380, "uuid": "043baa23-a1f2-4904-a8b3-2ab046019428", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675205380, "uuid": "a6831446-f779-48a6-83f0-7c49b78f9766", "value": "SHIPPING BILL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd617f9-a19e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675193656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675193656, "uuid": "fe710028-16b1-4565-835f-2d26958deb29", "comment": "Malware payload", "value": "c24e3593f9ea3dc9020e422cfa01518b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675193656, "uuid": "e3284bf3-5b01-417a-a4d9-2e8027f75a9f", "comment": "Malware payload", "value": "bc7bc137124438e085c94e8c6e877a6899775695a4e7fae108f66136f5100b12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675193656, "uuid": "5932859d-df8b-497b-90b2-6de3a8ef89af", "comment": "Malware payload", "value": "303724e28d6c297d9c62da41d1eb7af0b261a335", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675193656, "uuid": "a5cc7aa7-20be-445c-9cb5-7e4b96199f53", "comment": "Malware payload", "value": "828332beaeeea38684c399aeb65edd1ace6bebbe53d59f72fa50b0d1d25250bae3349a63d28263b1a97b57f38449d2af", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675193656, "uuid": "87f66847-7b46-4be7-96d2-f0e6f72a4263", "value": "T16A84B0C276F37C63E922C6729E0EC6F4761EB9524E186366221B9BDF15B01A3C1E3711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675193656, "uuid": "b9d363e8-97b4-4c69-982e-d78caaad3b12", "value": "9c039baca0968dd2f90042d865dd6c2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675193656, "uuid": "bb122901-de1e-47d8-ba01-a6bfa6c10282", "value": "6144:CCJVLHgg+Yic08S71JatD4yrBoF7F/52y9IiX4mqMoI5wbvT8MN:NHLmxcQ5P4BoF7F/52y95HqMkvT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675193656, "uuid": "e634c7d9-4cb8-4ebe-8ef9-414f50902e0b", "value": 401408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675193656, "uuid": "2073ac75-f84d-4d70-acd5-d47e23a2bc7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675193656, "uuid": "5d7e4ae3-d20f-4388-9003-b21ea2feeba4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1774ba9-a176-11ed-88f6-42010a9c006e", "comment": "Malware payload (Quakbot)", "timestamp": 1675176640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176640, "uuid": "f5238f81-9cf5-4e2d-93b7-37ba323a39be", "comment": "Malware payload (Quakbot)", "value": "90ece9f67237fa8cf4e1adc598ab905b", "object_relation": "md5", "Tag": [ { "name": "1675161160", "colour": "#029B8A", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176640, "uuid": "f1a8ecd9-0327-4683-a25d-886faefa1ff2", "comment": "Malware payload (Quakbot)", "value": "bd040a74f99bd767652abc940a4939361d214ba6407781724fde55e48fa7aecf", "object_relation": "sha256", "Tag": [ { "name": "1675161160", "colour": "#029B8A", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176640, "uuid": "dc677a1e-60f8-4f18-ac2c-e3e888c556b5", "comment": "Malware payload (Quakbot)", "value": "5b48931a9f9ee8ec119046619c19780e8e97e572", "object_relation": "sha1", "Tag": [ { "name": "1675161160", "colour": "#029B8A", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176640, "uuid": "681c3b07-1db1-47ac-97f6-7e16f36f087e", "comment": "Malware payload (Quakbot)", "value": "e2e1da42cba5a5d11736a92216f76c20306e86a213c33538244e499750f0ed0e5923f9f3dfaf30a5c6fcfdeead1d9941", "object_relation": "sha3-384", "Tag": [ { "name": "1675161160", "colour": "#029B8A", "exportable": true, "hide_tag": false }, { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "one", "colour": "#E3D54A", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176640, "uuid": "b0a0b608-9c30-492b-aaf0-06361f1a2718", "value": "T1D3F3E003BA9FCD15DABE11B005B66FDBA721AD3283E29367577530D8AD222B0F44215F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176640, "uuid": "dcb4ed3b-3cd3-4b38-9607-00109b260084", "value": "3072:Y1lg8QPXTRA2P/7dq+Jj29Ua2+jYF/EpHLz2TWtmD:JJtA2PRNJShnjZpHLKTWtmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675176640, "uuid": "f61f7d42-8345-48e2-b5a1-af5c3896254c", "value": 172568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675176640, "uuid": "d03644cb-d223-45e6-bb7f-c3848e7b9fe1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176640, "uuid": "63a91701-302f-4bd2-9a85-0d8eb1128267", "value": "215070.one", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dea72f0-a1bf-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675207880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207880, "uuid": "588cb2df-be8e-4a18-848d-e30a5a6f2d8b", "comment": "Malware payload", "value": "fa184b9a9fb1800866c93035387b2c36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207880, "uuid": "57e098d7-95da-4e6a-8409-562521ae31b9", "comment": "Malware payload", "value": "be19a4fb91f4aa9629bcf3d1bb2fc199e29e8dd5135663179954784bf4db6a57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207880, "uuid": "4a78e253-9ab2-43a7-96fd-1f7c29d7ae82", "comment": "Malware payload", "value": "303d14363529228c5fc9c4b763e57da3c060eca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207880, "uuid": "fe6e25a5-ae62-46c7-9a25-7355c4f94544", "comment": "Malware payload", "value": "3e6290404c5c59b9c4994cf292c7e545096914de97534e35bf9755fdf87f082501c5a78fb4796d70b6a891ad148d8422", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207880, "uuid": "af96151a-0409-4c39-9404-6466e874f93a", "value": "T145548FE272F2BC62E9228671DE1EC6F8752EB9924E047365221B5BDF15B01F1C1EB341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207880, "uuid": "41bd1fef-af00-4226-8c94-60dd126a7559", "value": "d84aba910fd98bff40c3867e1dd713e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207880, "uuid": "153f24ee-23b2-46fe-a3bc-99cd00231cf5", "value": "6144:Ufj9JLKmyGejntCQY97AwamqMoIinoj8MV:+Luvtpw7AAqMfh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675207880, "uuid": "8f5d45a4-48f3-4688-b179-ead3ad89e493", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675207880, "uuid": "4984f80a-4c7f-4097-ba80-1f4aa4171ad3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207880, "uuid": "b88e4820-8be5-4103-bff3-29f8f482b86d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f127a580-a18a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675185364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675185364, "uuid": "781643aa-f2a2-479b-a744-43ea4a1ff6ae", "comment": "Malware payload (GCleaner)", "value": "fa584de3f27136b0f4da492c9e7a4286", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675185364, "uuid": "b237f5b6-d25e-437d-bc7f-3b62d0303331", "comment": "Malware payload (GCleaner)", "value": "bf5e79830818d90b9bbb893a15adb4d56235138aa1469da2a2246c6a1cf6251e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675185364, "uuid": "43454f70-23cc-45d9-a652-af89baff51d8", "comment": "Malware payload (GCleaner)", "value": "be4a8663ec73efe95dd064361fb1d90ecb789d7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675185364, "uuid": "bf49d450-863a-4641-99f2-bc51f3118a8f", "comment": "Malware payload (GCleaner)", "value": "53fbb3da5762b000d9546e0bcd406c45a17329a7ec84c6209ec32a7c6bbe4f527dfd8b3337ab0e81e74ee12831d0982d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675185364, "uuid": "b6611bdc-560a-4075-b007-5cdedd802b24", "value": "T1A5A5330B70D94E37E5725777822249A3BC63FE2418FA954D313D92681ABE3DB0F0A365", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675185364, "uuid": "32885ed1-2d06-4c1a-ab5b-7a6f59807240", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675185364, "uuid": "27aa8c2c-71bd-45f4-b5d1-ea4b38532331", "value": "49152:C21S+NdyogLlyJD9T3dqA/90qLNgHlSlKu9KSZ2NqfkyLCgv2MR:dVIFlyR97dqAl0qBgHsssfv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675185364, "uuid": "e56deb95-7415-405c-8d78-ffa05710b63a", "value": 2173735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675185364, "uuid": "76648fa6-8939-455a-880a-5de8aea68788", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675185364, "uuid": "c90459d5-ff5c-4c20-b023-a5bdcbab5a73", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "197c5949-a137-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675149354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149354, "uuid": "8a32547b-abfc-4c33-90b8-c6f6e3b9077a", "comment": "Malware payload (AgentTesla)", "value": "ca57ca2b800dcb1802be85896120e03b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149354, "uuid": "0012f39f-0975-4884-af74-164df16575a8", "comment": "Malware payload (AgentTesla)", "value": "c000692d6aaeea505ce5cff84de29f09ef9af550cac6b052df3f824a77684fb3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149354, "uuid": "f513b6d7-8c8d-4326-b262-5491a5c6b36d", "comment": "Malware payload (AgentTesla)", "value": "b0237f6a24685ad90ddc2b627febe14e4b99ab2f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675149354, "uuid": "48998db6-f187-4cb0-9e7a-d7ef21a30df6", "comment": "Malware payload (AgentTesla)", "value": "2ffeb6325de9f8864e6d073cb417a06db0f1c29ddb2f61880884f0b2a53b809fc974bcf73fa5c62a3c0b23523246aede", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149354, "uuid": "e74cf5d3-d0e1-4ec0-9c89-4390e9e2e902", "value": "T128F4029A02688FE6C56943FA71F4102527301676B0C3EB480F9AE8D5CD973F19E3B65B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149354, "uuid": "2e938456-e7bc-4d62-8cca-0e87f063778d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149354, "uuid": "1aa99800-ff33-497c-907a-c7c6ac69a62b", "value": "12288:C9+oy/wYFPrjwv0OSu06owTCUYh0QwnHvGAL7vcWeh3ih9HGA:CMoyLFP4v0T8ow/QUHeAPvcBYTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675149354, "uuid": "8f633a8a-aab5-4df2-bd72-da6519f29b7c", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675149354, "uuid": "1d6b49c6-5cd7-4bc4-95da-67c7e79fc098", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675149354, "uuid": "a6a99372-d2ef-42dc-a1a9-126033dedee0", "value": "TT Swift ($ 23,506.50) 19.01.23_jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7f18874-a14b-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1675158236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675158236, "uuid": "203caeae-1999-46e5-ae54-132a42ccd91b", "comment": "Malware payload (ArkeiStealer)", "value": "119692b5d4c588b16c5fc6913fc1b353", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675158236, "uuid": "e3f65b09-cf1a-4e7c-a9ec-86315aa82407", "comment": "Malware payload (ArkeiStealer)", "value": "c019f3fd980e21296e5ed63698f0698e8d8aff2f123eee7ac067032a8be4f94c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675158236, "uuid": "81d44ff5-f89e-490d-8646-ab4b96679a25", "comment": "Malware payload (ArkeiStealer)", "value": "0365d018fd1df47197b61620a10abf3a00204def", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675158236, "uuid": "ffca9785-bda0-476c-bfc7-ee10c06b27ab", "comment": "Malware payload (ArkeiStealer)", "value": "6860488518b5b26303352a5cd73228913a2e97ad0d3389d561b7edaa60fb49f32eeb18e6f4f3799d8f16092ae2694417", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "pw-1234", "colour": "#ADC330", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675158236, "uuid": "da6f5841-372c-4751-9ffb-9f8904e6b728", "value": "T1145633D64731206A5A3FDE766F94CF93932EFE80155E0BF9B581C990841B4BA1EF0C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675158236, "uuid": "50398998-69ed-4c64-b2c3-00132384c7fb", "value": "98304:myeLDUolFv4fioq8s54wyKT+JJo7dQFDxPR/mM13swdBoVE/3JyxeJoST6V:myeLDn+fdfwR+Q+xmMawdBH/JKPqE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675158236, "uuid": "6a9dbe8e-409c-4e1d-9556-93457d8cef91", "value": 5936532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675158236, "uuid": "a30f3dfe-7e76-4f0f-bf7f-b99754d1585f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675158236, "uuid": "725ac30a-fcd1-4bd3-9ac5-cafd9e9dbca1", "value": "AppUnlim-main.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73f94387-a12a-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675143922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675143922, "uuid": "a17c3039-29f0-4981-9513-debd0ec342d4", "comment": "Malware payload (GCleaner)", "value": "dd34a675ad0676eb8e55e96b53d81c3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675143922, "uuid": "d52c46f3-9ae3-4aaf-9965-28abbe52d071", "comment": "Malware payload (GCleaner)", "value": "c0c13eb714897e5e07d5259cfa12893245d59c388ec606c7ccbb475fb5140530", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675143922, "uuid": "25f795cf-2087-41fe-8148-dfefb3fc926d", "comment": "Malware payload (GCleaner)", "value": "7cf85de9f53b8415eb90e7c8f00a1970f6671a8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675143922, "uuid": "5d364ebc-ba10-4f36-8781-ca4026a8f23a", "comment": "Malware payload (GCleaner)", "value": "bf6b4c9064306a1792d6daecbbd1cd4b0d447368e52d17cef6bcc84c0e8bbd1e02bf22b5a7747f39499ef130b89740b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675143922, "uuid": "bde96e6c-df69-404e-8956-9282bfbded9c", "value": "T1BFA5334165F1D63ACAD2DB35783C8502B817377B3B741B29D14EBA8D3F378A26828B15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675143922, "uuid": "03934729-51a8-4e10-944c-6c9f8a755a1a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675143922, "uuid": "6e594357-3652-43f0-9ff9-54762f1f7a23", "value": "49152:C2k+zPOBGzuyaCTDv0UTuoj1IycLlfp2y1x07Nocmrnu5jGizwRYLCgv2MR:d/zHv1pj1Et07cu5KnCv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675143922, "uuid": "c81c039e-0588-4e94-ac2c-d3be5295fb07", "value": 2166641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675143922, "uuid": "36096a9f-8c0e-4145-bd16-e8da24dc8d82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675143922, "uuid": "9c8d8e13-596c-4841-8265-ba7d61b02d0b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c70d4be-a1a8-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675197972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675197972, "uuid": "6cb0619b-c0f1-4dce-8f22-545e452a8d61", "comment": "Malware payload", "value": "f008da0a53c3905217a604c582be3ed1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675197972, "uuid": "68b7639b-3413-4031-a58e-0579bbc13817", "comment": "Malware payload", "value": "c0fb2aede5c7e78347a858fdcb407a1556de3fa6f23c825ea43da2839a256783", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675197972, "uuid": "2d15c8ce-2ff4-4be4-bf93-d8bf5ef345f9", "comment": "Malware payload", "value": "9dc716c6aa07615744516585cb2f81f58d81bc3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675197972, "uuid": "3f43c80b-38ab-4752-b9f5-9aa8db94b622", "comment": "Malware payload", "value": "6e2fdec6bc37008d1769af7a44374fd42c76306da1544e99f6081158e54035ebefd7bdc112e59e5fab04a63639194dac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675197972, "uuid": "89dbf87f-6dc9-415e-8454-4a685438900f", "value": "T162548FC272B2BC61E92686719F1EC6FC752EB5924F087766121B9BDF17B01E1E1E3210", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675197972, "uuid": "e3fe7fde-391e-402f-a7d2-a34edd28ebc3", "value": "d84aba910fd98bff40c3867e1dd713e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675197972, "uuid": "cab1e86b-6d69-4a60-bb76-2aebd2bda595", "value": "3072:B6u5DTLkp0FRsrrDt+j/KZEPhzhdFceimqPUx6WfQz86fr3MMPgm:35DTL9YrrDIj8qzHixmqMoIo8MV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675197972, "uuid": "c7ddbe01-8366-4ea4-afdc-ffd36ff15cea", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675197972, "uuid": "84f72c6d-930d-4f45-8db6-b3c1a736ca93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675197972, "uuid": "b9e12dad-6932-43b2-bb5b-41ace101db91", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494eebc6-a146-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675155876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155876, "uuid": "de4f9a8d-a041-4325-9c8d-816ac31e5227", "comment": "Malware payload (Mirai)", "value": "e8170c658b5928ef296aad932c68bba2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155876, "uuid": "bdd01964-9e3a-495b-9fab-4e08581cd170", "comment": "Malware payload (Mirai)", "value": "c1c35750c74328de2036f48951d2ae2fd94dfddc5d7026adb0c1437d5685ad1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155876, "uuid": "9039b3b0-242b-46c8-a919-8bbe7639c88a", "comment": "Malware payload (Mirai)", "value": "3c59aab1a9282e584ac3acbeb85795d851857961", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155876, "uuid": "36fcdde9-a8d3-40db-9a1b-8246f545d6d8", "comment": "Malware payload (Mirai)", "value": "8ca6df14cf524a810c75281c04173e314020a755cdc41bcbb2f55f71dfe88eb2e39fbdd3452e8639f0b6b5573a391eee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155876, "uuid": "63542250-2394-4771-bc9f-eabfc0948ad6", "value": "T174835B36B9762E26C0D0A43E11FB4B51B6E15BCE36A8C65E7D720E4EFF606406403EB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155876, "uuid": "e511630f-2dbd-4c0b-826f-2b2a73c47cc2", "value": "1536:/1Ri/8c/Ku5qS0shBB11B7MlvLSRbQpmbaWuFWfoQPB:du0sb1aYctWfo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675155876, "uuid": "6daaabcf-3b48-4d85-915c-89f425cdb438", "value": 82944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675155876, "uuid": "e73a98ea-fa74-40fe-bda3-aab0300db5cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155876, "uuid": "d92041c7-4318-4f84-9ef0-4d568ef6b090", "value": "e8170c658b5928ef296aad932c68bba2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "296300d0-a10d-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1675131341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675131341, "uuid": "a32462f1-1236-42a2-b1d6-eba767035b60", "comment": "Malware payload (TeamBot)", "value": "76305c74cf0c512125d056787970b213", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675131341, "uuid": "65272788-e5d4-4182-9333-1f10a01a66d9", "comment": "Malware payload (TeamBot)", "value": "c27ed4555385c5b9496771fae987837d25d41758b49f5e8e16114465b796d3e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675131341, "uuid": "84bac839-27f4-415c-bb3c-ed364b235ef7", "comment": "Malware payload (TeamBot)", "value": "814983d00824ad84be6522d3d6c23f39c0ca09c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675131341, "uuid": "5a1ea9e4-96e2-4f19-b0fe-c636a228bf05", "comment": "Malware payload (TeamBot)", "value": "2a2db7bfd6b380ac19de25ec1d32747722ea6606cc4920f0e69f5a724a382e6178efbab3c890176822dbc3bc962568ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675131341, "uuid": "aa28f63c-0a5a-43d6-868f-949554e5967c", "value": "T1B404E019B940C433C45291746934D2517A6A79326EB9DC077B873BFE2FA12E13B2E34B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675131341, "uuid": "c63fbbce-550b-4ecb-8414-5b494fb5b861", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675131341, "uuid": "1bfa27b2-4108-4af4-8b33-ad140fbe1bb5", "value": "3072:JjRHGGyGiLM6GAwMt52wEaq24/Fv5A8L3bp81z1EgInL6kELyjoIQ4:mLtGCpEYGFRAk39iitnL6PysIQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675131341, "uuid": "b527ac1e-c237-4c0f-89d2-f11409703eb9", "value": 173568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675131341, "uuid": "3c65e5d1-c181-42d9-8d56-356576eaa352", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675131341, "uuid": "ca937f07-944a-4df7-a85d-76ea858923b6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1826059f-a13f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675152787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152787, "uuid": "9aa90bfe-c27e-4203-a8f3-10a6c74f98db", "comment": "Malware payload (Mirai)", "value": "799c60b1f1a98686c9e566d3c7503dc9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152787, "uuid": "0cab5926-717f-44ea-a107-9e0d9e52909a", "comment": "Malware payload (Mirai)", "value": "c37961217b3fbd3f15dfa8704f7552d142d578c62bebd2377c8b6ec675221bdd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152787, "uuid": "4cb70e15-87e0-40de-8f7d-362aaab96d52", "comment": "Malware payload (Mirai)", "value": "be3bba009e812c28b5aea52637a7d93e4900fdc3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152787, "uuid": "a222b075-30a0-4b40-93af-ac330c9b7813", "comment": "Malware payload (Mirai)", "value": "bb7a7fc3a9c5ce33ea99815cd81227b3d91714b242cfdb7144935bf56a1f50e108db9107245872b4bfb1ff5cc24ef043", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152787, "uuid": "1fec6933-f285-4340-9985-fdf466e72261", "value": "T12F336C36E029DED0C6960134A4E88F751F03F1C883536EBB2AE546B2645396CFA19FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152787, "uuid": "66ebe301-ec8a-47a0-9afb-95785cebe665", "value": "768:Oa2vU7eng2qGJert7LrLMU6fgatQh+YbT/9+m3CZQoV/bnmCozw:Oa4U7G7SvT6ftBTm3KVrmCo8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675152787, "uuid": "ac0343b1-68d0-4297-afa0-5a056919f8c9", "value": 50168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675152787, "uuid": "c0270eb3-25c5-41a9-a11a-2e094b8ddc2b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152787, "uuid": "d153ad3a-92c8-47e8-b8d5-9ebd58e57c3c", "value": "799c60b1f1a98686c9e566d3c7503dc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da5f0137-a0ff-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675125625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675125625, "uuid": "c19f3d76-e617-408f-93c2-7dd1ce98a438", "comment": "Malware payload (RemcosRAT)", "value": "b4baab930a798fe4622b535b92c345f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675125625, "uuid": "f4f61e62-a7d3-459a-a5f4-379de56e4f20", "comment": "Malware payload (RemcosRAT)", "value": "c4cd277e81aec420cdf23a0d5ebff50b0d64dd9c6b3b1942567c263032f64deb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675125625, "uuid": "14a28132-a10f-41e2-a42c-bba811b4f905", "comment": "Malware payload (RemcosRAT)", "value": "05de8839222f6ec3d8b6dc9d30e826110f51fae2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675125625, "uuid": "cfddc060-dbe3-4bc9-917d-6f10fe182642", "comment": "Malware payload (RemcosRAT)", "value": "7086857dfd7d7ec1b01bad741b20dff4f3d5d16dcd3720daaafb4ab85188c8343b8eb8f751385d7043693ed2e994ab56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675125625, "uuid": "13e504d6-415c-4417-bf48-991416076ec4", "value": "T179F4AE1372E08477C15726788D3BD7A94429BE346E34B8593BE0AD8CAF3C7C1752A297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675125625, "uuid": "319017dc-513b-451a-a1b6-ec11454cbad5", "value": "8cd3e7faf6356e617724404653517987", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675125625, "uuid": "75187ce7-795a-4c85-ac13-82ef63b11504", "value": "12288:sncOtoAFbkyA1KFW5A3AImxsfKutdiQkBkG0nFEAoAYyNG/xhIL/2nSrJWIXnyGI:sn/tJ61OW5AQIl166G02aG7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675125625, "uuid": "e08fd4e2-891e-4865-9617-04d12bd754df", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675125625, "uuid": "3ab323d5-2d14-4be7-aeb2-ebd59ad85632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675125625, "uuid": "58221193-6137-46be-8ff1-ec6686b5b693", "value": "b4baab930a798fe4622b535b92c345f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1559150d-a11b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Pony)", "timestamp": 1675137321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675137321, "uuid": "e8ceed2b-3a45-444c-b701-bc7fbb301ad7", "comment": "Malware payload (Pony)", "value": "e211e228d9ace4f1bd6ca56353a48012", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675137321, "uuid": "141b354d-0e8c-4306-98e1-84c451ae1b7a", "comment": "Malware payload (Pony)", "value": "c4e0829559c2f0f18887e904e1be5ecfed1f9db99f9fba45744e975bb735f50d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675137321, "uuid": "eb8893f6-b382-49df-b7f6-04499c409bbf", "comment": "Malware payload (Pony)", "value": "4009dee2db83677160ce04ff6c32e4fcf3bf67f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675137321, "uuid": "667e3c6a-cd9e-4b72-a3a7-1a66e76a7d2e", "comment": "Malware payload (Pony)", "value": "5d02ee5994c183e6c6d1021447c6a33f0c56b24dd9981fa4193305c24840d706912c816d100f05883e3a40ad26be803a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675137321, "uuid": "962e9e9c-1092-48fe-bb14-b09fa802a0f3", "value": "T1A094E152AC553BD0E382CE704A7685E5A71F3C1E8B85ACC67E1D7E40EC607D1A772236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675137321, "uuid": "63bf1f97-d5b8-4b83-b84a-c8a66c293b57", "value": "b895162bdc69c08877fb12ac5c313f47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675137321, "uuid": "0c082a14-004f-4ee9-bc21-c55652110180", "value": "3072:Y9NFDg8JIdeyB+JFJcqiv8t5QMn7fiNxGuwGnkzBP6dv41E1Iggpof:VjUFJc/8tLn7MG6nCP6dCE1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675137321, "uuid": "79e310aa-7bb4-479c-bd7a-20395e3abd35", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675137321, "uuid": "676b2111-0b56-4075-9813-6ea23cffc38e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675137321, "uuid": "a2a559c7-64b1-4ef9-b261-16a783fb3d58", "value": "C4E0829559C2F0F18887E904E1BE5ECFED1F9DB99F9FB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98cfcab1-a1bc-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675206690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675206690, "uuid": "7244914f-f6b4-466a-8cc9-7571eba6794f", "comment": "Malware payload", "value": "efa711b79241d525fb41f642fd208c24", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675206690, "uuid": "c16fb39d-f639-44d3-b2c0-e273bea0e82a", "comment": "Malware payload", "value": "c5889835785cd95c18599999e00fe0a6a3a3062fda58f2044b7ae479781d5dfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675206690, "uuid": "8abe5223-2d97-410a-a8f8-16b7d32314ef", "comment": "Malware payload", "value": "2a9b2c79e2cb592604cfe5fa48daf5a9c34eedf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675206690, "uuid": "f0d2b306-4339-490c-8901-1512f827137d", "comment": "Malware payload", "value": "18770645a8dd74f251d2e1b5e47b51d0a30edfa68b1e9e83b922a65f82fcad78ed15c8b7dbf9ec7a39b8dad884764de3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675206690, "uuid": "74ba79cc-f668-4be8-8d4a-8006834e5e49", "value": "T1E1548EC2B6B27C62E92187319E1EC7F47E1EB5524E58B3E6121B9BDF15B01E1C6E3201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675206690, "uuid": "12f33b19-6bb6-46b7-a6f1-a7d16b7249a6", "value": "d84aba910fd98bff40c3867e1dd713e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675206690, "uuid": "fa516252-b173-4d19-871b-17332eaba3b1", "value": "3072:npuezkLteqRsJaEOlC5puT+wZQVj0Ggl6iDK7Lmqvf5mqPUx6WfQz86Y23MMPgm:gezkLU7JaHgy+zlbg8o2LJmqMoIW8MV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675206690, "uuid": "731a623a-5fe3-4fc7-a895-768aabda6c73", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675206690, "uuid": "515875a7-0a09-4f46-9b1b-9e5f6b05051c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675206690, "uuid": "a4d531de-c6fa-4358-8d0b-1704cb6822c3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7434a774-a139-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675150365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675150365, "uuid": "d3f79634-ea0b-4227-b961-44755560ee9a", "comment": "Malware payload (RedLineStealer)", "value": "e83e730ddeb61cd657a6a5ec4f58eeb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675150365, "uuid": "6b65656a-db1e-4826-b11a-337831be2441", "comment": "Malware payload (RedLineStealer)", "value": "c5c966c2ceb08999a937cc534b33246fe457d5ec32d0387edaffbb88b423a629", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675150365, "uuid": "a0d0a8d1-9634-4827-b337-b1c36cc9eeec", "comment": "Malware payload (RedLineStealer)", "value": "b120476532ff2c3442d6685f4377f003ef177dd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675150365, "uuid": "0954fedd-46d3-45a2-9aa1-f97299d3f694", "comment": "Malware payload (RedLineStealer)", "value": "41401aa2cedbf693bdd9d768f66dc66eff7e4cbee75f6537d209e9630014284d6da1b417b9650783ab9405d0e0be7068", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675150365, "uuid": "f60b2a89-8702-4612-a1cb-f45df375090f", "value": "T10C84AF02B2907C40F9618A768E1EDAE4F51FB592CE18B7E623189B1F25F31B3D767211", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675150365, "uuid": "872a70f2-b056-489a-b409-900ab588a950", "value": "a2c8bd590ac12702f85d4107db46f8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675150365, "uuid": "d3ed6875-1ffb-40ea-8220-0f7c2c6582bd", "value": "6144:hHvxLTXtG8J3MJnF05qH5U4GNgCXu0kGzPe5UJLe7VvojcJjnm7f4VkhK:5pfM8J3MJnbZtM1XIqm5h7scNmzOk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675150365, "uuid": "afea007d-891d-4dcd-b09f-d249346903d5", "value": 400384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675150365, "uuid": "c34a4fe3-f49f-4f6a-9455-e86d9705e4bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675150365, "uuid": "7809da97-bfa9-420e-b929-52514fac1409", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6336db1c-a155-11ed-88f6-42010a9c006e", "comment": "Malware payload (zgRAT)", "timestamp": 1675162362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162362, "uuid": "694e8737-09be-4ab9-b8df-ea0ce4132b9d", "comment": "Malware payload (zgRAT)", "value": "1543d42d973382b495b07ec6212c4314", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162362, "uuid": "c613713f-959c-49a0-91c3-30897f3fec68", "comment": "Malware payload (zgRAT)", "value": "c71cecddf83076d976b03096b4ba4f07a1cf9a6e7c1779550f3637653909cefc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162362, "uuid": "f0c84235-8949-4275-983a-426fdf4920be", "comment": "Malware payload (zgRAT)", "value": "a409e18fe59d5989907d9fd92c2f6517dc7d1c28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162362, "uuid": "93ffe774-70ed-4e33-9b64-1c2f1b954bf3", "comment": "Malware payload (zgRAT)", "value": "fb32ae755921d8a4a63cb9656bfa99c81b932e597fb9d1d4a5e1618be046940ff023ca8ba482b58b80d7faadf62a700e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162362, "uuid": "8fcb40f6-4c24-4eb8-a6a2-960f415964a9", "value": "T1FB35EB3E1CBE123B91A4D6AACFC58827F444E1B731226D36A4D787998747D8329C317E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162362, "uuid": "44090266-77fc-4edb-a5d6-777e4de56873", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162362, "uuid": "00061d7e-1a3b-48c9-ba46-62619b8b563f", "value": "3072:fk1spaSh2ocTms+ltHv0YH2N1Ef9s5Lb5JY6ZsfRhvCFdJrfyIr2x62xbARExwuX:Gs4Sh2TY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675162362, "uuid": "b20bbab7-86d9-4f97-b795-9fdd2edf9947", "value": 1072640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675162362, "uuid": "9f4a8c37-1b6e-4d96-8ce1-bfa7e923e74d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162362, "uuid": "8adab132-e911-46e4-a10e-0f72625bb3b5", "value": "CCleanerPro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097ec281-a172-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675174667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174667, "uuid": "ac2b0163-c2b0-4f9c-8f8a-b415c0281969", "comment": "Malware payload (DCRat)", "value": "45a2e59aebb679979120a1ac11d1612a", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174667, "uuid": "77cfde42-b9b6-40d6-9758-b2267c9f958f", "comment": "Malware payload (DCRat)", "value": "c8888442d54e17743624d1f50395790864cda90a703be1d1a42fa65568c3da7b", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174667, "uuid": "779c2b63-5761-488d-b535-fe2ae94f0ce1", "comment": "Malware payload (DCRat)", "value": "072e4f3205bdd6abcda733aeb433ced185ec1b97", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675174667, "uuid": "93b4fac9-df20-4639-b147-2a8dea043c17", "comment": "Malware payload (DCRat)", "value": "236b66c51097aea850591d2afe1a0a71f0618f114de382681f8d345edf8c2e2cae26933e114134d066496c0eea6fa39f", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174667, "uuid": "67b3edad-28d1-4302-8a62-4dad71207db0", "value": "T1F3236D0037D8C536E2FD8BB4A9F2E240C675D66B5903CA996CC414EA2B53FC596036FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174667, "uuid": "3cac30d6-de8c-4924-8806-5d484ad61c67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174667, "uuid": "ce5920b2-c44e-45a9-91af-ffdc3bd64d1b", "value": "768:QVboNq73kmvcnWgxX1jQcPowZYgqX8YbbgeCOVW4FEgKPJcZVc6KN:Q2NIIsc7QzbkL41cJcZVclN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675174667, "uuid": "e9edfc25-3ad6-4b2d-98f8-37aa74738345", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675174667, "uuid": "152a4c98-fd20-4063-bc85-183181a98bec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675174667, "uuid": "c6714c57-65f0-4111-9626-fb750de5b55e", "value": "xjJknft1KPmB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7592f92f-a1c1-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675208779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208779, "uuid": "9025daf6-0f06-4075-b184-723a1513200f", "comment": "Malware payload", "value": "035f0155d8705e9cc9dab2f93f39f3f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208779, "uuid": "a3aab880-e4f0-4d6f-a722-1c4e628ce217", "comment": "Malware payload", "value": "c89376a725a7aca8ffafc3f3d43e0ab163f373f2b23d888c8cd6d35e343e6b5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208779, "uuid": "8ee83614-da1b-4195-b232-d1b00c911d20", "comment": "Malware payload", "value": "60f6f436199ac89aa88ea5e69712c1efe57f72ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208779, "uuid": "720fe7be-f9bb-4b62-99d5-baed9ea7e6f5", "comment": "Malware payload", "value": "01257aca8f228724df87415a1e44a76af6f566dd20101b127025f63b9b9667bed7d73c9abf761463a811cf9ea9e55fae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675208779, "uuid": "fbae3d82-6645-4b63-9362-1cf211490962", "value": "T12DA533C3E5A20576E0E16B7C2C69D3082EB77EBE6834020E256EA71F4DE3B66414C757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675208779, "uuid": "0f991ab4-ed3d-4c05-bf16-5ede941fe854", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675208779, "uuid": "fb1b848b-3a4d-40fd-8f44-ab707b48258f", "value": "49152:C2n8wo+qaZetbJfDpXiPiEe/yUuzkG5QxyS+MLCgv2MR:d8aqaItbJfViPWyxzkmQEnMv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675208779, "uuid": "25f0e6a5-c2f7-45b4-8664-1eab511df218", "value": 2197779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675208779, "uuid": "a5134ace-78c4-4fac-a52a-45933dcc8dc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675208779, "uuid": "d7ca2ac4-75f8-4804-8ce3-66e485a1cde3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "655f461a-a13f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675152917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152917, "uuid": "b289ca7f-177a-4b07-b638-81e87b3e2515", "comment": "Malware payload (GCleaner)", "value": "5d3d064c57558268f7825f7e3942a370", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152917, "uuid": "555bd5f3-a61e-4dcd-bff3-56298fc57060", "comment": "Malware payload (GCleaner)", "value": "cad6e6757b2a6c18c9c5911d537ea8c17c2b07b6e4c9074bd0dd4b71b22c95c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152917, "uuid": "ea441f1e-6cd0-440d-801e-a5dfc8a29014", "comment": "Malware payload (GCleaner)", "value": "fad9d9e3c03dede2fcd9076852268413dd13aff9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152917, "uuid": "80571d8e-f454-4bdc-acfe-b61dfdd5d2a9", "comment": "Malware payload (GCleaner)", "value": "d327e4c39bc5cc5a2e185fba3be89e4c2730687f73ca7088f971958341b5e083f6541438f853a467d180c2df6950ae15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152917, "uuid": "0038fddb-20ec-40bf-b258-e7413bcbb418", "value": "T1FAA53343A1328831DA13663A2D32B162BDA67D6731785A83F50DF71F1B073745CA936E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152917, "uuid": "61eda16c-644f-4e55-a884-64d72674051a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152917, "uuid": "c33374a6-fec3-447d-be0b-8a299424bc94", "value": "49152:C28sQpAx0pOKAEmM4yeQklsYv2+tLdGEfv77CNmLCgv2MR:d8sp2GM4BH2Qd9n7Wgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675152917, "uuid": "037fbc82-dba7-4bc1-8a61-c4205535e09b", "value": 2176659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675152917, "uuid": "0333c052-68a7-4aa2-a82a-b14d3ac305c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152917, "uuid": "28c188a1-0313-4ab1-ac37-da6a7b2c00f9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb1a9ad-a152-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675161306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161306, "uuid": "fe1da9e4-117a-4974-9a7c-c2d9d899148f", "comment": "Malware payload", "value": "54d14f41721532553da4fc079a172c5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161306, "uuid": "ec253a0f-309c-47bf-bffc-8aee7be228e0", "comment": "Malware payload", "value": "caed1d4fd191aa33b838fdd823dc14ac4e47fe68cdb5f95c49f0fa3564b32548", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161306, "uuid": "9f02fc24-3164-46db-b0bc-16e2c1a0251b", "comment": "Malware payload", "value": "c3b566a4ef715302224709b481b0ce794037e255", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161306, "uuid": "9916c1c3-23cd-4436-b717-feefa781eb07", "comment": "Malware payload", "value": "47c8672f4b9f2062d9c363598329e75371ff8657b335564867ba7fe1bb8a24b02f426c7d06ebd8145e6eeecb9d13ccf3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161306, "uuid": "615ee78e-6784-473e-a5ec-bfac7cc1fdac", "value": "T1A6E4E53D297617D6C338F93186E58420B6EEA1923703F969DDE61AC14F026C2BECE51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161306, "uuid": "50ac9b3c-c262-498e-a0e2-385469f40994", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161306, "uuid": "97742d9d-0a55-4767-a4e3-1bcdb0fa110e", "value": "12288:ook+C+2SlLVseHKNTn7tunA+/kSTljwXcd7wJErzqAKKQqu+LR5FxOhdU9U9pZ22:PjseHKNTn7tunA+/kSBKIiWOAgh+LRUg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675161306, "uuid": "4104c9fa-a8cd-482d-b678-908c1e3bfc86", "value": 717824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675161306, "uuid": "08ba1865-aae1-4cbe-b773-8099c3ed5015", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161306, "uuid": "db83a2c8-6a20-4791-98ed-b8bdffc5ed6c", "value": "DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd62fa7-a13d-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1675151992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151992, "uuid": "3cb91285-b839-48df-be50-9f65c05e73bd", "comment": "Malware payload (DarkCloud)", "value": "f1820b1528bf51f685da8243fe4527de", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151992, "uuid": "393c2d23-2336-44ba-a560-0976c4128c7d", "comment": "Malware payload (DarkCloud)", "value": "cb2e60eaf57d3b65b82994a5d107b664e61ca64534a12ee2becb608aae2b5fa1", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151992, "uuid": "f2f75b80-4fae-4fd7-98c1-5942922f7913", "comment": "Malware payload (DarkCloud)", "value": "c20ad36fb268942b253b59c1bc9407ec5a0a0146", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151992, "uuid": "b0535f18-594d-4c72-8cd7-c91e6d1c2238", "comment": "Malware payload (DarkCloud)", "value": "f9ab3e68c4959b2fb003fc9b7a2304dcd848a3f51c02adbc5dccfa86ea0e67278025415e8e9f033b7bb0cf80d303d0e5", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151992, "uuid": "8a2d32ce-cdfd-4ab2-b00d-cddc9e0f7409", "value": "T1B40523347616B00C55F3D7B52C0E24EC6602E1F7A532A9E9C94EB1FA11D46FC8AD263A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151992, "uuid": "41d93e00-7653-4be9-ac0a-188dce2c68ba", "value": "12288:SplsH4iWrHeviaI+5x98jQnxznAbQPxIYvfQrghT6s20XV44BNkQ0XPxrTyi96Y:Sbe4iWrd+ppxzAkOkH2QawAPNP96Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675151992, "uuid": "b5e5d1da-1004-4fe4-adb4-64a5d03681ef", "value": 828722, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675151992, "uuid": "d8e2be96-2645-4b9b-b084-200720f4beca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151992, "uuid": "23ec3888-416e-4b3d-a826-f10739eb4b7e", "value": "Bank details mentoned in Invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5028335-a149-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675157426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157426, "uuid": "60ab594f-725b-4296-9339-f20e6f3b6412", "comment": "Malware payload (GCleaner)", "value": "1b89a0c01fb2b18475072e9b6dc328d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157426, "uuid": "1e2bc5ff-ee84-495b-b557-26d4d400f3d0", "comment": "Malware payload (GCleaner)", "value": "cb30a6369311589ae1b742ca706bf920c08e83847f23ea1eff92223d1a32a564", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157426, "uuid": "aa7c7cbd-ff7b-4c87-a36b-450ce6cc5bb6", "comment": "Malware payload (GCleaner)", "value": "d40f495528b623a61d571abdeb94d195d86c64e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157426, "uuid": "2d4cc322-8133-465a-8374-1c9d8254d166", "comment": "Malware payload (GCleaner)", "value": "ac1144f5bc1f4cab32a0b94c35aaf0dc91a02b4c8caffde248eeab0019436a9a646a48664378bbfe885d7b14d89517b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157426, "uuid": "127fbaee-3cc7-406f-9698-a278d5a6430f", "value": "T1B4A5338123655172DEB186764C28CE8B663FFC8730309FFA35A8644F2F1B2E35D5616A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157426, "uuid": "942185fc-a5d8-4f42-8397-8ae492b9822d", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157426, "uuid": "4f4a3f66-5650-4c3d-9fac-57014c2d4b56", "value": "49152:C2se3qK8woj1HvcLP55pb1eYaDeLCgv2MR:dsefv5LP9QD+v2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675157426, "uuid": "42c7706f-a5ad-4d20-b75f-83b6664f067e", "value": 2179344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675157426, "uuid": "81699474-f82f-490e-a90d-ad5c004800bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157426, "uuid": "719cbc09-0d1c-42b2-9e01-d8b780a1fab7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f141af7c-a1b8-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675205121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675205121, "uuid": "e7cfe605-485c-4639-b0d2-2a026a971a53", "comment": "Malware payload (njrat)", "value": "f0385d237cafb55c6479ab7c7a820f29", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675205121, "uuid": "0ece8749-5077-47e5-b86f-18512241c92e", "comment": "Malware payload (njrat)", "value": "cb58db93da3b638a36bd51134558126d9f5e40bb78af788d314f184e82bae2ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675205121, "uuid": "673daeef-1f9f-416e-ba9a-256038a03fc5", "comment": "Malware payload (njrat)", "value": "a3f13671f6466c5846c379d2e182a832c76a9f34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675205121, "uuid": "e8b03143-3215-48f6-bc73-78f157f64b23", "comment": "Malware payload (njrat)", "value": "5e17d17bf83540143e113f15c36d17b1f9d00119c978ed917b52be9e4e56b613bc6eebc812fc1a715a668af3472de736", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675205121, "uuid": "98b4fb88-4874-4cee-b763-4251963ac8c2", "value": "T119E4F217796B2660C6B9F1FA002C89E0A67CDE401010C6E93DF7BE5C797952FEE9825C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675205121, "uuid": "a4a902cf-ef97-442a-9589-21a202861fad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675205121, "uuid": "36234870-4fd1-4f62-9f15-7d3524bae88d", "value": "6144:dsFo5Mf8sPdCCOv8XmTjkLm8nfsxF7wjimDjeJgT9NLF:d1Sldq82vkLnfOOimXmm9Np", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675205121, "uuid": "5fe5fbc5-9392-426a-aeaa-874da7e80202", "value": 671696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675205121, "uuid": "1d3ecf6e-c1ce-4b18-b6b0-11ac70d87154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675205121, "uuid": "6c9f86e4-f4a0-4f97-9345-8de21dd314c3", "value": "CB58DB93DA3B638A36BD51134558126D9F5E40BB78AF7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02640706-a155-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675162200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162200, "uuid": "52a03ece-40c2-4e64-8551-bdcd38b6e95c", "comment": "Malware payload (AgentTesla)", "value": "d022f157df3635ee28fc9c51f029f287", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162200, "uuid": "7692cf18-294b-4e8c-ab34-0146f28b9544", "comment": "Malware payload (AgentTesla)", "value": "cb72d51bdc31dc4707480514dfc0cab72dba8546c585d1f11435837a840ca272", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162200, "uuid": "36b64b0f-4bf7-4531-9e79-a135d69cf9a5", "comment": "Malware payload (AgentTesla)", "value": "6a297e66fa9603c22bb84ab6bed5347543ea1a50", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162200, "uuid": "4067ee65-d2c0-4db4-909a-f4ec296b1079", "comment": "Malware payload (AgentTesla)", "value": "8b8579dbaca94ee1bb7f282df5d3a14702424ce99a0af05e10db1a90948a80d670f162fe10e4bc2284a03c93b115600b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162200, "uuid": "469aee96-0019-4542-b55b-6926f8029a93", "value": "T10462D08B1436060CD44BFF97C5A874F9E12686228A57C65DFAFF5651B0884D7B8A7043", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162200, "uuid": "df3ba203-ca3b-4a81-8be2-461e0fabda81", "value": "192:W5XLFvEaTuO5ZUTTYVK5g2T1YALyGJ9NLf4rBEGGfX0HypSPUeNVSiI3IS+XCsj0:W5J5ZgrS2GGR4affXtpKJSiI3P+4qU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675162200, "uuid": "360f2b18-4e1a-42b1-bcb5-cc2c55e09e9c", "value": 15485, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675162200, "uuid": "485d2ae6-0af6-487d-bf82-270e0a586e60", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162200, "uuid": "b4d6813b-ca85-4ac2-ac56-b96beb9d52ca", "value": "TT PAYMENT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f715837-a1aa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675198863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198863, "uuid": "e5fda2ea-9137-4581-ba97-967a9d702c18", "comment": "Malware payload", "value": "fb699496e64fd56a1cdbfd0df89dc530", "object_relation": "md5", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198863, "uuid": "3e6d8a65-0c5e-40b4-868d-de9765159c6b", "comment": "Malware payload", "value": "cbd7136dcdc7746124d93dc05d461ee5def7fc1b498183f453d4cb0c3b4926b6", "object_relation": "sha256", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198863, "uuid": "67064308-5c8e-4d2b-9da9-7107f9efc0aa", "comment": "Malware payload", "value": "b67e4d84c8163b8c079e81c2295ace6701b1cdba", "object_relation": "sha1", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198863, "uuid": "47c01369-273d-40b6-8dea-f25e006785bc", "comment": "Malware payload", "value": "55d9b61cbddd056a8c5c39e9385637ef672c2643f496d9784950edd3c62b8fb0b03155d4b7944b33f930e9642847346e", "object_relation": "sha3-384", "Tag": [ { "name": "BB12", "colour": "#1DF146", "exportable": true, "hide_tag": false }, { "name": "OneNote", "colour": "#51BA35", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198863, "uuid": "1a9fc14a-38d0-41a6-b701-96f8e9d0222a", "value": "T1E5D312695E2F5032808DF6979D08A4A5C1CA93D2D90C903279CCF496E696CB2FD4DCB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198863, "uuid": "9ef69d43-a4de-4d2a-8238-0acb6084d5aa", "value": "3072:JWCgfn8jHrXh2LH9gVlImTn2fpMG0w6R2DHvo5nxykCO+adOD:JcniHrXyCVqmzOMMKIHoxykB+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675198863, "uuid": "629aef8f-af3a-4082-8c97-7df0ae628623", "value": 142620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675198863, "uuid": "849cbb08-ba08-4d12-9e8e-40b1bd079d36", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198863, "uuid": "f88f9775-b0fc-4aac-a2cf-e5bc60f51f22", "value": "408709.one.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6127171-a106-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675128678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675128678, "uuid": "95135e35-7b35-4552-8dae-ec76c1a2cb0a", "comment": "Malware payload (GCleaner)", "value": "5a534f81f5bfe28a00948eac9983624d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675128678, "uuid": "602589b8-5508-49a4-a143-f08df0e4c622", "comment": "Malware payload (GCleaner)", "value": "cca14204a00da16922862b51a6d100d9c0664162549e945fd88f92e24882d96c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675128678, "uuid": "43afbfd4-c598-4fe4-904f-bc8aed673692", "comment": "Malware payload (GCleaner)", "value": "d96d65c41ead00f6261fb64ce3cb87518bbc2a16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675128678, "uuid": "81f22827-4017-4422-b9f3-1eb8e3d00134", "comment": "Malware payload (GCleaner)", "value": "d8a33b58ae92f5ddf850e46c6d7d5b6d5a7277f56f41692d68ce86ae329dd23e9887253a81c9b0fc248a1c2d7ef1ebc9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675128678, "uuid": "7898ed35-3765-4fd3-8a96-51ad951b1467", "value": "T185A533CB86B5CA7AEA323B711D311D04E927ACA371B99251315CBD8B0F3B3718587366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675128678, "uuid": "8ef7beb3-146c-4486-8651-84fc7c14ab9a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675128678, "uuid": "252c9648-c019-4d29-bedc-9fb46945b465", "value": "49152:2csI/yxznYmLp9OXKU2qcJwCtyvl5QSgWviq/6puTO7EQ8UqaBuLCgv2MR:DH/aE6qKU2tJwCtyvJgWKB+pMAv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675128678, "uuid": "c164ee1a-75fb-4e4d-97bf-f2d0f1d524cf", "value": 2172895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675128678, "uuid": "dcbe1972-dbae-4f92-bf2c-9d559d566373", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675128678, "uuid": "07a2499e-dbbb-46f7-93e3-fc3c54ef2fed", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a1457b-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140652, "uuid": "1261b93d-c68d-41ed-a1af-ba3257f58ef2", "comment": "Malware payload", "value": "99d84430aa3e2b2dee4aab8c38ec87d8", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140652, "uuid": "28252313-3cc3-4bde-abbb-d23b84b2a03c", "comment": "Malware payload", "value": "cd5e63ea5d1261b1d575ff4654a7257ac7413053cec537a1db2b860b0939e645", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140652, "uuid": "c7f9e3bf-efad-4d5c-95c0-05ae4355a607", "comment": "Malware payload", "value": "7dff1e851d241dbe42e78aee335a37af4c1afa24", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140652, "uuid": "4f55c0f1-6585-4b28-8995-83815bf4d2f7", "comment": "Malware payload", "value": "c3caeed40c633bce8e24a6e88197fba656cf7b947937d7b86c56833266c969e1d77d7c9cd2ce026a622a56e3c52a5f53", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140652, "uuid": "63525725-0b65-4306-a9a6-566f9ef7798e", "value": "T118363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140652, "uuid": "9a25e2ab-6e69-4fcf-8455-db6f9617c316", "value": "98304:3v4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXP:3vpvFa+g8RWLdPk/84tCEr0RtNiC5eSa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140652, "uuid": "ca630aff-a838-400d-b6e9-fbc432feeeb7", "value": 4992000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140652, "uuid": "71fd1e75-a70b-4298-8273-be10e1974d39", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140652, "uuid": "b6c954e6-1acb-4cb0-b320-aeaa8d99731e", "value": "cd5e63ea5d1261b1d575ff4654a7257ac7413053cec537a1db2b860b0939e645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dd0918a-a16d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675172607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172607, "uuid": "5e7580a3-1e92-4867-8e60-9cc63e871ff7", "comment": "Malware payload (Smoke Loader)", "value": "bbad8ad00bda4c149153ec4505114ed8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172607, "uuid": "1a4f32ed-d974-470a-9733-08b3c56b38dd", "comment": "Malware payload (Smoke Loader)", "value": "cddadec911ced7816af3f731cee06e5962b51e049bde4cd4c52e41980925ae70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172607, "uuid": "29d8e2a7-4448-4c8c-af83-3b1d7fc6edc6", "comment": "Malware payload (Smoke Loader)", "value": "462a806f38cce9c1a31c9699bb983c557907a459", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172607, "uuid": "090847d1-e27a-48ca-afa1-a125abd53198", "comment": "Malware payload (Smoke Loader)", "value": "a3d56c19ab68b05a18296c99a1c0564eec3d18f8c22e7dc8403c5de766abeff19f803fedecd19126454169df0f5a804a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172607, "uuid": "fac5ccb3-eff7-4b8d-b86c-0322f4d3f3da", "value": "T1AE549EC272F2BC62E92286399E1ED7F8751EF5434E19B366121B9BDF1DB01E1C5A3201", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172607, "uuid": "e2c022e3-8562-496c-af83-b953432e6104", "value": "e73db8d7bd9f9f6b2076d026a8fb8fc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172607, "uuid": "51226a8d-54bd-4292-b7ba-384909065758", "value": "6144:ZSoNCLKFlibiijTgCa8lcll9mqMoI38M:BQeC26HvqMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675172607, "uuid": "02578d45-fa88-44bf-a08c-22ad573dafa3", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675172607, "uuid": "0f670670-6ac5-49c1-9063-0eebbef494a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172607, "uuid": "f711f427-fa20-4571-be8d-a935bde42089", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e046b4-a196-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675190153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675190153, "uuid": "439cf706-6be4-47e9-b24b-12f65e232587", "comment": "Malware payload", "value": "a379695ed55c2c69361a67fcc90b7495", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675190153, "uuid": "eefc5364-1413-4001-b9b8-8cc4d5e4ae72", "comment": "Malware payload", "value": "cdddd240d432b084b2c5cbe6b4a89b39a33d97840630210772b7758ec87dcacd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675190153, "uuid": "b8a99679-c4e9-4b3d-bf71-98977ff4ac24", "comment": "Malware payload", "value": "f053f1917096b6d576339f3137e07f286c89b183", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675190153, "uuid": "34877ad6-8645-4488-8187-ac7adbc3b053", "comment": "Malware payload", "value": "75cab9b97df79260b7408b2d60ae2733d692bfb6113645a20d38b3acdd1daa0d3ee78c0083dd5edaeb9935ca0dd06974", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675190153, "uuid": "ab09b9b6-48ec-4169-ba63-f4ebc9a4a407", "value": "T17F176C47BC928583C9E43637B4BE81C833B616B99797661B4D06CD34BABF1DA0E36314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675190153, "uuid": "764d2211-687c-4335-b7ca-ff7333c58fb1", "value": "196608:SNhr300+F/3f/9rpptw+x/OqF9xIZMofMrq:nppqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675190153, "uuid": "3368d434-41a5-4c1e-b0b8-7e554671d2c0", "value": 19988480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675190153, "uuid": "aa09fcd5-ce8b-4aad-aba1-9314fee8f6b4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675190153, "uuid": "f16588ad-d16a-473d-a047-c82596a6cc9d", "value": "cdddd240d432b084b2c5cbe6b4a89b39a33d97840630210772b7758ec87dcacd.elf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8898efa7-a151-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675160707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160707, "uuid": "49e712ae-492b-49ce-8099-51ea7b39e971", "comment": "Malware payload (Mirai)", "value": "3f3f4441319bf5afdda997cead6d7cf6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160707, "uuid": "c1dc84ea-c7ba-4a72-8d9f-5faaf8ea7608", "comment": "Malware payload (Mirai)", "value": "ce15801ea275b9cff93757f30ddeffc2e0488d486fb7bdcd67f6587ac80880cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160707, "uuid": "52185c7f-6b03-411c-8589-a41402bb3852", "comment": "Malware payload (Mirai)", "value": "6ce2fda0cd1dceb0c78a63b8ebbe23036c5e60c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160707, "uuid": "cdf5762b-357a-4fa4-891b-4715e9cf23e8", "comment": "Malware payload (Mirai)", "value": "69a2559cabcdd7180b2a5be1da88dd0f779412097ddbfed3c7e0b020dd5c1bdca39953380a7c3d34d511f7bd9f3a49ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160707, "uuid": "369cdaf1-f78f-4613-bb02-05cf498e8200", "value": "T14F93195AF9819B11C4C91A7EF90E218D331357B9D2DE7223DE245B217BCB16B0E6B422", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160707, "uuid": "9242692c-eca7-4af0-90c7-9f9738ed35ec", "value": "1536:lcnQnnOWPKSKrKeKVK3LgSZS4X7N4zFMFlav5scpIaiC+jMmAr/C5qYBH:XnOyKSKrKeKVK3LgoS4rNYslaF+jMmAU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675160707, "uuid": "505c750d-1943-491d-bf6a-a04972c5d54c", "value": 95788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675160707, "uuid": "135c5567-7c8b-4b08-93b7-aa79c8787964", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160707, "uuid": "1c8c6c05-dd84-40d4-a5b5-b25a2dd4e6dc", "value": "3f3f4441319bf5afdda997cead6d7cf6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fe6065-a0fe-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675125029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675125029, "uuid": "cbd482e6-a90d-4045-a24f-2e15510a69b8", "comment": "Malware payload (RedLineStealer)", "value": "c954a36ff33abfa5fa016ad6765f16ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675125029, "uuid": "2450dc89-aa5a-4996-a7b4-15b79ee52563", "comment": "Malware payload (RedLineStealer)", "value": "ce72719afdc8c9cc927d29913dceb3b384802ba3aab038abb1406768c7695918", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675125029, "uuid": "f6ad7440-2c81-4204-87a7-bb3ade321e6b", "comment": "Malware payload (RedLineStealer)", "value": "c15cd1ee9bb1435dd08c6f7f0144a2bb343ed4cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675125029, "uuid": "f8ddaa2e-d7b6-46ff-a0b2-3465356f91e2", "comment": "Malware payload (RedLineStealer)", "value": "69531e36d1c61ecd74d44f7e91c330c81ef3958f45eb87361c86a3cab5da707c0bdae3fd870083706a4a90c145e3277c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675125029, "uuid": "a95070d2-9bf1-4f98-afa1-af4526d7aa70", "value": "T13E5402653A90D032C4166071792CD56DFA7A3AF21DB6CC07BF8D07ED0B321E2B56A35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675125029, "uuid": "3661b12a-2628-47e0-9c59-3ce8303b3fe1", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675125029, "uuid": "73c70c21-5dbf-4b47-a6dc-b80840dd7f4a", "value": "6144:tL24bfMha/Z6GrxPWpdurhbFWdeWePKxHDvZxGfpicqkfuE2BDj/:tK4bf+arxPUurhbFWQWeojvPDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675125029, "uuid": "a8bdcf7c-ac21-43ff-a2df-896321c29a1a", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675125029, "uuid": "8dba8b7a-a477-444a-9d73-e91af18ba8de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675125029, "uuid": "5211efe2-b296-4b74-8a33-acebe8d6f4f6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe67fba-a13d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675152156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152156, "uuid": "0916c936-f994-430c-854c-62883ccb8ffa", "comment": "Malware payload (Smoke Loader)", "value": "a244d14a0c5438ca946bb4d1da5e733d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152156, "uuid": "8c32dbd5-44f7-4e5a-96e6-1c613b88d845", "comment": "Malware payload (Smoke Loader)", "value": "cf22f0d694dafad6075d4eb65c84556310ac10a5af283a36e5a5363180a160dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152156, "uuid": "e436beac-5863-40c6-9f5d-1589288604a5", "comment": "Malware payload (Smoke Loader)", "value": "762e8633439dbfa08b4a7b1451aad00884d7a417", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152156, "uuid": "2543a1db-3aea-4a5e-b8a2-0a3efc9e9b44", "comment": "Malware payload (Smoke Loader)", "value": "fd7c4c4b786e6149a618f7aed0b4ccd80aa01d2e6e14f782845f8de87a894c3533ae75f35c10844f1c4ed440ad6adfb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152156, "uuid": "95230cdd-f147-4d93-8ec3-3c47e2adb52d", "value": "T1A1548E02B2D1BC41F9A28A758E1EC6E4F51FB4D1EE14A7652318AA1F35F31B7C766302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152156, "uuid": "a515162b-bebd-4f03-97c1-fd8d79a33afe", "value": "a2c8bd590ac12702f85d4107db46f8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152156, "uuid": "91fd78d0-2253-470d-8026-1f6577429ee6", "value": "3072:tVuIHYbCLpB7R4M0hqFq0yB8In1usWAyGDBkYGL3NhVr7f43H7BFqefRCDR1:iOYbCLpAM4qF81uM7gzNrr7f4VUeJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675152156, "uuid": "23226f23-681b-4fa2-8403-635a057d773a", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675152156, "uuid": "0810147f-004a-48f9-b4f0-3eead9b2fcc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152156, "uuid": "756e46a4-e9b9-4477-9672-a1760c493b4e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc2929b-a169-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675171208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675171208, "uuid": "799ac9f6-972e-40d8-b2e4-480aaff217a0", "comment": "Malware payload", "value": "8522f57cc50e10feb8fe41aaddeeb7e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675171208, "uuid": "c3ce6078-ac42-47da-bbdd-a61098a8a568", "comment": "Malware payload", "value": "d108d542cdda1cc9a6f061612b46afb5ab6ccede00063e59ce2298a6a633fe7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675171208, "uuid": "d6fc12c8-9ed1-4e63-aaf5-117bd9b0c1f1", "comment": "Malware payload", "value": "cbb1485e099b440563d877b161da7b84ed0e1f62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675171208, "uuid": "17292e91-d6d8-4d7f-81e6-9f01b043053c", "comment": "Malware payload", "value": "3d0a7d4274e74d23f1309d9078560448a858b4c4f593337f68741e231eca9d6b206f327fde56cf66f88a9a5b8e8994ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675171208, "uuid": "5b714525-bab5-45c7-8787-7fed5e85313b", "value": "T1BDF4E53D297617E6C338F93186E18420B6EEA1923703F969DDE61AD14F026C2BDCE51D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675171208, "uuid": "0763db9b-281b-4674-b93c-e73aa71ff9e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675171208, "uuid": "55690d4b-6d24-4abd-aa2e-409e05085763", "value": "12288:4hhfO+C+2SlLVseHKNTn7tunA+/kS3xineogrqKi7r/33mD15iGkuaFmljwXcd7Y:sffjseHKNTn7tunA+/kShinxgrqKWL3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675171208, "uuid": "9d38a04e-6779-4457-a57d-3c51f83cb9d7", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675171208, "uuid": "4b34d89d-493e-4fe1-b69e-7765f84972fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675171208, "uuid": "94a81d49-02fb-40b1-af9c-40172b8514eb", "value": "SOADEC22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211cf71b-a150-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675160104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160104, "uuid": "5f3b375c-b3ce-475e-ae04-10f0bd74d240", "comment": "Malware payload", "value": "ee5c5264ff8762b7ae611f4ac8457d58", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160104, "uuid": "bfec8e5d-4663-4b36-8026-cbcc96ee7b89", "comment": "Malware payload", "value": "d16163e2e6911531256e0a6f3100873b8eb9b74414a562beb576ee14cc8a57a9", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160104, "uuid": "1f8e2eb9-201f-4bad-9131-3d99c850eb93", "comment": "Malware payload", "value": "c3a411014caff29f07667f2bf4f90c382810d133", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160104, "uuid": "cb4243d9-d8ca-47d3-99e0-a9a9105e3801", "comment": "Malware payload", "value": "2e542063a75b80366d51772fba333a2657c2553b3522f836a0e36d771cdf49c7f39635c9b20b217bf0eb42c9887ee99f", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160104, "uuid": "078fedb5-d7ab-4cf7-8da9-ea4a14d592e5", "value": "T19725693D19B617D6C338FA7086E18120F6EE61923707F969DDE61AD04F01582BECE62C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160104, "uuid": "557e589c-4731-42f6-9108-afa45fd12c1d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160104, "uuid": "58d356d7-0113-48f6-afd2-c7852e8b5d13", "value": "24576:WR/jseHKNTn7tunA+/kSvaKqWON9XCny0Lp9yD95D4fj4uJNB9W3IkU:eMKqWOidPyD9qffNBGIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675160104, "uuid": "2b1571a3-5315-433c-a5f7-a538a3b46ef9", "value": 1057792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675160104, "uuid": "33fd3df7-3d0e-4778-99fa-6cb206f642e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160104, "uuid": "87e99c0d-b7d9-4195-981a-749fd389470e", "value": "STATEMENT OF ACCOUNT (SOA).PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0810a007-a184-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675182396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675182396, "uuid": "9eec87e3-3e10-4eab-91e4-31a390092065", "comment": "Malware payload (Smoke Loader)", "value": "e272a502d081ecc2490ff3ddd70d3379", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675182396, "uuid": "0ebd7ec7-1fdc-4d65-9f4f-e6a15a93ad6a", "comment": "Malware payload (Smoke Loader)", "value": "d270c1a6bfe1a4ba4bb170033ff448fa1421a549519250ee892f856fe101985a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675182396, "uuid": "8926b6db-9b14-4854-ba5d-c779b328c960", "comment": "Malware payload (Smoke Loader)", "value": "3b3ec8b681fb0432c2e17809e61b60627641bdf1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675182396, "uuid": "43f55c63-414f-49c4-8d0b-1416cbefb78b", "comment": "Malware payload (Smoke Loader)", "value": "4ca613778fd1a1e6eab710ae1774471cd3f011fb58d3eb475d1ca513dc7727f550d05e7ef69111782ecc582062b0e603", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675182396, "uuid": "3b1c7ab4-af13-4241-b3c5-0be6eaf4e77c", "value": "T14B548EC272B27C62E9228A719E1EC6FC761EB5534F2C7766120B9BDF19B11E1C1E3601", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675182396, "uuid": "e79f0237-112b-4002-92d2-dc07b5b2f784", "value": "e73db8d7bd9f9f6b2076d026a8fb8fc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675182396, "uuid": "5aefca1c-9e71-494a-9117-68a1be21cd68", "value": "3072:uqLuLwYaLNVRoOt/NiCDBeE0xj7pcQNU/Zx6GmqPUx6WfQz86mS6N/03MMu:YsYaLNUQFiQeEEmEyxjmqMoIxRs8Mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675182396, "uuid": "13d1abed-7253-47f0-9ebf-7b2af9c52acc", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675182396, "uuid": "1aed4626-02bc-4c50-b45c-57769891ae17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675182396, "uuid": "5395d444-62cd-4c4a-b393-4f5620cea1d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3971737c-a175-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675176036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176036, "uuid": "ad3b6eb4-dec1-4ce9-bd64-7c13ff2518e0", "comment": "Malware payload (AgentTesla)", "value": "834b2095d2c554d003c0c04bc7e4a1e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176036, "uuid": "0fc29f40-2810-4cbe-a716-a02b1f386e48", "comment": "Malware payload (AgentTesla)", "value": "d271d352cdd64384f1536695d0d0b281d23d79eae928c2491b87ec3f82422bf4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176036, "uuid": "3a6e6e89-f6d6-4ccb-b30f-42af7654d6f4", "comment": "Malware payload (AgentTesla)", "value": "7c44012215cb19ca3b6aca3a7145d28c3fb93c91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176036, "uuid": "f71917bd-455b-40ff-80f5-f8a28acc375d", "comment": "Malware payload (AgentTesla)", "value": "cb7c0f644fb9b0accad37c6726dcc2bd89b03e781688ff38043f6fd2247fbefb14fcd610dadc30cf4f43f08ba61cb0d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176036, "uuid": "d2b0eec8-6674-45a7-ab3c-0fcb0e09c3ac", "value": "T11EF4026A4278CFE6C55883FA21F414652B301663B0D7E7440E8AE8D1CD5B7F18E37A9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176036, "uuid": "77d92476-d785-43c8-9ca4-eb18f5d6cc38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176036, "uuid": "134f0fde-c6b6-4bc4-9977-4a7f1de40a62", "value": "12288:H8Lok/EQca1X838ntxe3HDkvMnNsUM7nGj8EA/IWeh3ih9HcA:HMokTm38txe3jsMnN3CU8EoIBYTV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675176036, "uuid": "7cfd56af-91c0-4b5e-86a0-5faf13cb5e45", "value": 739840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675176036, "uuid": "97817b26-4727-4058-9674-448db29ba883", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176036, "uuid": "0fdf303c-7cd4-409a-afbd-181a53a607ea", "value": "INQUIRY 20230130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e1c827-a0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (BumbleBee)", "timestamp": 1675123551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675123551, "uuid": "3aa40d6b-0089-45ed-b573-c1af43c2d488", "comment": "Malware payload (BumbleBee)", "value": "8afc8b0d6a3f0690d319d0dec85e97da", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675123551, "uuid": "fdd9b79f-b749-426a-968c-a13e6aff2c36", "comment": "Malware payload (BumbleBee)", "value": "d3195c8dbeb74fded26d4665226611acc1dc7306cfad6a478f3c3c93692307f3", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675123551, "uuid": "38201576-5669-4a7d-9a08-4bac0d21c445", "comment": "Malware payload (BumbleBee)", "value": "bc360c72abfa634f2d5c8c1e4cb4d8964a34a5fe", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675123551, "uuid": "e8c017d9-624c-4771-9562-9c6b5614016a", "comment": "Malware payload (BumbleBee)", "value": "d2b3176394573b07c921c811cecfa25fa398489c8c82fae5c53e74a487388895285f2c726b81681bf0e25594697bb44f", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675123551, "uuid": "f1242445-baf8-4942-979b-32bb75a195af", "value": "T1F01633C871741B32C69E4E7F6E70A6E4D6C4BF6C424980F2C0587AD631B96B3CAE9845", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675123551, "uuid": "1a2a6c35-b6a6-4a0e-8858-2331ba29287a", "value": "98304:SPKnw39kiUnMUYeg8F1HWMUKFln1vEsZSKRkGDs19sirjNGj/:/wNJUnMUYetUKFZROBGu5f0j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675123551, "uuid": "d3f1b329-d7f0-4523-a4b7-ee2e4117f244", "value": 4390912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675123551, "uuid": "a165cb74-ae9d-4f30-bfe3-43f0c242f149", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675123551, "uuid": "76cba96b-a1e9-4149-ae13-079a10bf9b20", "value": "d3195c8dbeb74fded26d4665226611acc1dc7306cfad6a478f3c3c93692307f3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8af48e8d-a192-11ed-88f6-42010a9c006e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1675188628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188628, "uuid": "954e8edc-8bb5-48df-a183-3d4a5a07cf54", "comment": "Malware payload (AsyncRAT)", "value": "04ac322607a1010c48c4115826e5bc0e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188628, "uuid": "5b725227-ce4d-445f-a96a-f4e88539bc60", "comment": "Malware payload (AsyncRAT)", "value": "d370d76cd76d88cced143ac2d73ea8abd93ab2759ffbdb5aeffc6db73aaf0f50", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188628, "uuid": "5bcc71c9-81b7-413f-bb30-7f061c419e39", "comment": "Malware payload (AsyncRAT)", "value": "42bee9f20b9891168418ba583b0540ac45522d10", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188628, "uuid": "bf25296e-adbc-473f-91dc-260ccc23d8a3", "comment": "Malware payload (AsyncRAT)", "value": "72760b4099f816c0f004e699c249f8d8ef121df6dc1b56ee8906700b3995842a3f716396695f6f5e409c3b3df092f54f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188628, "uuid": "f101d3d9-a0c8-4344-b0e8-d15278e7fafb", "value": "T1D0C4AEAF2F9E6E51C97D7B360193959193F0E0CB5A3BCE0989C6F5E027333401EA9489", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188628, "uuid": "047f766f-27a0-47bc-9b60-a68411e60696", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188628, "uuid": "ee967f65-187e-4582-9a32-11091aff8fa5", "value": "6144:eEev87+XX/gRMdTQljqpOVI7TkGnf6AYCknhY5fwN8AIlqOgB8hBsYI9nUHgiCHZ:wiq/ynI7TkGyAYxewN8A0qjBP9n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675188628, "uuid": "5efd34b1-9b86-41c4-9feb-78a7f48c6767", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675188628, "uuid": "27c9ec14-2551-4c28-9d60-9085151f2449", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188628, "uuid": "602b92e8-623f-40fd-8770-6b002eea9221", "value": "D370D76CD76D88CCED143AC2D73EA8ABD93AB2759FFBD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03530ab0-a15f-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675166496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166496, "uuid": "2d1f23ff-9ea0-4c40-ad40-50b7865ff7f3", "comment": "Malware payload (GCleaner)", "value": "44b0610aa763be4c92b2037f541c1dbb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166496, "uuid": "eef2e380-882b-42d9-afe2-d0191eb28d8c", "comment": "Malware payload (GCleaner)", "value": "d3ad73ebc03a6bdffabdcf70cd151a7c7aaaa77480a2229149a3f4bc1daf53b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166496, "uuid": "26db36b2-8be0-4d68-8fa7-1cba2b8a77f8", "comment": "Malware payload (GCleaner)", "value": "8c7a94021b125c892e520ea6d425df423ef5e5f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166496, "uuid": "ecfe8009-57f3-4124-8d78-54e64e6b1f27", "comment": "Malware payload (GCleaner)", "value": "1ff0cbd2d6f2434ef2d69126ab2b050a1712a07466e59d6ad29fa19a2a53c6a46dca0442c7a1720989b0bb17320aeebf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166496, "uuid": "14b39fb6-94e5-487e-8d0a-fd3c345364d9", "value": "T18AA5330934A28577C212E73C6D356855B8A6BA5739B0235130CD6C8F7B27BB13E35A3E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166496, "uuid": "3ce5fe82-476b-4e41-be13-a432af60653e", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166496, "uuid": "e616fc2d-4261-4ce4-994c-7556f83f0d8f", "value": "49152:C2Hy3ex2flLlTusKQdIB83+AcPMK0mwWTqbwxALCgv2MR:dH7x2tLPKQGB83+Ac0K0m92wmv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675166496, "uuid": "82caaf78-59b9-43d5-b277-598b70a3b2b5", "value": 2197180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675166496, "uuid": "d52b3fc5-688b-49dd-8545-2fef9cf87ab0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166496, "uuid": "7a25bb9d-0de3-4417-9e0c-98858e7839aa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7b3a626-a17e-11ed-88f6-42010a9c006e", "comment": "Malware payload (MetaStealer)", "timestamp": 1675180221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675180221, "uuid": "78c2017e-659a-44f8-87e1-e59e5aaf952f", "comment": "Malware payload (MetaStealer)", "value": "21a0588dbedcbf5807782febe2333d74", "object_relation": "md5", "Tag": [ { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675180221, "uuid": "b6230ce9-7f8e-4e37-965e-4d97fe7f44a3", "comment": "Malware payload (MetaStealer)", "value": "d3da939964cbf347635dd39214d941dc4bd59c84060ae4465ee6e943bae79dc9", "object_relation": "sha256", "Tag": [ { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675180221, "uuid": "f0f0ee4d-a788-4761-8f22-e18dac001165", "comment": "Malware payload (MetaStealer)", "value": "3bd172b912810c964edb04530793491f862e53c8", "object_relation": "sha1", "Tag": [ { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675180221, "uuid": "737d1244-cbdc-4ca3-83f7-2c4c4a95b2be", "comment": "Malware payload (MetaStealer)", "value": "1b6bc10c6ad54f3147a5b6ba05288bc04850c1d2ed9ee6c18e7f24dc090d8c775c2892abd6307515140291fc91a5ebd8", "object_relation": "sha3-384", "Tag": [ { "name": "fake-installer", "colour": "#1519B8", "exportable": true, "hide_tag": false }, { "name": "malvertising", "colour": "#374BC4", "exportable": true, "hide_tag": false }, { "name": "metastealer", "colour": "#68BF73", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675180221, "uuid": "5ab30552-a094-43e4-8d2e-156012e46599", "value": "T183E6235076D6C636D26E013244ABDBA61D297C211B21E0CB77B4FC6C7B313E2BAB6315", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675180221, "uuid": "deb8192d-149e-4500-97bd-800546805768", "value": "49152:CpdS3f0xzmDVAwFRGH/mb2akiOI3PtX5PhOKrtqxEyGBj9eUyzw3R5:CpLMi/62axPtpP/4xEy4YU8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675180221, "uuid": "39a6686f-62e1-464e-8a0a-89297a13ba37", "value": 15003648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675180221, "uuid": "a80ba8d7-e249-4540-ac6a-99e2b1abe0e1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675180221, "uuid": "61006432-f00b-4a6c-94f4-754fa5534ce7", "value": "Setup.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a085621-a155-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675162374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162374, "uuid": "f73c1637-2531-4b6c-be9d-741b6fd35e63", "comment": "Malware payload", "value": "1b3090929408ca24b223ef8f9e52193d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162374, "uuid": "52685c5c-69e0-4100-a750-06b64673a522", "comment": "Malware payload", "value": "d4144a9ed994706e3c013993b07dd679dc286ca17b24866d5790ffcc725303cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162374, "uuid": "b2ce2870-9e97-4d24-85b5-5caeb59a2893", "comment": "Malware payload", "value": "b067a2d415671d976ac6c9e235dbe0f16155d58b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162374, "uuid": "88e89365-2669-4325-a836-0cc2886ebd5e", "comment": "Malware payload", "value": "d691e7554b75e81e82073dc4fd7d7a4842b7cb678ea483b996bd94788e5a31de6d0d5c7925e212fa8056d00bc296c524", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162374, "uuid": "861dcece-43fb-4dde-a385-4636e54bb5f5", "value": "T1CE955A47E3A190E8C1A7C138CA525356FAB1BC18472457E79250E72A2F77FE1AD3EB04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162374, "uuid": "9959f26a-f0de-4cdd-acc8-f093c843266f", "value": "7d3755d010047ae48f1c346557af27ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162374, "uuid": "1405d828-7712-413c-833d-2e07cd1f0da5", "value": "24576:qntYsMDgAyrPAIg1Kb/gBqASgJyLabuW3nl1LUuOJQ8doi3+mb:4YsMDgzkIMKb/gUAr02buW3l1LUui1dP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675162374, "uuid": "0ee8e068-5eb7-4606-a2a6-7c04dbe59326", "value": 1941528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675162374, "uuid": "a3e75b32-c1ed-46cb-b105-c2c9cb5c61e3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162374, "uuid": "96d07095-0c64-4ccc-ad6c-96d58cef5363", "value": "63d8f2a47b8b5.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbab152b-a150-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675160363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160363, "uuid": "6fe9e7e6-7388-4be8-a41b-7aeee83d177a", "comment": "Malware payload (AgentTesla)", "value": "8355ff19be62ac27e2d9054585b42766", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160363, "uuid": "0e81f00a-f919-4b1d-9b5f-c44e345c95f7", "comment": "Malware payload (AgentTesla)", "value": "d51994a70ae919cfd8e8c6122e390e2ea6af4724a91f923fbd837573fc46df7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160363, "uuid": "50dbfdda-ec2b-437d-85f3-06c8b5049a2c", "comment": "Malware payload (AgentTesla)", "value": "813caabe119c812b894af0704e232710f8c9259c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160363, "uuid": "ec6cb3cb-148f-4512-96f3-fd8128e61e76", "comment": "Malware payload (AgentTesla)", "value": "ba4e280c4cba250845a56d66cbd970e687f7c9bb8b8bea975e2c95cf980e138848c72cb9137f623846597e68f63aab8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160363, "uuid": "5b2c4e0b-422f-41e3-8c9b-cab336a00398", "value": "T16A62D048F35E7CC4EE822B374FA633A47CC9988655253E788A033B5C0C6CB91537DA65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160363, "uuid": "5d408352-4d02-4eff-b041-ea295159f9a5", "value": "384:9KhUaLxd/Fjr8Jno5rpvtku6PKJFaNh94IoxfG0mB3yRaDW88Xa3BZGkg:8hNPtf8JnMrVCzko39+tmBTi88XWfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675160363, "uuid": "f426c039-0125-47e4-a78e-51bde3ae1926", "value": 15536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675160363, "uuid": "06dad72e-1f69-4738-addb-e94df79d3e8f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160363, "uuid": "ea632cd6-93f6-496b-9fbe-1f01f1997ea4", "value": "URGENT REQUEST.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb124270-a147-11ed-88f6-42010a9c006e", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1675156524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675156524, "uuid": "3808e2b5-5135-4330-9b17-dfd7254ab373", "comment": "Malware payload (AveMariaRAT)", "value": "c3c67bef4331fe6e84638aae09a0dd6a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675156524, "uuid": "baa8095a-339d-46fc-ac47-5d902a09caf5", "comment": "Malware payload (AveMariaRAT)", "value": "d64087bb6c3f3db707e9728a3800ad308ea6ce7e4b33a4dae2ee15101df4e134", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675156524, "uuid": "e504e1ec-4493-436d-8078-f38c8af4a2e3", "comment": "Malware payload (AveMariaRAT)", "value": "3dd35ddb2c956771d25724353e252c47a6f0e905", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675156524, "uuid": "03b963b1-33ba-45f6-977b-460fbb32798b", "comment": "Malware payload (AveMariaRAT)", "value": "ad1bbbb75da5d6ff30c6c3b0d6c652489be99bb12cb5a1217d5d10692b8bf98755e1070f8b32fe40f40a4868a7fec7d3", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675156524, "uuid": "5966058c-ca5c-44d7-82f2-55adae4de2c7", "value": "T11F159D23BAA144B7F0672D3598579325593ABE002E3CE546ABF53D4E8F37742B8242D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675156524, "uuid": "215851da-db6d-4060-9420-55d7bb653bf4", "value": "fab723900b8ba2b2a2705c88827e03ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675156524, "uuid": "3724f92e-72a2-490e-9323-53842101c321", "value": "12288:BENV/fB+g9GgglTA/CsFA4Mv5Eko1M+c/ibBdxQ7zPZ+mLJtzR:Bo79CGPmtqc/i7IBnzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675156524, "uuid": "c35ecda7-f3c3-47b3-a44b-76d1dda25f6c", "value": 955904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675156524, "uuid": "708ac64b-6ea8-4137-86e6-64b9c09fb1f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675156524, "uuid": "12db9d5a-cdd1-4bde-9cf2-fe51051089b9", "value": "Scan Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a9ffe2b-a181-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675181165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181165, "uuid": "816e7cf8-d0c5-4c5f-83de-91757e9f6bee", "comment": "Malware payload", "value": "74f6992e57a5235481a7eb6f151c0614", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181165, "uuid": "95796827-85e4-4ed4-92fb-20b62a8be113", "comment": "Malware payload", "value": "d6767d847c5545622e5a54a1f72afea521fef119c452b74fff3a164b168fb8f2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181165, "uuid": "17a14841-6266-4941-b03a-c3795e050bd7", "comment": "Malware payload", "value": "239d3ce6c7b11107b0aa05442deb500049c29128", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181165, "uuid": "63ff3bd2-81cc-402b-a200-947ec80d2e9d", "comment": "Malware payload", "value": "0396f886a0ba96effac2513871e7883ade2cb26756b50480c26cde80682c05717194b305dc7456761045113fcab21014", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181165, "uuid": "e8fd93ce-d0c0-4018-9473-14ff043d9dee", "value": "T136E44CE4FECBE1D1F4071CBC02A9263F59BB23185838BB2AD5113E19D821285AD67F75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181165, "uuid": "ed1fb032-7f2b-46fa-9a8d-305114d8c72f", "value": "48ee4c9fac8d1206bb74064becdbc1dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181165, "uuid": "5312b06d-9565-449b-8ad8-155295363a8b", "value": "12288:9qwFxm3G6H4RyuHbR1MxnuTV/iV1SdURA8s2Q5Qp:QwFxm3G6H4IuHbR1MxnuTV/iV1QTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675181165, "uuid": "c9580504-4267-4e71-8c1a-3e63152dc770", "value": 719572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675181165, "uuid": "d50747fc-0bd0-45c0-a8b3-d274ae483dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181165, "uuid": "c72528d3-ca2d-4020-bd64-7b4013670bdb", "value": "300123.gif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c93d0e8f-a185-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675183149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675183149, "uuid": "ea266c71-4489-4ce9-8a91-ca9b8d09824f", "comment": "Malware payload", "value": "0cc5d5ce37dc79ee687c1e6b04c9ac6f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675183149, "uuid": "d09d463e-56ac-45e1-a54a-15fcd3f7dc02", "comment": "Malware payload", "value": "d7f27bcd068821e3b541ffcc181509ab84636aec7f800c709c91b59c0795e95c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675183149, "uuid": "858c70f5-fb9a-4332-82e5-ffd4ba957c55", "comment": "Malware payload", "value": "8ad71d0e26666455e688c0f4d8d634a16bedc0f1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675183149, "uuid": "f5f8d6f6-91e2-4da6-9d3c-ef280b26f5aa", "comment": "Malware payload", "value": "cbd205b0402e583fd52cac3a270fa1ad66fdb7ba7852279948833929078fedeff7072c65ece94fa6f5f1330691cac567", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675183149, "uuid": "4ddd4fd1-1656-48f1-8800-e66e82d35d44", "value": "T117F44CE4FECBE1D1F4071CBC02A9263F59BB23185838BB2AD5113E19D821285AD67F75", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675183149, "uuid": "060c9098-dcbf-4782-8bfc-6491bfdee05f", "value": "48ee4c9fac8d1206bb74064becdbc1dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675183149, "uuid": "a5de0bd3-1fca-424b-a80f-2ac2b28dfbb9", "value": "12288:9qwFxm3G6H4RyuHbR1MxnuTV/iV1SdURA8s2Q5Qp:QwFxm3G6H4IuHbR1MxnuTV/iV1QTQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675183149, "uuid": "8c3ddae3-c50b-4111-9480-afc934f659bd", "value": 737635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675183149, "uuid": "ec0e9bbd-7ea3-4833-8fb9-b94a0e13e4b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675183149, "uuid": "adeb0668-ee10-4089-b1d6-e253049f53d2", "value": "300123.gif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe739bf-a13f-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675153015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153015, "uuid": "b57c7f1d-ff80-4ec0-8f9f-68eadcd235f7", "comment": "Malware payload (RedLineStealer)", "value": "208e0e5404b377ff4a61e424c74892a3", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153015, "uuid": "362ca29e-6e79-4fe9-bd7d-9b4e847d89f5", "comment": "Malware payload (RedLineStealer)", "value": "d85391521bd9c46bc3a0ecae974f9f985cc0f5bdecf62103409a8d55fbd4ebd8", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153015, "uuid": "59ff42c6-f904-45b9-b94e-7a5b9c3e1e22", "comment": "Malware payload (RedLineStealer)", "value": "1cbb639d4a4058ca24dc0be5335cd6fb7fbb48b5", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153015, "uuid": "d65b362d-6aaa-4754-bf32-275bf7083e39", "comment": "Malware payload (RedLineStealer)", "value": "bbbdddc342f452a8e709707234ea494f661f33bfe3ea177ff2e532ec182c44092045a10624292470da41b97e5fc5120a", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153015, "uuid": "a1c3fbdf-6470-4b8e-8c9e-731c252c9cc8", "value": "T147A512613F4EF233F4627BFE4225C9AAD39CCA9DE65297C084595124B8AB51CD378D0C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153015, "uuid": "5715ca2c-9ba2-4f74-9984-6a89a2201993", "value": "49152:YAsezdpBwKmuXFEfP/BudXopbF0t5FKH4ac3YD+:YQxpBHDXo/U+z8+YYD+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675153015, "uuid": "0f9ff8e4-f033-4c37-bf16-a8045bb4f2b2", "value": 2160105, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675153015, "uuid": "7c82a71d-9913-4613-aed3-02300cb92320", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153015, "uuid": "1f50d325-68c0-43c1-9052-d081481450ba", "value": "glu.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89cc3832-a17b-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675178748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178748, "uuid": "50d2265a-86e6-4a2c-a6b8-326bb707e75f", "comment": "Malware payload", "value": "34836aa4eaf07b8ccf7d67817e2d9cdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178748, "uuid": "b2065a24-cf8e-49b3-8b10-c19fa6d09a80", "comment": "Malware payload", "value": "d86a220dd6b7e1a43947be099a9b33a837ad61086cbd00cba7e730b54cabbfc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178748, "uuid": "10e87186-58e1-4819-9a50-bcf202705ce8", "comment": "Malware payload", "value": "6e48ef72c5218c76b2a1524eadf282912f5a2b96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178748, "uuid": "49dc981d-3168-4195-ae7b-95195d94be80", "comment": "Malware payload", "value": "74bd87acde1e6df00055f518de31c27779da985ecc72562a868302c9245a48d473a3154c6f68f9b7ef01972598ab3819", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178748, "uuid": "65f8f7e6-f26e-4c07-a649-c3244a345080", "value": "T191033994A6AC8B33EBAF4B7E58F9558247BC5173E405EB0D388C50DD38D279302A235B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178748, "uuid": "7d11d277-fe12-4fdd-9903-23785a0bb781", "value": "768:BaJ45P5jHWSDAYsAY+WXcViup2D09VCBJifwi/30NZXggUX:BaSsi3s3+QcViND0zgJifT3CZwBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675178748, "uuid": "21b5ac4d-8f36-4972-a204-7432b9670b69", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675178748, "uuid": "78be3fe0-b8b9-4d12-b8ef-10c605669a0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178748, "uuid": "a61e72bf-c9f0-48a5-98af-49704a281d04", "value": "SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9224822-a1b6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675204221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675204221, "uuid": "7719a6da-b393-4273-ac56-f06e4acb0bf8", "comment": "Malware payload", "value": "4144520ffece09cf8670b7d8cd8849c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675204221, "uuid": "cd97ce41-2e51-4314-8a25-531a45bcf82f", "comment": "Malware payload", "value": "d8f32cf50e51417e047eab3582173ef0457e5439df28113bd8afbee290f6087d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675204221, "uuid": "dce2f6c2-b8a1-45e4-a9ba-9132b36ae1a6", "comment": "Malware payload", "value": "75b7ca39c03d0a944da4090df9c76b4edfbdf707", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675204221, "uuid": "a06deda0-68cb-40cf-8a80-67338a14ef3e", "comment": "Malware payload", "value": "91b8a858383442f3db197cef5c38ce15b8f19a51e597de138e2a36dd8d87ccd5f1bea6947ee9a1e4c0a3b18ad809302f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675204221, "uuid": "2d021675-4ce0-49bd-b75e-dd358c8aa55f", "value": "T149549EE272F2BD62E965CA329E1ED6F4361EF5524E087766220B9BDF15B01E1C1E3301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675204221, "uuid": "3516d0c0-0736-4b98-af22-4eef55fe296b", "value": "d84aba910fd98bff40c3867e1dd713e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675204221, "uuid": "e9612f21-51de-475b-9a1a-a7425c5e6b1d", "value": "3072:5Suah4L45UmLRsLLuyOEfWNiAmlEjOfNZq9uNmqPUx6WfQz86Oiu3MMPgm:/ah4LuU7LSaAiAmlEeNPmqMoI+u8MV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675204221, "uuid": "6a769bc4-d07a-486f-a6ed-6258bddc1d50", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675204221, "uuid": "a2ed19ba-036f-4694-a227-a65922379583", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675204221, "uuid": "453717be-ec67-4515-ab47-309a84659280", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d74215b3-a155-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675162557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162557, "uuid": "c43a4954-bd46-4bfb-a7a3-49e0981e523a", "comment": "Malware payload", "value": "ef6263b792549b5b3abfe33a8ebe9771", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162557, "uuid": "8332f1eb-7da0-41c9-8f0a-86600d8e303a", "comment": "Malware payload", "value": "da0eb63691ac93a850ddbc26e9ca7ce0af481d14ca0e1c5668ebc5f299f8e6e3", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162557, "uuid": "e473786d-6a16-45d7-a98a-a3b994eaba99", "comment": "Malware payload", "value": "2d3e1a53d78490ca12db27cb90817d7ebcfd04ce", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162557, "uuid": "0def855b-a02c-4ee2-b1be-69a028dd8589", "comment": "Malware payload", "value": "199f33bac2b5a78be5507c986de40cc78378f43f1b996205b7d588b01bfff0f282cf4dca220a5bc8ee06c0c5dd61ccea", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162557, "uuid": "bd22c82b-b508-4ab1-a5bd-aa7989259d03", "value": "T1AA662368F44A33A1F80EC6B805F029B403F12D35136B5BC92275B65F9167E7FEA60936", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162557, "uuid": "54d058bb-23ae-428b-bf45-3b2a71cdd122", "value": "196608:sASyANbxw4Kb1wUhVJ3DJRS+iGvgauwkiuSDi1mjmZ0A:szyANNwbRwUhVJzJJiZ11m80A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675162557, "uuid": "2cb6519f-03fb-4c70-99ea-e40936c63d9f", "value": 6963259, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675162557, "uuid": "173f8bbc-38c7-4950-8fb1-fcd2a828f64e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162557, "uuid": "dc859964-b310-4955-b8ea-42c4576f3c8d", "value": "Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2e195e9-a19d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675193393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675193393, "uuid": "99eb7f91-88b8-4879-862d-fd25ecbd490b", "comment": "Malware payload", "value": "a51a634e7d4de9f1995def5fb0e9f30b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675193393, "uuid": "cafaee4c-ae70-4594-97c9-02c3a557f7dd", "comment": "Malware payload", "value": "db8ec89991e16866a4c2ecbe82d1dce0a0f3bc852ba1b8a978d8c59801f861db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675193393, "uuid": "634d4873-8d23-41f4-bb4c-3d73651990c4", "comment": "Malware payload", "value": "4b5d954e9ce0fc5146c308ed30243ef69ea4af83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675193393, "uuid": "d8a4b7aa-d47d-4b2d-b6a1-880933d50772", "comment": "Malware payload", "value": "ac1a37e70054773593e281144035018bc041b42c42cc1c65e4589efe3e51ab78dc2e23f19c99cf34cbc6f2e1af717700", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675193393, "uuid": "5e762cfc-b6a7-4d02-a086-19af19f5ed63", "value": "T164548ED2A6F27C62E921CB328E1EC6F4761EB5534E09736E121B9B9F19B01E1C5E3341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675193393, "uuid": "6ae9fca4-37e6-497f-bfaa-273c0c3c49b3", "value": "9c039baca0968dd2f90042d865dd6c2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675193393, "uuid": "b635ea5c-2e69-43ad-80f8-181e8dcf3c5c", "value": "3072:LbuCBiL0URAUXkWRa5CMRP8L4J8pNlRBgLBI8pmqPUx6WfQz86G1+ILM3MMN:WCBiL05UIRkL4uphBgtJmqMoI+KM8MN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675193393, "uuid": "5a303815-a550-4653-bb2f-3525614017ad", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675193393, "uuid": "5aa9c4e5-3c36-4708-9d9b-bd5f6d783054", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675193393, "uuid": "279bb3c4-6548-4837-910e-cd368df9e822", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0755f94-a1ba-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675205925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675205925, "uuid": "22a8f58b-aa65-40ba-beb9-c96efba04c50", "comment": "Malware payload", "value": "2f885eaa60ac08d44bb22aeafe4f5135", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675205925, "uuid": "77e850fa-c2df-421f-bd38-24a6ed601b5a", "comment": "Malware payload", "value": "dd0bd63ada359ba9e0c332af732770c116fdc178d48c4a6dd55e69dc14525340", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675205925, "uuid": "fe55798a-081a-4a25-a674-895f4f5e10aa", "comment": "Malware payload", "value": "4f2b0894a6096b16f6a34d34bfb987c20c8e97cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675205925, "uuid": "d32408f8-7c80-4ef6-a1ee-d84daaf2be77", "comment": "Malware payload", "value": "b4f84f1b1a239e4dcc2313d0761667e07fc9339c6b794696138433ef7e725af235ced01a996b6d1868e11fd1bc0764e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675205925, "uuid": "b48b40ed-e036-4e09-a1f0-d1f7c3379735", "value": "T172431744BFEA5A05E2BC8F3468F545150A74AA23E632EB1F4CD668DB17327C58C40FE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675205925, "uuid": "fe288d57-d850-4c06-b75d-33a436a6007c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675205925, "uuid": "fffcfd21-bbec-4998-b822-a8b0ee5b08f5", "value": "1536:is6ADnRZNaidhycD6wsNMD0XExI3pmkXm:eADn8YAcD6wsNMD0XExI3pmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675205925, "uuid": "0dba1068-64bd-4699-90f0-1eb7c5023cd9", "value": 55808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675205925, "uuid": "1ecd63f0-fdf2-4c2a-b86b-a298fb00c8d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675205925, "uuid": "0775fba3-1bd3-440d-85b8-0619c53e744d", "value": "65KUG4ai.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d4974ad-a15f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675166620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166620, "uuid": "f9af3d1a-b39e-4f4a-b462-9c8ce5947c29", "comment": "Malware payload (Mirai)", "value": "28542d678df8e73fd669fc4808e3575f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166620, "uuid": "25206d7c-c3da-4689-abea-bdb05c5d54a9", "comment": "Malware payload (Mirai)", "value": "dd7f0e1764585d84ca2af11f55224e9adf31cdca5f0c0a31315d7a83d6574c1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166620, "uuid": "aa11b42f-4742-41f2-a5f8-12a494d6714f", "comment": "Malware payload (Mirai)", "value": "dd0d2433b598ac3751c35301cb954908935e2d0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166620, "uuid": "40655f32-4e14-4a3e-8be9-98d42ace63d2", "comment": "Malware payload (Mirai)", "value": "d3c38e6716042207e286c1ca897b1ae21f05c127b4561a5d593ac328674af909146a3dab36a857e0219e20d2c2337014", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166620, "uuid": "8bd5b61a-d9bc-40ee-9a42-208a9561dd5d", "value": "T1AE43F2130C0BE4CC72F608368A6E870A3F5F3AE1E57E219911C49ED8B9D0157B9BC57A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166620, "uuid": "5d83fa21-7ff3-436f-b9e7-5434246d4175", "value": "1536:oR84lxPY274dUwwQqgk33im5yjon7Mriv5:gJlxPRYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675166620, "uuid": "50c35409-d40c-4daf-a47c-a9bf1ef282b0", "value": 57964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675166620, "uuid": "554a9c8e-c35d-4d47-a5d1-cf746f646bd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166620, "uuid": "85481b03-7242-4914-89b3-ecfa6c696924", "value": "28542d678df8e73fd669fc4808e3575f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6ef639e-a168-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675170690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170690, "uuid": "02569018-1ab4-4134-b28d-5fb8222eecd8", "comment": "Malware payload (RemcosRAT)", "value": "68fdb669425ec2a155ac6d508aa7a8a3", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170690, "uuid": "6015ce9c-f685-4b1a-8bbd-1d8f2bc4b1b3", "comment": "Malware payload (RemcosRAT)", "value": "de8a8e788979f605ae68981ec3bf84711e957bfa4746d5f23c2015a8ec928c32", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170690, "uuid": "49631874-c3a2-4b6b-ad62-cfb2abd7f585", "comment": "Malware payload (RemcosRAT)", "value": "bda890389cdf441841377119c2eb81b29f5780a9", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675170690, "uuid": "1795b351-8531-410e-9cba-187294e9a0c6", "comment": "Malware payload (RemcosRAT)", "value": "b9ba494e2f722d533eb0bd07c1226ab270d02c709ed6442793558dca55a3453f2a0450c648f3087890f5e9f9f37a5d65", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170690, "uuid": "67d6b8b8-0b31-454b-9940-f20f764f1ec4", "value": "T15CF5B4203AFA901AF1B7BF759AE475A69E7EF6633B07954E1050038A0A13E40DDD173E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170690, "uuid": "7cba87db-15df-4464-81e7-7eb03dd8aae7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170690, "uuid": "c20f1f7f-2901-44cc-94ca-be7e7eab3e16", "value": "24576:gAzFN9Z2XBQFio7Qg/pAqqE96RoS3p/PmV08YKwTQok4U02409htjRjLYBS7Rt2c:gA36Iio7Qg2UX0TSLjRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675170690, "uuid": "e178ff7f-b0ab-4322-bdfa-aee3b136461c", "value": 3473408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675170690, "uuid": "a0d35c8c-0cb5-42a0-af2a-c14b03f5b262", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675170690, "uuid": "02c21d1f-83e2-4e5b-bbde-d319af8f5c2a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35d429ed-a10d-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675131362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675131362, "uuid": "6c66b2c5-4a00-481f-ac40-cc7b2ca859b0", "comment": "Malware payload (GCleaner)", "value": "970c41b5f61da8b0558a4fd8243cdc12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675131362, "uuid": "0427ed19-c123-40fa-b3a5-07357a0779f4", "comment": "Malware payload (GCleaner)", "value": "df0210cf3c9755bcf4204117206dced57bc7c48aca5ab246880435f56b67823a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675131362, "uuid": "bc0af389-0c4c-45ec-923d-5ce55b44a40d", "comment": "Malware payload (GCleaner)", "value": "04d47aa18e1b30ca84279fe56f3a62d4dc94fc5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675131362, "uuid": "93e592b2-a294-4169-919c-2507c007da85", "comment": "Malware payload (GCleaner)", "value": "6de31f7e5b3b147b1c731103b8396a388bd74e6ec7208b8a324d8738a12cf8f16bdd3290cfe483cc363218ae378f5cc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675131362, "uuid": "a8fc7f57-1a74-447c-9e3b-478e21944ea0", "value": "T197A5335A5098483BF282967ECD20B9566AFFBE153074F011B44C709F4A3B6E9487F7B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675131362, "uuid": "c12e9ec8-04ef-4461-b19e-470b6a34cf45", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675131362, "uuid": "be768826-c1d9-4baa-9aee-a6695e42caca", "value": "49152:2chHs5N2FNeD/lwUU7HCxxp7nda/VE0qssxhMlPmLCgv2MR:DhHUVDOUU7Hyp4EndhMgv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675131362, "uuid": "b27ffc56-794f-46e0-a5be-8657da0e14ee", "value": 2192640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675131362, "uuid": "5fb83d79-e501-412b-8fb0-1a41cece9dc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675131362, "uuid": "6765a598-ef97-4fa3-890b-bb1c3a5dae8b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43e47e1-a1aa-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675199005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199005, "uuid": "f1ab9ca8-987d-41c0-9060-a3fe18ce0910", "comment": "Malware payload", "value": "0de13cd68f2e6a6959eade7c826366c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199005, "uuid": "eff96321-af25-4fc5-ba5f-d9bef3000960", "comment": "Malware payload", "value": "df37de8d73f9eff29baa4d7241dd5fb4ff56b4722cfc1160c43d1dead2fc9df8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199005, "uuid": "ff88204f-6497-4ccd-a277-c3c91dcbe72b", "comment": "Malware payload", "value": "ec84f3033d3fc8c30dec2be4de06320b1f7b59d1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675199005, "uuid": "3b22a52c-48d1-45a1-8d1f-d3a68554601a", "comment": "Malware payload", "value": "2e8bb6f764ca370d68cd547a60988d94cf25bf14605622e5a3158e6250690f8a668c10798c7ee489a5c7afd1be440224", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199005, "uuid": "0156be48-db93-4d20-9108-34da59ea863c", "value": "T1F5549FC272B17C62E9A187319E1EC6F8351FB9A24E187366121B5BDF35B01E1C5AB343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199005, "uuid": "2ccf2b7e-2c22-4f59-95fc-a3182d083449", "value": "d84aba910fd98bff40c3867e1dd713e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199005, "uuid": "91398801-2a54-47e0-bdd1-9e468aa9b678", "value": "6144:ZQLRLGTAHplwcHNoMGtFNgmqMoIU2CX8M:Gdq8JHK/v/qMMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675199005, "uuid": "ed9c6d04-132d-4ecc-b7db-a3186e6911aa", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675199005, "uuid": "dd519420-1fbc-4485-a5ce-7e3fe9facc29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675199005, "uuid": "61dd3746-09a8-4beb-853f-0e0e383c75bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a58267ec-a18d-11ed-88f6-42010a9c006e", "comment": "Malware payload (OskiStealer)", "timestamp": 1675186525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186525, "uuid": "d4ee2a37-a3a2-4a12-afad-ddeca198f27d", "comment": "Malware payload (OskiStealer)", "value": "28682416fd765969c4d42c76d8f59d69", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186525, "uuid": "1d313ccf-c629-4488-b081-66d884db4a61", "comment": "Malware payload (OskiStealer)", "value": "dfe5049756f130f2559746da26d1a7dce785b0099a715b55d3cc6f31361c96c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186525, "uuid": "55f09304-e2e6-44d1-8c8c-ef91f55c7f38", "comment": "Malware payload (OskiStealer)", "value": "723de57b27d0b285ea5003907eb2c44159ecef31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186525, "uuid": "0d99c2a7-2d6b-4b85-a346-71f19ffc910a", "comment": "Malware payload (OskiStealer)", "value": "a4b8bdd7943e2e9197ff6d88382f6facd01488d5994da378d504711ba9df086d87b193430880b400d6966619861f7693", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186525, "uuid": "26878528-067b-4bda-97e8-1dc162835ac9", "value": "T149146D30B690C035E8A310BCDDEE86BEB96C7A301F5950C3A3D45A662F712F27A71657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186525, "uuid": "92c79c36-ea13-4887-b42a-9ff51b5caf3f", "value": "7bb9d345a5fec4fbbf5100d6a3ffbb8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186525, "uuid": "735ee6fc-8099-4c32-9a5e-140133ff9b2a", "value": "3072:WfUomEuYm98dlSq7gt5q7Dx+XgS6aCEwhOfUbCalNT2pbB3fIM1Xi6FLPo3c:WfUauY68uSWCx+XA7mg2pN51Ljo3c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675186525, "uuid": "e3bd38ff-f73d-4b4c-a0f3-4c192170c852", "value": 204800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675186525, "uuid": "e7e506b6-bb85-40f7-a302-3ca75dcfdf87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186525, "uuid": "f2256f8c-d375-4581-a2f1-ae479755fe0a", "value": "DFE5049756F130F2559746DA26D1A7DCE785B0099A715.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ebb9f38-a17c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675179025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179025, "uuid": "085cfa15-dd11-4759-ac7d-534d581415e5", "comment": "Malware payload", "value": "723aa63dd6c41be730d3a454db6aa765", "object_relation": "md5", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179025, "uuid": "188f290a-c561-47f6-a022-85708f59919b", "comment": "Malware payload", "value": "e02ff82ce33603b1d5f9846d28723bbef81e6c1e0b0a4668ff797bc27e8d82a4", "object_relation": "sha256", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179025, "uuid": "fcc884f5-1858-4e1b-a1f8-738016aa0d5e", "comment": "Malware payload", "value": "7ecf7d27991b5920adc941195e41cbd8e157f97a", "object_relation": "sha1", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179025, "uuid": "c36dd404-3fe9-4c15-b829-bac597ff4846", "comment": "Malware payload", "value": "42b26ae8892328045fff5703d2c0208a2c3bec26bc198aa7acf68f0f44ce703d68d020612aabf136d5694558c68a906e", "object_relation": "sha3-384", "Tag": [ { "name": "php", "colour": "#5D0626", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false }, { "name": "WSOWebShell", "colour": "#C53911", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179025, "uuid": "52126b04-5959-413c-8a83-a4fe17ff6f32", "value": "T153A3E5933A0D0DAB23C39F2AC2759549D85FD4B05087F42EF46EB8745E789AC03B9E94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179025, "uuid": "5108ab1a-bba3-41e7-be00-d46d8af8af68", "value": "1536:MB7NBwlip0bH6R7PExxtJ+lRkU2Mlo6mARpRv:QHTR7PY+lRkU2Mlo6Ff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675179025, "uuid": "aeb8a73b-5615-479c-9204-7b2d17e79b8e", "value": 99750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675179025, "uuid": "4bb99cff-c047-454a-8714-533ace9ddc98", "value": "text/x-php", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179025, "uuid": "c4398ad5-600c-4e70-b4f1-abef0e7a9279", "value": "BBh77A9C.basebash", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c02e317b-a1b4-11ed-88f6-42010a9c006e", "comment": "Malware payload (DCRat)", "timestamp": 1675203320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675203320, "uuid": "084054c8-c101-4b2a-8380-980e8707e292", "comment": "Malware payload (DCRat)", "value": "a2b5b06c6892da9d79036b2ac472cbcb", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675203320, "uuid": "48ee61ea-59f0-4966-bc65-d7d92afb1106", "comment": "Malware payload (DCRat)", "value": "e0e8d8ded4ed02589e1a38d5d05bdba9af3ab0c4eb3ad290f78fbaac4cfb4a19", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675203320, "uuid": "6ada9e2f-fa1c-425d-8b6f-48fbab3d87b2", "comment": "Malware payload (DCRat)", "value": "a9975118721d3189dc518740517c577bdcaadf06", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675203320, "uuid": "eebbd10c-e38b-4ff4-9ef0-4fcb2dd1a384", "comment": "Malware payload (DCRat)", "value": "b313421b4d58403200dcc50f83ef2d0a9d6bb06801f1359beb9207cbb80d6094a980570f30c1016ace0f9a153e76cab5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675203320, "uuid": "a784010e-5987-4015-bef9-289c166e6e10", "value": "T1EC6533206DA6940DFFBF8930725FCB550B68E1039D7A0C9EEB5D6A045C446C9E83F78A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675203320, "uuid": "b8a5b028-b5e7-4a88-a315-a281051e7ac9", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675203320, "uuid": "a2577dba-49b0-4d18-82e7-b92b94e35cc8", "value": "24576:MdPuMecQUf/Kk7fUdf9E21nCNrfnZJmVJWyVctRw2Ii8xgY4/5EGJRhT+b1nPjpn:IuMhQUfn7Udu21CtZJmzVctRwiignhr5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675203320, "uuid": "2f1062e4-df14-488b-b403-5ec5a821f94e", "value": 1490432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675203320, "uuid": "da5c06a7-ceb7-497a-86ba-f162c4811a82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675203320, "uuid": "767f74bf-1668-4b22-9f9b-2cfcc8dcb84f", "value": "a2b5b06c6892da9d79036b2ac472cbcb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c033786-a1a6-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675197032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675197032, "uuid": "f6dd6f8f-6b45-4799-a44a-64dbf8d6d90b", "comment": "Malware payload", "value": "c357594b8f1a058908f6150d6aadde30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675197032, "uuid": "71ea1a0c-780f-4076-b6ae-fc93892989f1", "comment": "Malware payload", "value": "e290aa4a9558ef977d0ba2d41cb490154fc0e0ae875544ceff3b46009e0b574c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675197032, "uuid": "58134a1d-7e8f-4d8a-b909-43ee456b75e9", "comment": "Malware payload", "value": "228df963bb207b22c2c8132a4eaec027ed6cf3f1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675197032, "uuid": "24e70b98-266d-49e7-b581-ac79c4cfbef8", "comment": "Malware payload", "value": "85104b4b022be208dcf1180fbb8c96aa724d05c0a42bf742f314333c17335bf401f4b2f10eb4cfd256b4c1d364fd93ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675197032, "uuid": "d7827e01-9baf-4608-b608-867ecb22ef07", "value": "T19E548EC266B2BC62E9228B719E1EC6F4751EF9534E087367120B9BDF15B02E1C5E3352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675197032, "uuid": "8a5120bf-9d6d-4f31-ae7f-3b52646811bd", "value": "e2474d94404febb68b5af309915f543b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675197032, "uuid": "d84dad17-791b-4e5f-bfbb-a5b48d434f99", "value": "6144:fbFaALpXMo9InDsyxSC0jn6TmqMoIVcjM8M:RtFTInDsyxS/76qqMvcQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675197032, "uuid": "1ef5a9b8-928c-436d-bbe6-dde3a6eae1dd", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675197032, "uuid": "7bc73ec9-9096-44b4-8d0d-2bc89ce5ba15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675197032, "uuid": "bb0a60c6-17bf-478d-8053-16686fa409b9", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1ebb24-a12a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675144045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144045, "uuid": "80b683d9-60ec-4952-a53d-7abb2f19c3ee", "comment": "Malware payload (Mirai)", "value": "4189cd7ec1e82b2280cfdccd878932f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144045, "uuid": "834ee964-8cd7-47df-b748-571e47097392", "comment": "Malware payload (Mirai)", "value": "e2c28dead32232ce97c9a7f814ee0157a40375f8ea331d0fd126974d028f1f7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144045, "uuid": "254407bf-6b65-4a4b-86a3-5ab818d32e5a", "comment": "Malware payload (Mirai)", "value": "9cf3c454f6d7640c4661b9f98f736dee9916bbcc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144045, "uuid": "02cbc044-fb79-487c-a4d3-66347b2c14ee", "comment": "Malware payload (Mirai)", "value": "5aefdf41e7279008c541fa7187a18fb44ad459b71299bfac692fe52d987e042cd278a409cfde04bb39965d8dc2d4d91c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144045, "uuid": "ee935d9f-e911-4c4f-80e7-6cbdfcc74fff", "value": "T169336B65E8294D64C14E01B4B82C8D3E1FE3E4C5A6823DB26ADEC271544FADCB904FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144045, "uuid": "828d12ef-b1be-45f5-9510-9e0397436bd1", "value": "1536:3a+BiFCYXjD2/FuhFeKbwBx/oURAYEYCF:3pioYXOt4cYyAYEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675144045, "uuid": "57f99444-3c09-48ba-84f8-ff24a0190609", "value": 54668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675144045, "uuid": "56e1f2e5-73e3-4b79-a80d-3f95b272e1bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144045, "uuid": "cdb757ff-c986-49ef-acb6-01085c28c827", "value": "4189cd7ec1e82b2280cfdccd878932f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac38b38-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140658, "uuid": "d4aa937d-4064-4f77-a37b-70853ee8d58d", "comment": "Malware payload", "value": "e123c0427254a0a9cd55541046ab0e1c", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140658, "uuid": "916f2186-a90a-415f-b7d3-cc5d2804f3f4", "comment": "Malware payload", "value": "e2cb1ca0690ce027731d33ab4c0f1b6e9aa47aacc74c749ae162eca5107985eb", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140658, "uuid": "bd5a27e2-bce6-4a35-8ecb-aaebd5491de8", "comment": "Malware payload", "value": "987c16af087ff78f00841e1e2a984a5a58d8c7ff", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140658, "uuid": "e544d0c4-de17-404b-ac97-1354e5077e0c", "comment": "Malware payload", "value": "df4196ae7ba62e9b20dc56bcc90a24bafcceaba3b649dea58bb9eb37b71d8ce5c0ddb037a02587df925d3f8ee39b7a17", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140658, "uuid": "51ed76a1-b24d-45c8-93cd-6fd616628b67", "value": "T127363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140658, "uuid": "4e0be0da-dbf4-4991-b00c-65b8a5f3453d", "value": "98304:Ov4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXZ:OvpvFa+g8RWLdPk/84tCEr0RtNiC5eSg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140658, "uuid": "1ba92350-5f64-4dae-afaa-ee7278e001ed", "value": 4992000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140658, "uuid": "1f914134-1780-40cb-8d34-f0b91cc5133b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140658, "uuid": "1286c059-7d41-4268-9d0c-2ef86b4bf5b4", "value": "e2cb1ca0690ce027731d33ab4c0f1b6e9aa47aacc74c749ae162eca5107985eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aa78139-a146-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675155932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155932, "uuid": "18b3c364-def2-4d1e-8519-e134b7658c54", "comment": "Malware payload (AgentTesla)", "value": "91d69ed82c3f65c41672e144b3a690eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155932, "uuid": "740c82dc-2ddb-4448-9222-da625f46743b", "comment": "Malware payload (AgentTesla)", "value": "e3197ea24c7913bd2e146bc2b16dde76bccf5f76c3fd4b9304b66e7e355ba00b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155932, "uuid": "ef3c8ca0-63fa-4109-8845-4f60176829f6", "comment": "Malware payload (AgentTesla)", "value": "1de2f553ff9fb2685e634647f3bf4a350c5effe2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155932, "uuid": "e71964ef-c670-43d0-abf8-67ec7a8605ce", "comment": "Malware payload (AgentTesla)", "value": "c69d806fefd26fbeb30d61e06afb05c79f138659e8278cce73f01600c6938359965a58e340c49ec351d78916a1c391b7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155932, "uuid": "10694517-6fea-438c-9f33-9e6df5446cc2", "value": "T130E402597AE1DE42C19C45B8C4D7402903F29A87A637C7C33EC9A6D70F02BA98DD9F49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155932, "uuid": "aa59aa12-e8ee-4d52-84a4-c35db31a7209", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155932, "uuid": "c12112ff-9775-488e-a941-e64c8fb40b86", "value": "12288:5YnxbxJWWJ9tSQ9whr2dYdg3gXVvM7HBMEvV7tB24G5AJy4D9yoUT:WnVxAWQQ90rwP3g67hMEp2hAXBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675155932, "uuid": "c9aee521-5cdc-43a2-8b97-de893c1888fd", "value": 689152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675155932, "uuid": "a9df6697-b8f0-49e3-845b-937eace172cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155932, "uuid": "9f8decaa-27d5-4d9a-8b3c-1442494a4dc7", "value": "91d69ed82c3f65c41672e144b3a690eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1219a1a-a1c0-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675208449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208449, "uuid": "8dfc0f0c-ebaf-4794-bfa7-950c80bd3c1b", "comment": "Malware payload", "value": "40e2664e1f22dd9c72636ce686797da4", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208449, "uuid": "ff2b1ffc-24cf-485d-b83b-ee88a789a69f", "comment": "Malware payload", "value": "e33aee583553de9a48fbffd5a545ddce4af362aeb4b44ace89209ca8e94306a4", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208449, "uuid": "8db7ef13-ab98-4471-9800-628a0bad7f1e", "comment": "Malware payload", "value": "9e0f963219f520a6c9193bb3fb52900e779bafcf", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208449, "uuid": "328539a1-7095-4416-8a6e-92ad554b4083", "comment": "Malware payload", "value": "78463a8a3d0808c33c9a6b90e4d39300ce160acc9e06fbb4fa68d58bdf5b7a806d261c50df6603a52bf13ddbc0c90e07", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675208449, "uuid": "8d48c508-bdaa-4c15-bb4c-0e6edbac2680", "value": "T1EF5423E0CDF41C5CCC93CAAADED1C4782E780A76A2F987E6B4A17D833EE151EE144549", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675208449, "uuid": "3314afdd-6dea-4c38-b6f7-70ecce361af8", "value": "6144:zjKmRn457N1rjHHM4IMANDMcUTg6TYN1QhUf5qoT+MgOe06I6nP3:XKYn45p1r7sEA+TgeYN1QKfMoT+4T6IW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675208449, "uuid": "622abb81-a060-4f45-8096-abb887024251", "value": 297339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675208449, "uuid": "388b292c-1019-4d37-8c24-fb7ee690c96a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675208449, "uuid": "eae3feab-71b4-41fc-9658-665f612f6e55", "value": "91f7c342ce163fe12c018a5068f921b5b78574cf05927bb85876be8484a2c237.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96f5b61a-a0fe-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675125083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675125083, "uuid": "e6392faf-d86f-4e7a-888c-c1f838d9775d", "comment": "Malware payload (GCleaner)", "value": "905eb0187344f068860f1c15b8ad6cdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675125083, "uuid": "31ace413-be3e-466b-af81-f7eded89bddc", "comment": "Malware payload (GCleaner)", "value": "e356cf8119ebd0d55db3c840eb42abd744b828a3e1367b2ee732e43624b616c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675125083, "uuid": "ab082c7d-8730-4b66-b4bc-e046b6298496", "comment": "Malware payload (GCleaner)", "value": "fa458f1fa92ae18b31949145f7144cfc3a8a7a3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675125083, "uuid": "ed76c4b1-065c-4c64-b30c-27e1cea5156b", "comment": "Malware payload (GCleaner)", "value": "43b40e3b8ae1d35797095db6616bb252d2e66ea06833a94c8a994f13681fdf7d40e9ba770bf2c1fdfcd75f41fc96a20d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675125083, "uuid": "194f918e-d0e8-4b18-8864-206d67bde5b1", "value": "T1DCA533A980F38932D251EB30547842A3FFAE6C6B3DB2E553715EFB4E0EB7660940C215", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675125083, "uuid": "3398b284-2958-4a0a-8926-31f81727bb4a", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675125083, "uuid": "0390653c-d80a-4d79-9a99-6bbe60df43b0", "value": "49152:2cgQaPUI8xdXm5/wJG5IqLDTI++1xeKCX9dnseLCgv2MR:DgfPXsxm5/wkLI++1xetvv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675125083, "uuid": "7fbbebcc-3308-4c06-9b54-acb7ab705a0e", "value": 2159061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675125083, "uuid": "cb2da297-adb3-4bc7-be51-27717a063a09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675125083, "uuid": "1e5e91fe-e308-457c-b368-e2200beaddcc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0c5b67c-a143-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675154788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154788, "uuid": "05103c45-9183-42d5-8622-c45a49f91d61", "comment": "Malware payload (Mirai)", "value": "886f135354053424dbbb4d8c19b88cdc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154788, "uuid": "1d96857f-9caa-4d94-b161-b4627dec40d2", "comment": "Malware payload (Mirai)", "value": "e3926c0f67ffad33858fff9464db4f5b22de0a0497acd8d1d8520aa6dd1ee436", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154788, "uuid": "d529320d-7d40-46d6-a44e-bbe2b9014239", "comment": "Malware payload (Mirai)", "value": "ffce5ecd6a18de22330e6f83928a80e922563067", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154788, "uuid": "72d5797f-40da-4420-ade5-b4da9c77806d", "comment": "Malware payload (Mirai)", "value": "bc9c06099d16735a02367505610de76234120bb26287a93c43a0302b412ef58a45e768ca236eda2b842e1ffd4cf38177", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154788, "uuid": "7196d591-44b8-4f0b-a49c-a23985c57e25", "value": "T19943C7A0BC824D2AC5D817BAF57E12CD332073E9D1DB7223C8155B547ACAA1B0D67F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154788, "uuid": "2a991f13-ed64-4dce-9fed-f4caa1d63613", "value": "1536:+FyVZPynVpEGN1kk6k1RSIqfzfDBhb0Xc/hSZX8S2yI15Ta:kzVqGMk6UREfjHAs/0ZXTdI7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675154788, "uuid": "5cb380ca-6bf2-4d42-a84d-feac5e6f9e4c", "value": 57564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675154788, "uuid": "6f80ec6e-c1ed-44b0-88dd-7adf42846455", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154788, "uuid": "241fa3d1-3955-439f-b33b-36a37783ffaf", "value": "886f135354053424dbbb4d8c19b88cdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7175f55c-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140482, "uuid": "57a1c3c4-08c3-40da-98ca-088a01173d67", "comment": "Malware payload", "value": "cd98f049926cca6b622f15271b7e7e65", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140482, "uuid": "365233b1-4fe1-4834-8ab5-232469cf7333", "comment": "Malware payload", "value": "e3c0901983c0689d907d4d474a28f154d992190b88143b9dca1313c6c0f6452d", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140482, "uuid": "91fb96e6-f18b-4261-8af4-1f41d3b9d4a3", "comment": "Malware payload", "value": "b2d01db98f1b878eb622d7131962ca90e5c66f6b", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140482, "uuid": "a933fcb9-3703-4ea5-a089-7c0683c8e613", "comment": "Malware payload", "value": "dc649b11fc8fe592c73eb34eb045bac98ab3609192ae90a0535d877134160e4025c08c4bfcbcfff7e22ad9d878647cff", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140482, "uuid": "f69666ce-0704-48ef-826e-c92e049fa6df", "value": "T191363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140482, "uuid": "268c38cb-a557-419b-9a74-6fbcab88bbfc", "value": "98304:Av4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXu:AvpvFa+g8RWLdPk/84tCEr0RtNiC5eSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140482, "uuid": "18626702-1d4a-45a4-859b-3a9869a144b3", "value": 4993024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140482, "uuid": "a59b944b-6636-4c67-b1cc-7aac5ef6c3f2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140482, "uuid": "46f5930b-467d-4431-8250-508c6013b843", "value": "e3c0901983c0689d907d4d474a28f154d992190b88143b9dca1313c6c0f6452d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd19a12a-a10a-11ed-88f6-42010a9c006e", "comment": "Malware payload (DarkCloud)", "timestamp": 1675130301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675130301, "uuid": "8413b23e-bb6b-4099-bca4-ce90220da8b9", "comment": "Malware payload (DarkCloud)", "value": "580a4621cd59c4630d988f8067cc185d", "object_relation": "md5", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675130301, "uuid": "7045e296-7c4e-444c-9a7c-b0f881748677", "comment": "Malware payload (DarkCloud)", "value": "e59bfbd9a59b19bdfc2c7435858396d1ec99e5ddb5cc59c3c98e8c2e1bd5c947", "object_relation": "sha256", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675130301, "uuid": "ad0b76e6-19f1-45d5-ac9f-f59848183a4c", "comment": "Malware payload (DarkCloud)", "value": "592187cd5dd880170d83d080238685d6a496dfa3", "object_relation": "sha1", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675130301, "uuid": "20900b3e-4700-46ec-9da4-11d114561c2b", "comment": "Malware payload (DarkCloud)", "value": "9285270924db817ac3411546ff70fb943357e02a05f6a473cfccb354f4e468464db9c3939841cedcea6eb8cab42859cf", "object_relation": "sha3-384", "Tag": [ { "name": "DarkCloud", "colour": "#D119B2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675130301, "uuid": "d109b66b-bd04-4d48-a991-973395f87eb5", "value": "T1D225CF0179F380E3F8C7487A513976CC9E2035126753E23766F977A462032BBBAD6762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675130301, "uuid": "1aeab256-0baf-404a-933e-cc0dbf0605b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675130301, "uuid": "9997a178-38f9-4520-ad65-3a6f501c1464", "value": "24576:ypZlh1cconBuOhjSXsxTNE5wrqhTPVcN1K1rtE+Wy0jFS124M1v9fJPqpMQD:rxTNywrCPVc3KptOy0e24MFSpMQD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675130301, "uuid": "ddf00344-db2e-4e3a-bbc2-352da9e72fa2", "value": 1010688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675130301, "uuid": "16e2de06-012a-42bc-9ef5-64ce1639ad35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675130301, "uuid": "e55f5b2f-73d0-4945-bb26-c56aa2c1f114", "value": "pago AFIP VEP enero23.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9e077f1-a0fb-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675123933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675123933, "uuid": "4dbd52e2-28f1-4686-ae42-d02984a70c3f", "comment": "Malware payload (Smoke Loader)", "value": "5a059ed72a6871e8e9c8f6124ac5be9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675123933, "uuid": "2276f6dd-7a28-4aaf-af33-d043992ebf98", "comment": "Malware payload (Smoke Loader)", "value": "e5a7f5ebac116313c1e61e55fd4db09ae60f7762bd4110ff43d6032fab605e27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675123933, "uuid": "31cd4f88-2bdd-46fc-8ed6-a7cc0ee08a31", "comment": "Malware payload (Smoke Loader)", "value": "e74b28cb61e542c79d84b4cca737f33f4e680ca6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675123933, "uuid": "282c415e-5f84-4395-b6ac-c4b1b5da69b3", "comment": "Malware payload (Smoke Loader)", "value": "ed190d95e1b9bcdef86be8722a52c8f5bf6ddf3723c0f0b33a0245be70572df70f48f749c54e908ce629ee87124c89c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675123933, "uuid": "4badaba5-ed90-4a28-828b-0381ec607b42", "value": "T133F3E026B960D032C12210765835D245BF3EBA721F769847BB842BFA5F602D2772F35B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675123933, "uuid": "7e404f22-3b91-4d46-84ef-e3260deed6f1", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675123933, "uuid": "1c31b4f0-7aa4-4104-a569-a7195173ded2", "value": "3072:Sj1huo38LoYhiUx5YHnzfzmUSY4w87cY8MWQCtY:FLoYhiU8Hzfz3pOB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675123933, "uuid": "2ea8a394-7365-465a-855e-1c449ab6d7f5", "value": 171520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675123933, "uuid": "3398ca64-f93b-49c6-8abd-f816ba3f5dac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675123933, "uuid": "6ae2f3fa-f447-4ff3-9947-d1fb2b21a76d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3acbfbdf-a177-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675176897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176897, "uuid": "fb2fb900-ac15-40af-85d1-bda95ca87d17", "comment": "Malware payload (AgentTesla)", "value": "10b65ea01b35adbd6fdb59571d8b4c34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176897, "uuid": "54f5194b-8090-4dfa-a848-62d0be956202", "comment": "Malware payload (AgentTesla)", "value": "e5b47dfdce0b43fbef23cf393838dffe7ea5173e73a783d881963e5b49b4f3d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176897, "uuid": "16793356-481c-49dc-8716-06bc71b41507", "comment": "Malware payload (AgentTesla)", "value": "13a1ac1d302365e217169ac4da59f8d2300a463b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675176897, "uuid": "234cb945-8919-45a0-9e41-45e9ce3b0ca8", "comment": "Malware payload (AgentTesla)", "value": "8133d7f860ae6b98690bb7d6cd6a1ea8a74c3294148b491da4da11328bbd7693de73f00311b63e529043826371500fbe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176897, "uuid": "467f1630-5675-4545-b6f6-d8b876116c54", "value": "T1AEF402A94338CFE6C56983F965F400252B30256AB087E7490D9AECD5CD873F08E7766B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176897, "uuid": "8db639ee-5a06-4707-bbdd-b5bfdd840079", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176897, "uuid": "d21cdee1-c2ee-46b0-8254-98f6774da95a", "value": "12288:5/5odtdWeh3ih9HA24CkOaag4rWgcPvU2zL+b8Mf3DjmTgNA:5hodjBYTA24CmNgcnUH+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675176897, "uuid": "f18e29de-2dd7-4cfa-986e-d707a37820b3", "value": 738304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675176897, "uuid": "68d87483-525d-49d9-a32d-fb2b6f527b41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675176897, "uuid": "ea5cc91e-7a41-48e8-af8d-00e0d9f9171d", "value": "PO_300000000010134016_DD230004898876-pdf.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6903ff59-a146-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675155930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155930, "uuid": "cc0f308b-eab2-4a7d-81d5-30709e345339", "comment": "Malware payload", "value": "d2269e91a52286492191f2361e236da7", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155930, "uuid": "273154f8-d680-4a51-b892-bd888ec90558", "comment": "Malware payload", "value": "e6cfcfc964c7e9279e76748fa9b117f05c6b18aa3e43c3b39369d0115b53d609", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155930, "uuid": "43a843da-e0e4-4557-9b77-34e31a7432c5", "comment": "Malware payload", "value": "af497c808db68e5c7d10545271146d265539b804", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675155930, "uuid": "6b995701-7ebc-4974-862a-049acb86b364", "comment": "Malware payload", "value": "daefd06a764c61368db9b8e629042368287e86841a9acbeb21679c28d22ffaec11695339df0c17708ecfcd7ecf669970", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155930, "uuid": "858758b4-c0fb-44fc-813e-f1d7bf5fcfc4", "value": "T1CAA42323E3B977C207EB1BA5566FD5311FA2200B09D91D78C7B7900E26FBC9189E2674", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155930, "uuid": "1a3d9d8a-ec3b-4363-9a22-1348f589d3bf", "value": "12288:dmeRY16Fpmg/TzDvvX2zzJN2K4xwR1b5/t:dme+16rlr8zH2K401Zt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675155930, "uuid": "67ba2f93-e813-40ab-a89d-8047bf1193ec", "value": 465504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675155930, "uuid": "f9447f89-4015-4049-99c2-6dca9c86d00a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675155930, "uuid": "20227142-8ecf-44be-86b9-bcdf5d34f555", "value": "STOWAGE PLAN.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80d657b1-a1a9-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675198490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198490, "uuid": "87d298a8-640a-43bf-a2f2-3c85dc8d787a", "comment": "Malware payload", "value": "b8068836af35aea7dacf48aeee974b5b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198490, "uuid": "6bc416c7-4c69-4b22-abb2-4fd77926b5f9", "comment": "Malware payload", "value": "e70dd54b6b5680230a7af30a6b127ecb60c32ee9f0bff30d8d79a2a7ed9c3ab4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198490, "uuid": "38bde690-2cec-4662-8469-fe8946ac8cfe", "comment": "Malware payload", "value": "9cb6d42676cddf945767e1ed3fb4c861a37fbf66", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198490, "uuid": "08562d6a-e8d2-4e65-8fa0-5ae154809391", "comment": "Malware payload", "value": "c446e305ad85231ba7b84ff492b7063ff1eee83abda743dc5d324066f287b78ef8eb53b7ec9b22061d503b77f0c5e9d3", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198490, "uuid": "3daa89dd-a38d-4dc6-80d4-de757311bf9c", "value": "T17793AD29D831C135E8A290FFCBF786BD5D644B201303D4D797C15D49AB9A9E6F832A23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198490, "uuid": "805f509c-5ddc-45c9-afe6-ebabdae05fec", "value": "f86dec4a80961955a89e7ed62046cc0e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198490, "uuid": "4b2cf018-2c6c-4bb2-bb89-2fe16868d93b", "value": "1536:tBwl+KXpsqN5vlwWYyhY9S4AS+cdKlMm4O3XZJyvAT8JpGegG:Hw+asqN5aW/hLg+Hem4MXZtT8JpG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675198490, "uuid": "6ec9e1cd-cf7a-4766-b08a-a7062fcb8cf1", "value": 94720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675198490, "uuid": "38c232e1-796f-4d06-8425-3a441b76c2ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198490, "uuid": "c5817de6-43ca-4406-8caf-f6b6282868c1", "value": "2023-01-31_b8068836af35aea7dacf48aeee974b5b_crysis", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b75169e-a1aa-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675198910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198910, "uuid": "93df0ef7-b448-467e-9a75-8cb147b489fe", "comment": "Malware payload (Loki)", "value": "025207095ce4531ddc16d0c1dce457cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198910, "uuid": "1da24c1a-a463-4e00-a2fb-0536fe5b1127", "comment": "Malware payload (Loki)", "value": "e7ecce5580d7ffce80b2921d953d528aeb9c1f724a49d91db380478c5423c3f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198910, "uuid": "29b810e2-d77e-456d-8ae2-9b307bf5f2c8", "comment": "Malware payload (Loki)", "value": "afb61d96ff8eb5974109a1fdd59559f1ca7cf6db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675198910, "uuid": "405cb539-f981-4116-a450-fa9662b53cab", "comment": "Malware payload (Loki)", "value": "128682e104c7f15bb7e2d41504bb722e7c2b912321ddbff9e317ad99d25c97e15afb87620cfe5c86e8355c61c550e98d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198910, "uuid": "469d3795-7cc9-4aa2-8a05-56e563a412a4", "value": "T1E1A4131823F543BDD27A47BE83F2B87083B8AA8D6F4BD7154E6454FE99477140B21287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198910, "uuid": "4ed48d22-61bf-4c3a-a17d-711565ecf2e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198910, "uuid": "4bc1ed51-3888-4d5b-a800-5804b6290778", "value": "12288:6r8i69LjbTQmvpuAHoZ/A/UrrWXQG4dWtb9i7+pvtCWtO:6r8i2bTDMSqrWADdObw6Rch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675198910, "uuid": "003064c1-ba17-45c7-ad85-f4b13a4b09fd", "value": 488448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675198910, "uuid": "f9f4cde8-95fe-4c8f-8b0a-3817142ee17c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675198910, "uuid": "9ed74036-09c9-4ccd-8998-ff02418ddc38", "value": "kellyzx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fafec4de-a154-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675162187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162187, "uuid": "d7663f1d-7cbc-4660-bfe1-d6cb1c94cf13", "comment": "Malware payload (AgentTesla)", "value": "daee5baadef83967f807d6fa4d3d5861", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162187, "uuid": "cdb9a5e1-5485-45b9-a032-63b851afef5f", "comment": "Malware payload (AgentTesla)", "value": "e8ce64f1b350b774fe7f3704083b2f13bfe49ce8c50fec7580935f21b77e7257", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162187, "uuid": "6af36e77-7dec-4324-817d-d2ea824e1c70", "comment": "Malware payload (AgentTesla)", "value": "f7b73eceed960341ce666ee1741c0ea2b846efea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162187, "uuid": "b62c0268-f220-47ec-90e7-58ed6aaa6615", "comment": "Malware payload (AgentTesla)", "value": "4f5b741bc03891c86d1fed760daad35dd2fc17d4196f92334d31c09f6007f24458b20f726422e2b78b470893140d329b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162187, "uuid": "88df0e11-b5f7-49c3-a14d-949a4ecd647b", "value": "T100F2195877EC9733EFEE43BC68B425824BB2A937A201E7082DCC78E965923D74650713", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162187, "uuid": "877156af-4076-4bf5-8f73-bfc124574a5c", "value": "384:LOhNuCCfNLxQk5PAfwEwhkPdtiaDQBggKWIUw34KljAAlGOBN3uWvENCKvFUkmlW:LOWLxzAfn1ixxKWnih4LW+k2RH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675162187, "uuid": "8e8ee943-7367-4de1-b58e-15111292b0f7", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675162187, "uuid": "bdcbcd63-ba3d-4179-a6a2-0fda82495dc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162187, "uuid": "2066505f-e93a-4567-9f35-fcc554ef85b8", "value": "PAYMENT SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8892826-a14f-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675160009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160009, "uuid": "3f672923-e90d-4082-bfec-0f99a8e3cefb", "comment": "Malware payload (AgentTesla)", "value": "ee163e2c766f6401f4aeaf29838c0c4f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160009, "uuid": "b6a64cb7-859c-4d56-a235-4ebbf061b9ae", "comment": "Malware payload (AgentTesla)", "value": "e97dde60762e93941be041f414bc2b028dcc806ffbb945ad7907f16d2ac292c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160009, "uuid": "21472a5c-957e-4fcf-8ca1-46efa88e51f0", "comment": "Malware payload (AgentTesla)", "value": "650acf810cf320e17f7951b34789ec3882d60483", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675160009, "uuid": "25a6b53f-69a7-4cd2-b489-824ea9fe3a0f", "comment": "Malware payload (AgentTesla)", "value": "6c9abb7271666f7d762afa94ce7c07466925da8b39be3adfe832f79eca3796797b8df240c5fe061349ca719ae236fa2f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160009, "uuid": "ec9353bf-8466-4b45-a65f-988f1907e8ec", "value": "T19FF2085877EC9733EFEE53BC58B425825BB2A937A601E7082DCC78E955923C74A10723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160009, "uuid": "d08569a3-0e9a-4566-b75e-79d5c644b6b9", "value": "384:SOhNuCCfN5nw2wPS3wEwdVA+YhGuggKWZUw34KljAAlGOBN3N3vEnCKvFUkml8ka:SOW5n4S3nwYkuxKWqihyLW+k2RH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675160009, "uuid": "adcaf6d4-5621-4c04-97b0-0e7cf20799df", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675160009, "uuid": "80b1ea65-563f-4b27-8757-469735010ed3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675160009, "uuid": "9b91e45a-9ab3-4af8-a6b4-96c339cd636a", "value": "DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e7cd67b-a13e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675152476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152476, "uuid": "b842eb8e-8e95-4907-8fcb-9702402c4334", "comment": "Malware payload (Mirai)", "value": "92f8e531fdd301cc45acde510a2170f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152476, "uuid": "bc694a47-b80f-484c-9234-0d177f0f7fa5", "comment": "Malware payload (Mirai)", "value": "e9e137b1784a095384274d6e864d36b8c373cec83703dc4754947789f96e78da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152476, "uuid": "b67c659b-0b59-42cd-8f72-ec36bd928ec0", "comment": "Malware payload (Mirai)", "value": "d80c5a659debde79e5f17108ab5a724aa7c2fa6e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152476, "uuid": "054dfc6e-5719-4bec-8841-a193a1e9819c", "comment": "Malware payload (Mirai)", "value": "678c4621f78a9ec229a22a759a296b52b8118a80f68a32284cb09f5a02c618aa9c1f8c15f14dc614e60dfc6e3bf6bc30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152476, "uuid": "ea975e27-1823-4751-bba3-77c94af2a52e", "value": "T1F5A2D01576632E56F3ED1C3DC96A8267BD670BFCC0F6327579416620C90D24A3E38A4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152476, "uuid": "1988d80a-f01b-4483-bd99-f6051e45b774", "value": "384:TvtIoZxrSniaXs+qx+bwqPX+VOcFd5fHq52lxjBQKhwhymdGUop5hs:TvQn4j+ZO5fKAlxlQcws3UozC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675152476, "uuid": "7c8a4aca-3ef0-4b71-b610-15d098fba0b7", "value": 22168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675152476, "uuid": "802f32f2-7ac6-405f-9834-2425d6249344", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152476, "uuid": "165b99a7-55d1-4e29-8e26-28601ae2b75f", "value": "92f8e531fdd301cc45acde510a2170f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a617dd60-a13c-11ed-88f6-42010a9c006e", "comment": "Malware payload (TeamBot)", "timestamp": 1675151737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151737, "uuid": "2eefc638-48d9-41fd-9e0e-c2f2b36f0363", "comment": "Malware payload (TeamBot)", "value": "b00f39990129ba770f69fccba3fcab0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151737, "uuid": "e7020286-71ea-4168-aed4-2b1f321aecb7", "comment": "Malware payload (TeamBot)", "value": "ea68ed8d82539adbb9fdc9aa78b2b61768c60c234c7e328b8793d7092bc851c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151737, "uuid": "3eec076c-ee01-4ff0-884c-75d97f697f18", "comment": "Malware payload (TeamBot)", "value": "502088d354a0bca21a36fd5f541f2e3258b7738d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675151737, "uuid": "5a60fa9b-9065-4e37-88db-ee03d55393d6", "comment": "Malware payload (TeamBot)", "value": "09da2d7f83d6b6ee83804194eb127eec740f40846a90f24a49da8803d2638a7a7b94e3403d11b84a5dba6c9037c381ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151737, "uuid": "8ff81120-6210-4fa3-a2c5-6c3c753f646b", "value": "T165548E02BAD1BC41F566CA75CE1EC6E4F51EB591CE08A766231CAB0F25B31A3C76E311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151737, "uuid": "2c223f2b-6d11-4eb0-b441-98b38060581f", "value": "a2c8bd590ac12702f85d4107db46f8f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151737, "uuid": "92030e90-f7cd-48c2-bd41-8ea802612998", "value": "3072:OsuIHYbCLpB7R4qKPV30LMYWfApuYkQubaUYXYm7f43H7BFFsHERCDR1:YOYbCLpAq43tYLpuYkQIFM7f4VDT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675151737, "uuid": "b7fd206d-e712-472c-9324-1983e702cbba", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675151737, "uuid": "d17f2fee-a7d6-4a74-b173-61096065568a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675151737, "uuid": "ebbd1b14-1b42-44c3-8aa6-e9b49acd5299", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae727dd-a17d-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675179609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179609, "uuid": "bac2f93b-03d4-4e19-a5fe-307cbab71caa", "comment": "Malware payload", "value": "0208817d1a0a9bd2b5ba9bb87eb934d6", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179609, "uuid": "fc13974c-77e6-4207-be98-e156750eec80", "comment": "Malware payload", "value": "ea872a29ed2189432ff3f8ce807412eaa200928fadf9eb918518be5d5bd0ca1e", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179609, "uuid": "8ac006ea-4074-4420-84f3-4c5cb9006ae8", "comment": "Malware payload", "value": "ba190c8cfba453e163dc0035ece7d3a1c0c4e08f", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675179609, "uuid": "b1cf7825-f072-47b1-9f21-0f64b1c6757b", "comment": "Malware payload", "value": "08451e424a71b3d78680aca51d1365fd4a73414fd01290dd644d320ac9000f9dde154caa4ee29f121c82b2dfb7ce99cd", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179609, "uuid": "4c9655f2-cd83-426d-9abb-1e436db862e8", "value": "T12FF4230AF95C205CD498108C3950BEF5A998DFD0CB4CD1DFB259541B630CBB3DE6A6AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179609, "uuid": "aeda5bab-f127-4570-b92e-37a51aa0c201", "value": "12288:yKKYkbSL7/TaiQmAyBkK2hA2nczTsoQ+g7GuFg5+GAoWv6RbrjUyHzvyTA:xK7SL6LmAyBk1A2nqBsGT5W6RbrjJzKA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675179609, "uuid": "096faa8c-e31b-404d-9bba-8ff33b3e6985", "value": 747869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675179609, "uuid": "1db23758-9c6f-4540-a719-fdbf879af758", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675179609, "uuid": "037e3e86-c277-44d4-8250-f4b043cfd7ab", "value": "2021-06-02-fake-gzip-file-from-supplementik.top.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62608a28-a164-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675168803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675168803, "uuid": "cd56e2d8-ef07-4dae-9d32-72c771e9d1b6", "comment": "Malware payload (Smoke Loader)", "value": "8fb01de2c5bf7c12bd6524ef482c871e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675168803, "uuid": "4447624d-8fd1-445c-bdff-3d63b7cbb377", "comment": "Malware payload (Smoke Loader)", "value": "eb3b0c091e4ba48c28181e99e4e03daa4d69ef14aaa7375f718a17990afc3ce9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675168803, "uuid": "56bfff00-7ae0-4503-a4e4-de28d69aeaac", "comment": "Malware payload (Smoke Loader)", "value": "10286e9349a1151288bc31d1cf49b8b99f7b71b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675168803, "uuid": "408cad04-6cbf-40d2-8991-988ef324a80e", "comment": "Malware payload (Smoke Loader)", "value": "08823b1928ed8332c68200175b4f244e31ff8cd4c42b58ad9b2249119f1c3972a39893de1f4012a5b668d382931b695d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675168803, "uuid": "edd160bf-4595-4425-99df-072f33788bc1", "value": "T17B548F82B2E1BC41F5674A75CE1EC6E4F51EB591CE18A76A23086A1F25F31B3D762303", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675168803, "uuid": "fa6f114c-305c-44bc-8716-be19179bfbe9", "value": "78339dc1c5de0e493ea2b28607ce356e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675168803, "uuid": "765d42c2-2939-47c3-b1d8-4e91819ee4dc", "value": "3072:5muqy0K9LVkoRoiMOSng62vLsggO8aaJJgDVPMkABX9l7f43H7BFaRCRCq:bV0K9LiF/PSsgx8/gD4b7f4V06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675168803, "uuid": "f42c23f2-f51b-40a2-8174-84350fbe60e3", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675168803, "uuid": "9e5d1c71-97fe-4ec1-a7d3-36b2b7cb4d65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675168803, "uuid": "62aaf246-d130-45d4-b79b-7269cc5ca2fe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c7bd2c4-a180-11ed-88f6-42010a9c006e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1675180712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675180712, "uuid": "402094e9-7ac1-4a69-9e9b-5b1659b0d907", "comment": "Malware payload (ArkeiStealer)", "value": "05ddd41b70316164380ed7167d0b11f7", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675180712, "uuid": "e0fa52bc-d9a8-4471-9d6a-8f50835f1178", "comment": "Malware payload (ArkeiStealer)", "value": "eb792aefeecd5bf6d7464223729cc0c5b6de0c77e6e4bb4914a397cf14c15473", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675180712, "uuid": "12265ff5-ef49-425f-afbe-be94a1467621", "comment": "Malware payload (ArkeiStealer)", "value": "7351de26de050ddf22c3494a195842b6506698f0", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675180712, "uuid": "4e2e4c4e-9f3d-4754-8c86-23f0687429c4", "comment": "Malware payload (ArkeiStealer)", "value": "439be7fe79acb2ad9109e88c96adc85d68be2c848f40685f3edaf238d485503522c14a6a6be19ce90dbff6ef5ab0ab58", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675180712, "uuid": "2b623cf0-7fb6-435a-b977-4bef826b6b5f", "value": "T1F5E4BE3D37B664B0C567507D0B708E364ABEBD310E4336ABAFC43D6A9E706906631396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675180712, "uuid": "0af08dfe-5ac4-462a-bc8a-0203554485c5", "value": "ea3425e7a35fb163de9905f007d5a0f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675180712, "uuid": "3fb2a0b3-4d43-428a-a7c9-0ea3fa571167", "value": "12288:j/3T66QpF7gpLPRVfl98jAfkrtXuWLtrbSrVOSYqoVJUKXBkc7bIUxaotUd:j/3T66QT7gpLPROjAet+WLtrbSrVhYqX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675180712, "uuid": "ab47ac7f-dd62-4c50-a818-01ac787a9065", "value": 721920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675180712, "uuid": "f85e5cd3-ad1e-47d2-b582-89ae9c8ad386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675180712, "uuid": "05432018-e8bb-4aba-b711-f9a5bf115429", "value": "Setup_x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93413b23-a18e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675186924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186924, "uuid": "57929bdf-8ee6-4734-a0f6-fc559cd3db73", "comment": "Malware payload (Mirai)", "value": "22236418d66d092a868814a050662cb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186924, "uuid": "a96897d6-0224-4083-a244-8bd73ea3cf99", "comment": "Malware payload (Mirai)", "value": "ebab385a00e909ff7748edeecf15ffceba7748e9b0f9850142fe7ef8d5ed5ffe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186924, "uuid": "1caf8c07-0b1a-45ea-97f9-aeb147e1ab8f", "comment": "Malware payload (Mirai)", "value": "0bf047cdeb6ce406a32e0c305a2b9089c9e369c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186924, "uuid": "ae59ecf6-a36b-42d2-9720-b88120e87de0", "comment": "Malware payload (Mirai)", "value": "eeae017dda24ee31c32663f55fd6b2db3e44f91626d6c8bc95cdd3052c38f12e8917e479ac580e8dd72974490ac50e35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186924, "uuid": "70415da9-4e20-46f3-9e58-4f8d8a88337a", "value": "T1ADA3E91E7E118FBDF76D823447F78E25939823D627E1C285E19CE9001E6038D646FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186924, "uuid": "b2982b94-11d8-43c4-9ba3-efbdef3e6176", "value": "1536:+DdgrUgifAhAWUq1gt4h/m4iXGmLl5yDiywPveFpZNzJ:sgr7iIhymO4ajIiywPEDzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675186924, "uuid": "c0708d93-3269-4c53-8183-dda243d9be3f", "value": 97808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675186924, "uuid": "b0f97250-9788-46c7-94ca-60808515e672", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186924, "uuid": "e1629fef-7a72-48e7-b2b4-0687e49e8b3a", "value": "22236418d66d092a868814a050662cb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ffab502-a1bd-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675207024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207024, "uuid": "0545cb8f-f0f7-4f63-8fc5-2546a64cc9a8", "comment": "Malware payload", "value": "e1633196dc90f5a510c7c5f643e15b28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207024, "uuid": "f9d919a4-3335-4532-89fb-07c37adca13b", "comment": "Malware payload", "value": "edfd2ad8e08552a8f629f1e7ac920fab882c91da339a97baf8ec8014865c88cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207024, "uuid": "c4339442-b4ba-414c-ab0a-dd48701a59f3", "comment": "Malware payload", "value": "79c2295d7f5b251ff22531d3115adfe7b5a873e0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675207024, "uuid": "41ed5747-f2fa-4cd0-a7e7-92ba9832f01d", "comment": "Malware payload", "value": "444a69471986bda3e2f51d88da44a8d40baa99602de08d1154a184b06fec2c7c378babcf445dccb528816ece907f871a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207024, "uuid": "6442b36b-e592-48ea-9588-e87cd3c078ae", "value": "T103A533C7B6698873DB63DF3565317310D672FA6B2831D684B228F60F1B722F044196AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207024, "uuid": "a13eba33-6f19-4ccb-a8d7-37672bd63dd4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207024, "uuid": "d3dbfe48-5e23-44b4-8d16-83e9220e0f07", "value": "49152:C2X7/MS6sGm8+P02nEbXNOPB+Y5OyMhqN99PkjX4I34LCgv2MR:drEV5eXn49Opz/M079oX4I3wv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675207024, "uuid": "5270d773-ffc9-4420-922d-56a6655a3c3d", "value": 2185101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675207024, "uuid": "cd442801-72a4-4fe5-a0dc-e4fb73a40f5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675207024, "uuid": "1a6b9b5e-8798-4ed4-9aef-b431f08205a0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d12301b-a144-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675154943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154943, "uuid": "92e70d2c-cc40-4466-a989-ffe4e076ca51", "comment": "Malware payload (Formbook)", "value": "ee87f6d9f759e25bb73978b9e2d83f1e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154943, "uuid": "ba41dd64-c503-444e-8cb3-6c0f8f269504", "comment": "Malware payload (Formbook)", "value": "eed05f91ea269ad8faf0e1374f745f9408c23f4a2597140b1fb0a455785d5aab", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154943, "uuid": "9170e53e-aef9-4963-bf94-85c56895154f", "comment": "Malware payload (Formbook)", "value": "fd2fc4f671008a683a69efc39208516302d05c93", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154943, "uuid": "311ba6d8-1629-4cf2-841f-1ecc136cb9fd", "comment": "Malware payload (Formbook)", "value": "49b33df97145c9c9dc8462dca18f69ed5ea5660d374f423ea4be593a1b18801d6f16b5bf1fafbb68253795f4c6c5a229", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154943, "uuid": "32c777b7-7d7b-4a21-9484-4ad551795296", "value": "T151D4333E73C13002015CB0A52EBED856A955DA4EC6D2D1F7B7F88D26C6E573892A7F08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154943, "uuid": "604f909e-7f70-414f-9d17-731fdd7ce5b1", "value": "12288:dg9DcK2VBIWh/csVnbYjiFRO++WEktvrZzTAnQfs8ErT0STNhvc7ftVaq:dg9DsX/hbYWO++WEslzsh8E8ST3vAVYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675154943, "uuid": "40b30457-05fc-4187-a6d5-41dd5b248c9a", "value": 611442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675154943, "uuid": "5283d4c8-819c-4775-9c95-519e1445f8bb", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154943, "uuid": "ac8fe357-aefb-4cc7-9c53-146cbb85b537", "value": "Payment Notice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95cdd1df-a178-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675177479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177479, "uuid": "937c75a8-56da-407c-b842-5849cfdcbff4", "comment": "Malware payload (Amadey)", "value": "bdb6c33b061292f300272de5c99d7c98", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177479, "uuid": "7948d301-35e0-433a-ab5c-116fe13c0af7", "comment": "Malware payload (Amadey)", "value": "ef4240728834beb8c8a5f3351c63da3a8a4be5fea4e4a1c7b4fa4ce6ae7660d8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177479, "uuid": "0d0e1b38-ae78-4cec-bb70-387f96fd0d6a", "comment": "Malware payload (Amadey)", "value": "9ca3e565d6480782bddc0595239e7eb95e79bc32", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675177479, "uuid": "5fbbfbbd-b4a0-40f7-b9cc-c1736716753f", "comment": "Malware payload (Amadey)", "value": "c7261f9e1db40b23fb2319cf14bd9bb1c30796f3e7aa5ea1ff98bf19a357be12712fafd96c8dd583800d04d49be0485b", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177479, "uuid": "fa4fca0c-2635-4683-972e-40162fbb502f", "value": "T1B5548EC272F27C62E92287729E1EC6F8761EB5424E187766221B9BDF14B31E1C5E3341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177479, "uuid": "67ea273f-1769-4740-afbb-3c28b6e8b6f3", "value": "e73db8d7bd9f9f6b2076d026a8fb8fc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177479, "uuid": "6b0c9e53-bde7-4f0c-86b8-3f3add80d0d0", "value": "3072:U5ue9S1LjiSRoMsqrKwBc/+MhynRrY8Lg9pmqPUx6WfQz86/xBpW3MM:1WS1LjYpgBcxyNY8LgrmqMoIT8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675177479, "uuid": "87473a60-2720-4c1b-bfd0-3ac304edb95b", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675177479, "uuid": "1d2d54f9-c4d6-41b4-a4b5-21f25347a507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675177479, "uuid": "c711849c-e8f0-496f-bb70-8efaaf7ed23e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a591ba-a1c0-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675208423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208423, "uuid": "8278983d-739f-41b6-b3e9-b9ea1d37a279", "comment": "Malware payload (RedLineStealer)", "value": "b1ac405734eadb4791ec53357f5b8823", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208423, "uuid": "0b3621ed-2e10-44ed-a074-6f27cf2bd7be", "comment": "Malware payload (RedLineStealer)", "value": "ef45c92c5f51405f1f95cda737f1ae4e3b3d5aa6ed0222aefb7e794badebd130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208423, "uuid": "e4dec4f9-abe7-4748-adab-5716bc3e2de3", "comment": "Malware payload (RedLineStealer)", "value": "ca353a02478effc1d6c4408bb21c365bcc443ab9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675208423, "uuid": "b019fa46-e654-44cc-8c25-519d302e8c32", "comment": "Malware payload (RedLineStealer)", "value": "39996ceedfaca2742d8158c1f8c0e6b7bb047b6e21e9384f90558cf521d13dcc779586337664902e6f7426b54c13a2df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675208423, "uuid": "e6c199df-1588-47f9-9952-1010909215cd", "value": "T1E654028517CB48A3DCA5EBFA9980B0CD23E6F26186D3AB5DCC46723C7D663B2944453C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675208423, "uuid": "e578c93a-605a-412f-be74-2866fee6dada", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675208423, "uuid": "2f1d2f59-ae59-4800-987b-b0a84a9deea5", "value": "6144:7eUw6bt5n2af3CtmUdchmANl+vOOQp+l++i+5sjozpvvG/E2O+C:7/w6JQcUdclNlYsx18sc8w+C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675208423, "uuid": "caef7898-7726-45e3-adb5-63304be96272", "value": 287744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675208423, "uuid": "9f837029-a001-4f05-aba4-5d73ca4de1d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675208423, "uuid": "090d1d69-8a48-4115-a021-e0cd0fe5e1eb", "value": "b1ac405734eadb4791ec53357f5b8823.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d96e562-a142-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675154166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154166, "uuid": "4919f8d3-aafc-46cb-b032-dfa5fe05edaf", "comment": "Malware payload (AgentTesla)", "value": "253b662e9a5cbcf51e0690f8a8c1d2d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154166, "uuid": "5a9f36f9-4712-4b94-941d-58275215c01c", "comment": "Malware payload (AgentTesla)", "value": "ef56792948d94d095892af7148e7070640012f3e46c72f3a11c18b1572566466", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154166, "uuid": "52ce40ef-c8c2-448e-99b9-b85abad3eeee", "comment": "Malware payload (AgentTesla)", "value": "1c1f2265d56d821710328877be7212241c9891e4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675154166, "uuid": "0d3d350c-c278-434a-be65-45300b8193c9", "comment": "Malware payload (AgentTesla)", "value": "37ef9bb4f2d7b32df2c55b070580c1a8e83269360df09fc7fa2d45d90bad6d2e2e39caf00f08785ab05be00b9a090c1e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154166, "uuid": "9d910138-aeb4-4948-ac95-f677b66680e8", "value": "T1CA642390802E4A70BC8AE7DF2C55BB184769D39AE561F0DAC21C00652727D929BCDFBD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154166, "uuid": "62333894-47de-4198-a3f7-ff157a268f4e", "value": "6144:S0J+TrEPMdaYEQZ9wRwy5iHaJp2egO9l7WyRGkPWx3e:SMp08oWjooAelZWyRGkPIO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675154166, "uuid": "fc62e158-501a-4fda-9acc-ff8a153d42d9", "value": 311816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675154166, "uuid": "3c6f3cc4-c5da-4c12-b03b-8d86d77d8fa0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675154166, "uuid": "55b7f6b9-efa2-42fa-acb6-873a8147aacb", "value": "SALES CONTRACT.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962a512e-a126-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675142261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675142261, "uuid": "b30317c8-71e3-4beb-a50e-0e8734a48eb6", "comment": "Malware payload (AgentTesla)", "value": "c9f9b05a5b70d88baf9afc54d65bad67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675142261, "uuid": "379628f7-04a0-4438-b34b-4cda2df661ac", "comment": "Malware payload (AgentTesla)", "value": "f1182fa55596cbfb96648db1a3e9f122e6245fc8fe851fa1fbd48d725254046e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675142261, "uuid": "49322a57-66dd-4320-81ea-5b9e5b0c360e", "comment": "Malware payload (AgentTesla)", "value": "e17c80decad1164ea965262fbbe423a90c1f6c33", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675142261, "uuid": "ce9b27cf-8917-4cd4-949b-4985865e1b3b", "comment": "Malware payload (AgentTesla)", "value": "51767173b6b85ab6d34a836619053990f80e7062bf2dc5cfda228d991d7ff991bf052adee8724bd9e80ec61b5cbcb490", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675142261, "uuid": "26a8a098-a1f3-4732-947d-24bb543f421b", "value": "T1B754121421F0D5ABF9AA4B701D3E8B9A4FD7AD1A2464B74F1360139D3E237908E1F392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675142261, "uuid": "43254d42-f6af-4eed-8b7e-327dbee6c162", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675142261, "uuid": "7aea4e88-01a7-457a-bcef-469bf3260414", "value": "6144:DYa6dpoXq/l87ic5lFuUr+qi9jBYeuROhDh/m9kOkEMDCC6ita:DYHpL98oe+qUqps6kOkEC9w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675142261, "uuid": "5c3b004e-c26c-49c3-85f5-9218e49b2bfc", "value": 294699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675142261, "uuid": "0a7ff066-880d-48e6-8c94-75962421e609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675142261, "uuid": "d4ad9e9a-a799-4912-bb1a-ff01de6de096", "value": "inwardremmittance9885021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1df0795c-a18e-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675186727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186727, "uuid": "1b8bba8e-3be3-4394-a5ca-3fb41c180c1f", "comment": "Malware payload", "value": "7569ad9336b177cc05a9e8f2de5d0690", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186727, "uuid": "a0cd9490-f4de-4be3-aa09-291576c01bc2", "comment": "Malware payload", "value": "f1305657666321f9d0ebf3fbb1cadd17cec20a7da5eeb073ce714a6262207b7a", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186727, "uuid": "b5c6d763-c839-44c5-b277-48164393cda6", "comment": "Malware payload", "value": "35528b015d396f5f2c79890445b02fb798ce3706", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675186727, "uuid": "4a4dd552-543e-49f8-b9b0-bf60d2086685", "comment": "Malware payload", "value": "d689e090cf10dc876a27e3a078ecd986e67e08662bcaaf584a843da3cb1c7242804cc3023bfac75542e28b5569e40e49", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordKeyLogger", "colour": "#8F67D2", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186727, "uuid": "bd4c9a54-1687-4c82-afab-6c5802581758", "value": "T1EB11CEB65B6E5012C5B1CB021D47929ECF6081A294C00715F8FD0E60DF39116A39FBCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186727, "uuid": "e19bb407-a538-4c64-b148-a788c90a2a3d", "value": "12:IaOFjtRQVsZQVFHUr00kMj8Y/iUJzMe5hQkPe9e5hQkPJpdGxe5hQkPIee5hQkL7:DOVtyCipsFTxnswvpdPNuR71q2z8JAhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675186727, "uuid": "489c48d2-80f7-4958-9ac4-7f8289f1b226", "value": 960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675186727, "uuid": "aa1dace7-4aba-458b-b2e2-e15e203b5672", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675186727, "uuid": "69ae8c91-a833-421f-ab38-6f1abdda5c78", "value": "DLkmLcnL.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038ade78-a136-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675148887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148887, "uuid": "7fc077b5-a9fb-40c3-9693-db4f112aabee", "comment": "Malware payload (AgentTesla)", "value": "8bd8bdf3fe7276e63a21591a0ccaf1f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148887, "uuid": "c5b0d6dd-b87b-4fc8-ad08-4bf393f9db45", "comment": "Malware payload (AgentTesla)", "value": "f14871b3c4416a897aa8526ec0d5cf04f2b5fec3d2f11f46d76f7705295b45e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148887, "uuid": "11da837e-a368-487b-804d-9929062f3875", "comment": "Malware payload (AgentTesla)", "value": "233a7dc8b4b71cf58aae144580bee190f1272d64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148887, "uuid": "36c4fcb9-1ffe-4eda-9b91-dfd2f120795a", "comment": "Malware payload (AgentTesla)", "value": "1255849ddf07674ee377ee6032cd8a16e123caec736494ee895fed983db369b3516cc14a5635ca65085884ab1911f6b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148887, "uuid": "679ba6e3-c6cb-4616-a505-39cc4d130bdd", "value": "T1C6F4026A43788FE6C55983F571E410292B3026BAB093E7084D9DE8D5CD4B3F18E3766B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148887, "uuid": "b55abca4-f137-487c-abad-225eadb8d510", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148887, "uuid": "19e1c004-4b08-4871-b689-8cad58c46dfb", "value": "12288:JDHoGX6jXLi6dMg0CI01cNMPb2E/do5Weh3ih9HUA:JToGKK6c30bABYTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675148887, "uuid": "ddd4bf15-ad0a-4ef7-9642-b1d1c7e09729", "value": 740352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675148887, "uuid": "84e13e9c-fcdb-4f89-b453-8e62ce34e6ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148887, "uuid": "28f6f96b-e2b7-432f-ac2d-3725d44b9e05", "value": "Purchase Order No-1243.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aac743b-a195-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675189889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675189889, "uuid": "cab16b55-5088-4aab-93b1-c30699a7bcd2", "comment": "Malware payload", "value": "c18009108480fdb057a8864a211212e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675189889, "uuid": "4ce7c205-92c6-4b18-bb07-80db7b8da07f", "comment": "Malware payload", "value": "f1d42be3aa56c1703b0fffcbc0e45ab6ea8b34e0a53fe00349648a24f731b045", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675189889, "uuid": "4ba457a3-a206-4627-aeae-869efb11f305", "comment": "Malware payload", "value": "2c46161be8dff6308f5d87534f41354fabbc6f25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675189889, "uuid": "d4ca8815-2f10-4df2-ab59-67da78d3919a", "comment": "Malware payload", "value": "f1ebdb50c665fa938618d7c58d6ca33116fa37ab576147896f72f3baed2b44c58261c986524680175bbda2c24171adde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675189889, "uuid": "74ee6fbc-9c63-4772-a6ef-f6dac5a300d2", "value": "T14584BFC277F27C62E9668A319E0EC2F4761EF9835E087366120B9BDF19B15E1C1A3750", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675189889, "uuid": "21d1a964-c5ef-43d2-9059-83f984766989", "value": "9c039baca0968dd2f90042d865dd6c2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675189889, "uuid": "f7aee195-bc68-4912-b341-9486689c2b15", "value": "6144:cm+m7Lhu3kHfVUyZmHIV37cF7mZiiBP0e1ggL54mqMoIFayI8MN:X+iNdUfHIV37KuiiBMeyYBqM7ayI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675189889, "uuid": "394b82ec-5a25-45c5-b094-cb78a4bfafd7", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675189889, "uuid": "0076cf5b-9917-4d1b-9701-a2df001d3b5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675189889, "uuid": "e0d45df4-d8e9-4ac8-ac9b-5e5745834ecf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9950da0-a141-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675153944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153944, "uuid": "f2f04b86-1446-4912-9a35-974ad50c9c2c", "comment": "Malware payload", "value": "b733460219df80a501e226f4103ff620", "object_relation": "md5", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "senseofswitzerland-ch", "colour": "#B73529", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153944, "uuid": "89371870-aac7-4217-947a-b10303352ddb", "comment": "Malware payload", "value": "f2eef480e8ab6edb03f79734ece3ba0feb3533f5b66e221bd22616047d3d0858", "object_relation": "sha256", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "senseofswitzerland-ch", "colour": "#B73529", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153944, "uuid": "14649f14-004a-41b0-ace9-808cb856a06c", "comment": "Malware payload", "value": "7c6bd55c936cf44d437a9e653508ff82085debc1", "object_relation": "sha1", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "senseofswitzerland-ch", "colour": "#B73529", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153944, "uuid": "661d81a5-3b98-417b-b05a-5384cc1ceb16", "comment": "Malware payload", "value": "f62e238d0394292e50b87a6e659fe20793e1ed965c6751b6d7739c831c6fea96b107d6ce6c57e526ec94ce924deee9d9", "object_relation": "sha3-384", "Tag": [ { "name": "chm", "colour": "#080B02", "exportable": true, "hide_tag": false }, { "name": "senseofswitzerland-ch", "colour": "#B73529", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153944, "uuid": "36f82215-ad4e-4a4e-9d6f-fca9b88d8a71", "value": "T11C72AF2030306AA9C815C3778ED739D73C52BAFDBE322449A4589B358D8AC41EE494FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153944, "uuid": "8bd51cd8-076d-4328-bde6-173a1e2ab993", "value": "384:yKpM0zWCeRUqrjR5ciJTfJE4RREiEhJCxyqk:yKpXCCXWNfJEAEXRqk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675153944, "uuid": "340f80da-349d-42e1-83cb-aac913546b5b", "value": 17142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675153944, "uuid": "180e7be9-7956-42c1-a463-4d872486e287", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153944, "uuid": "37281ea3-f64e-418b-8c7d-fc44ac012cdb", "value": "0085437719.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286f3351-a14b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Loki)", "timestamp": 1675157969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157969, "uuid": "e32279c6-e272-4dcc-b3fc-63fc14b6fac9", "comment": "Malware payload (Loki)", "value": "1102b4859e44813c528258469cb84fe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157969, "uuid": "f8456521-a0b9-4d5a-9bcb-18a1cc2cd96a", "comment": "Malware payload (Loki)", "value": "f2fc96c2b9de98a371e1fe00274f90eed2285c991a1598a5143605c58884c745", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157969, "uuid": "394ce5df-613f-4c5b-ae54-ebf4b85c92d0", "comment": "Malware payload (Loki)", "value": "3ea4e248bcb17842732a80b47c840b96c488fa6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675157969, "uuid": "72a3fc7e-71ce-401e-ab81-0e28b41193ff", "comment": "Malware payload (Loki)", "value": "9f5517e4198d4d0646f3fc05968be15607a46fe49aa3220f83fd4ef9732096cf0bd9a37b75d20913f7bf4612e8aea9e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157969, "uuid": "2488c09e-75f5-4734-a9f2-d90bc5dc0e2a", "value": "T1ADA4231132A8B739E33E07FEB6637970933569417E06E7488FE8A8ED14477491F12A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157969, "uuid": "db7046de-9f14-429d-bc69-aab0ea60aa47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157969, "uuid": "213c6827-533c-4aa2-8bfd-90b2e84474d8", "value": "12288:9HxhpW0CCgSLiK6NesFFR7SWUcrDr8z9i7+pvHCWtO:9HdCtsnm7UcrDr8zw6Rih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675157969, "uuid": "12b84aa0-d26a-49ff-adbd-eb5459c1085a", "value": 487424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675157969, "uuid": "52d792e4-a08c-4df5-99b7-47f79dc68c2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675157969, "uuid": "194d699c-235f-4bbe-8bcc-fd5b14d26dd0", "value": "VESSEL PARTICULARS & DETAILS_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6087b95-a13e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675152623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152623, "uuid": "b9430699-6427-4184-a7b0-4635c116dd08", "comment": "Malware payload (Mirai)", "value": "5ff8a248a69a0e31745ef3def9c2f4f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152623, "uuid": "5fcf2be0-2e2c-480c-825e-4b399fb5a75a", "comment": "Malware payload (Mirai)", "value": "f3353ab05f9b071ac00e982f813f77cb878e11abfcebe72f10adb3eb136a8431", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152623, "uuid": "872ffcc4-1793-4fd5-b91f-0750957958d1", "comment": "Malware payload (Mirai)", "value": "51ecc073eb23f6ab0ffd223ff05216a18bc9e38b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675152623, "uuid": "d368f6b3-fa87-4271-ba90-d231003d3605", "comment": "Malware payload (Mirai)", "value": "a8344b711f6492f0bf408765e1ac7ac7c4164fbd56f011b7bda9c60c64a2a3f4041681d45a00c0e9d6aaccdee49e54d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152623, "uuid": "370d2aa5-2274-4b7a-909c-a15744e21b19", "value": "T16EB39CDBF24702A0C8624AF007CB4BED3E2723815F27C5E72C6A657968791CF8905F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152623, "uuid": "f783960a-883d-4cd4-b426-5a0dc427d35b", "value": "1536:Fu27gBY9FSSpj3z5Qxw6YaWWgg1D/LWy:c9sSyzz36YaWWgg1Dq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675152623, "uuid": "eb353bef-ba9f-4aa6-8d85-b36faa7a90ae", "value": 107800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675152623, "uuid": "807246f6-bd06-4cd8-902c-2e99e036d07c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675152623, "uuid": "452bd63f-d8ed-4b1f-91ce-d8d0cabdea4c", "value": "5ff8a248a69a0e31745ef3def9c2f4f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b54ae5eb-a140-11ed-88f6-42010a9c006e", "comment": "Malware payload (GuLoader)", "timestamp": 1675153480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153480, "uuid": "961128c6-235e-4542-9522-281fdf84741e", "comment": "Malware payload (GuLoader)", "value": "5595641f96dd5a411dd96aaa905274e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153480, "uuid": "53a6e10b-7179-46b9-a7b3-b3ef31a9c621", "comment": "Malware payload (GuLoader)", "value": "f3967214637eeea339f345f384b3023bd1b67c0f85ac339c1c0b4ed80709acfe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153480, "uuid": "5658c472-1da4-4017-abfd-9bbefb07bf2a", "comment": "Malware payload (GuLoader)", "value": "29451a5b03dbc3503eee1190b3b49cd984c6a6e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675153480, "uuid": "50e93212-0609-4e70-9799-2de64d671f17", "comment": "Malware payload (GuLoader)", "value": "a2ce6e86b0bd80d0c4b28c0e88650826fdb3e1b55f79b799a2662895605dd747f55ae67d922f43f09ce59d615d10d83a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153480, "uuid": "cb02c7f5-a9a8-45cc-85be-9864155ba85a", "value": "T129E4CF837502E55AE61942310532DA65850F7FA42C219C6FB680BF2F71FB18B593BBCB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153480, "uuid": "1d05abeb-3b3c-48a9-99a8-f84127f10104", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153480, "uuid": "ab76dc52-95d1-4713-ba70-682dc868883a", "value": "12288:OKLTQhrI4SXbEzWH4tuy9Bkl47Cp82HdgU4sWIdwbIV:OzhMgKCuy9Bm4CLdaIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675153480, "uuid": "c71d9b69-32ce-4814-805b-de37b16a2c71", "value": 707104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675153480, "uuid": "2a08850e-4133-4f05-a052-8aaee48e4027", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675153480, "uuid": "2aa834fc-7244-4971-a98c-93395d40e2db", "value": "Signed-sale-contract_addendum_129KB_0000000000000000000000000000000000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66dc2384-a15e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Guildma)", "timestamp": 1675166234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166234, "uuid": "30cbf006-1282-473d-a079-43421df19984", "comment": "Malware payload (Guildma)", "value": "d52ac7755bd61b035235df79fabe1b59", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166234, "uuid": "c6cf7857-7b0e-4aef-85cd-72f749cf43cf", "comment": "Malware payload (Guildma)", "value": "f3c3d2fae15f05589f8860df40d0533165484fb2975b2204c2f7cca750eb7b51", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166234, "uuid": "1b6342ca-9d77-442a-baac-bf68420deb99", "comment": "Malware payload (Guildma)", "value": "4e7a57f7c7fc8ee15cb390337983d116220c7625", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166234, "uuid": "edba7c9a-9698-4ac2-9dbe-af326831fe5b", "comment": "Malware payload (Guildma)", "value": "e4d487785f82659ff86308d884cd9e3c6d7eba25835a5dbe5d4d234edec8e710d46e3c4af5bce11e18c443feeb85590b", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "guildma", "colour": "#DF8F77", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166234, "uuid": "071a3e32-5135-4877-a85f-3289cec88f07", "value": "T1B8F0AB9D90402D70E8296CB7CA820F106B5DFE830B002022039E029A8170A889E1E268", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166234, "uuid": "9fd8bcb8-4b18-4420-b5db-5d713473c679", "value": "12:8rflM8OBE6ZGQWgkxe5D5hex1tjdsLKOmesAzm74Uj1cSTj3pqexA:8loGQWFxed5he7taLKOg8m7jj1cuAe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675166234, "uuid": "31999573-7d82-4eba-ae0a-934af5a25380", "value": 481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675166234, "uuid": "57b9d1fc-a83e-4cb4-b66f-9ea12e71a1c5", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166234, "uuid": "1c4344ba-b8de-4c68-a9de-c51b4ae077ee", "value": "d52ac7755bd61b035235df79fabe1b59.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c656151c-a17a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Amadey)", "timestamp": 1675178420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178420, "uuid": "ca700344-d2de-49b5-9275-1dd8526e85fc", "comment": "Malware payload (Amadey)", "value": "67bb41448f41511e169c83230d7e9486", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178420, "uuid": "6bb6d842-21a0-4cf2-80ce-cd08bc9e296d", "comment": "Malware payload (Amadey)", "value": "f3cd81daa660f8a66d5fd299a0801d06eb05e88dfc914da4e04aee13df10007b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178420, "uuid": "0d2a65d5-7f5c-4a30-8630-11cba953f0ea", "comment": "Malware payload (Amadey)", "value": "dde5a6577a966a9e8713e66ad7ef50b840dd114e", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675178420, "uuid": "401450d7-614c-48a8-83f8-99eb5a856e47", "comment": "Malware payload (Amadey)", "value": "ce62d7ce9266de93cb55e4e39c54b472346831c65a5bdef8a3f795eb21b60641161cba965ad1af5d20b10785dd0c4164", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178420, "uuid": "cd1685ac-319a-423d-96c2-43ae57c89c66", "value": "T1A934F9217D16C031C56061B729B9BFF2C19DA8259BB049DB7B800F7BDA122E67970E3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178420, "uuid": "cd62d06f-4d8c-4aa8-aa78-04f24f457dcd", "value": "dd0e4efabc62274a7cfb37b4b7a2951d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178420, "uuid": "66e508dd-4794-4e97-b01c-03573afbe299", "value": "6144:ILUoeyDABOdDubDXqgraG0JzSRuVyL+VY9QqgE:Ilu0LgwJ4uVyaVgJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675178420, "uuid": "05baf505-8d91-487a-b033-8238c927ed70", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675178420, "uuid": "cd90817a-4d20-4b0e-a302-23bef126aa17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675178420, "uuid": "77445712-50cf-48c9-92f9-991454b5f4da", "value": "f3cd81daa660f8a66d5fd299a0801d06eb05e88dfc914.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424297c4-a15f-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675166602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166602, "uuid": "1d8e9e43-a916-464e-bfa1-2abe00b3e851", "comment": "Malware payload (Mirai)", "value": "f879bf7a58e3d53cfb888c00a54f3544", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166602, "uuid": "25792ee7-2475-456b-9a6a-25fcbbe858a0", "comment": "Malware payload (Mirai)", "value": "f43f42f00754e8057edf48c464ce4afc1d3ede77a96aabec045ff9cdd4b525ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166602, "uuid": "fa88ebbf-e9d5-4429-b704-a82693a800b4", "comment": "Malware payload (Mirai)", "value": "2919e39351ac448f9c0c613da7b20bc9f451815c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675166602, "uuid": "5faa1b2b-7d9f-42b8-9283-cf094864b15d", "comment": "Malware payload (Mirai)", "value": "6ce11efe896435a6fda87a2f57ed59c5c0cba48484b22cdf03d6834a37831bd6bbf4ca2ee5f0dc406d4b48ea0c9a13c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166602, "uuid": "11876d49-e05d-4397-9450-55106247f27d", "value": "T196A2D01921CDEA72D170903EE13CC357AEDB47B652FE313A2E180BA9A48591AD37E905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166602, "uuid": "5aac650c-2428-4a33-bbbd-b51764d9042c", "value": "384:YD5mog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSb+pzhymdGUop5hXA:YDgoh/DxCvhdR4IjWVFbSCds3UozJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675166602, "uuid": "5adc5689-fd3e-4ada-b63d-497022e9efa1", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675166602, "uuid": "25189bbe-1bf7-4a77-97c4-abca0506029e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675166602, "uuid": "4770d996-6ccd-4c2e-93e2-c369d547814a", "value": "f879bf7a58e3d53cfb888c00a54f3544", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7efb4c3-a12a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675144009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144009, "uuid": "2f760b01-098c-41c6-91b0-fbd56ef6b4ab", "comment": "Malware payload (Mirai)", "value": "33fd8ed2325dd01dc92db52434fba1d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144009, "uuid": "b4db8bfa-816c-47e1-94c6-2b24a7f85826", "comment": "Malware payload (Mirai)", "value": "f4501215e11790f0bd7687e627abe7e43d8732632ca5bd2badfe2adfc5721247", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144009, "uuid": "1197f4f0-8ee2-470d-b359-cd35ea1ef072", "comment": "Malware payload (Mirai)", "value": "91420b06f96fdad80ebc673a82240569d5b44830", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144009, "uuid": "5e2d8287-1091-4a46-827b-b9f9abce40c6", "comment": "Malware payload (Mirai)", "value": "06511601dba4fea71cd41ee4269785565c177f4239b8d93cb563420324983ac9835eb6404dfbc4e2dfced1e9bf006cdc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144009, "uuid": "97730235-da4c-4f35-9170-5390e708e667", "value": "T1DF534B9AF4018E3CFA4BA67E54160D0AB971B39152934F2772A7FDC3ACF30697A02D51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144009, "uuid": "511d447c-dcff-4313-bc93-5ced30eb2a2a", "value": "1536:LE2dKd40y5tgM28qUPgN8l8MsINprfm7uCciPY:I2jqsg6um+iLiPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675144009, "uuid": "5d0d2b38-50b0-49f2-9ae7-42769f1f17e3", "value": 61216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675144009, "uuid": "4e7fbe4f-b245-41a1-981a-65fe8f3569ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144009, "uuid": "8d1116df-668d-4ab5-9787-820cf8a356c4", "value": "33fd8ed2325dd01dc92db52434fba1d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e837ec3d-a135-11ed-88f6-42010a9c006e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1675148841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148841, "uuid": "12671d30-d6e9-4b3d-b2c9-7b2e326d6348", "comment": "Malware payload (RecordBreaker)", "value": "137ba87c6fc910f693edcdb07286bcea", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148841, "uuid": "d5f2f488-3be6-4a3a-9073-f1cdb3dd7011", "comment": "Malware payload (RecordBreaker)", "value": "f475056480a797aa29c860f3141ae41f0fa2d477e6c036c7a3b63cf6e4e589ad", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148841, "uuid": "f98b575e-5b4b-444a-bd6b-844d0f9645aa", "comment": "Malware payload (RecordBreaker)", "value": "63f201c05f9acc99a30b39a598655dd53b9c81c1", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675148841, "uuid": "3943019f-4518-4cd0-a09e-626464df1ddc", "comment": "Malware payload (RecordBreaker)", "value": "df9021d7a56b1ac89ba818266109bdbbce72bdbed2c359e768882888a9073b3525085d4f2241f432d5fb2e493473db2b", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148841, "uuid": "9a8844dc-224b-4e84-b957-f560da1b2c14", "value": "T13F761225F85233A2E84EC5F406B02DB803E52D75126B57C43278B05F92BBFBEDA64935", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148841, "uuid": "a5c6dcb8-143a-4933-a4fa-682b9ea75b52", "value": "196608:j0W4QY1uzmMJNYv0O42Khby8BAr1hgI9jtVGNQu5gC7:jqQeuVs0Sf8BAxh7Vn+gO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675148841, "uuid": "7595c68e-70e1-45d9-9069-f8e43318e121", "value": 7421494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675148841, "uuid": "3eaab6bc-3fa0-49d7-882a-b77729f33c40", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675148841, "uuid": "5a57fc87-38f9-491d-ad6d-dfaf2cf3520c", "value": "setupsoftapp19.0.exe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b506d9fd-a184-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675182686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675182686, "uuid": "5f4bd9b0-ca23-43cf-a2d8-40fce8a5de15", "comment": "Malware payload (RedLineStealer)", "value": "8f93050bcb83888d355787a9bd96dbdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675182686, "uuid": "5a86a3e9-fa72-4af1-8521-40685b5cab01", "comment": "Malware payload (RedLineStealer)", "value": "f56091c6fbaa3f4c3d7bb41d73747e7f4c691a1170dd89b8728dde2745446f9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675182686, "uuid": "9420330f-746c-4eae-a849-f95a454a9597", "comment": "Malware payload (RedLineStealer)", "value": "625dbf976dac727bc61bc1a315b2d79ac8a9b113", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675182686, "uuid": "cb3a679d-2efd-4054-972f-9e3d506ac7b2", "comment": "Malware payload (RedLineStealer)", "value": "3b8d8153d1c84dc169c0b4b2897250db6fe5e1f4e685c63bd9c162dd1abceba97f715a5096fabce3a1fa0218f016186c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675182686, "uuid": "a23e058d-4098-4092-816c-3d5ff9d63c58", "value": "T1BF84C0C2B2F27C62E9228B718E1ECAF4751EF5924E097765121BABDF15B01E1C1E3346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675182686, "uuid": "471e5de9-0daf-4d47-ad72-ba8da9f14c05", "value": "4aae5aed0c3540c5480a5674492f1494", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675182686, "uuid": "76832748-ff38-4ff7-b4f5-104111ae2627", "value": "6144:ARTXL+3JgpPXGAa3pdKOWmIDhTftmqMoIxD8M:Ijay/GP3mOZIDyqM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675182686, "uuid": "8befccad-3ef2-44f7-b512-868fc8deffb3", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675182686, "uuid": "196fdffb-4ba0-4888-be21-3c7bd76209e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675182686, "uuid": "377fe476-056e-4ba9-bab9-52c1798b7f6a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baf02cae-a113-11ed-88f6-42010a9c006e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1675134163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675134163, "uuid": "27a4ff9b-f6c0-49cc-a607-b8a699e9e753", "comment": "Malware payload (RedLineStealer)", "value": "7b7b401185e03afc5608488b427dfd72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675134163, "uuid": "1e5c5862-4290-414a-ae37-b5163ebc6052", "comment": "Malware payload (RedLineStealer)", "value": "f5ea6fcc65c96c95cdd970197783efb5d04b5ab6fba4d6cbeb578ef57daa6b3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675134163, "uuid": "d4b0763e-1f99-427e-a991-ce6a308f11b3", "comment": "Malware payload (RedLineStealer)", "value": "c2deb92ca0d4a710b15e00631f0a7bcea327c79e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675134163, "uuid": "61626660-de7e-453c-aeba-111efb6e1907", "comment": "Malware payload (RedLineStealer)", "value": "c549e634ee7b2366d1f71b21f32aef0dc823b11231a501f72b14f11ec25c22a943faecabbf244396b61396491c6a9c14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675134163, "uuid": "79f1eb27-da72-4c6e-bc79-da035948cdbf", "value": "T179541211F592D032C8566574A834D1517A3FB9320FBAA5C3BB881BFE5F312C25A3A397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675134163, "uuid": "4581e759-3c19-4d25-98b7-3a36a71aa725", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675134163, "uuid": "f896589a-4b44-40b4-83a3-61d9a9878e4d", "value": "3072:YjuNKILyNu6y5nW9ouOoitcQIE2TEehZ67q4G6HgJtuDziOiJUDpUKcmWZ53VRsD:3Lwu6egyfI7nd4G6IoDzihNZlRsYsv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675134163, "uuid": "838f6902-b1b4-43c1-a0c5-dfead8b64326", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675134163, "uuid": "8da54930-8992-4b00-aba1-1d27def7ecc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675134163, "uuid": "d0309ae3-abfb-4ff1-bd34-3e0abd37f6b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebf7a78-a180-11ed-88f6-42010a9c006e", "comment": "Malware payload (RemcosRAT)", "timestamp": 1675181065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181065, "uuid": "bd6ccb6c-db62-429e-a132-627cf1cb869d", "comment": "Malware payload (RemcosRAT)", "value": "5975711864464801addae436268ac804", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181065, "uuid": "cf32e157-f81d-4294-8ca2-c4084fed1ae2", "comment": "Malware payload (RemcosRAT)", "value": "f6847b746e97fbfbf29670e635317472fbfd5524e1f2d9d34bf78a3d15e9a7e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181065, "uuid": "d7a766bf-dbd0-46b8-987d-2e83a4075353", "comment": "Malware payload (RemcosRAT)", "value": "1e8bc6e0e0bf805f2fc3196e36c5998b53d2cb7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181065, "uuid": "0e677dae-9fd4-4894-b944-eda4426c9947", "comment": "Malware payload (RemcosRAT)", "value": "5b49088d0e736657c8559aa42badb2cf08fb13f5901235d138ceccc102bb315b70b4a6e14a1c6f0ef6f64ae7190fde05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181065, "uuid": "c15300bb-1434-4fdb-bd48-97237f6bffa6", "value": "T145A4AE02BAD2C072D57161340D2AE735DAB9BD212835597BB3EA1D5BFD30180A73A7B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181065, "uuid": "9a1e8f96-82a4-49ec-bebc-6fe5db057333", "value": "658143f158f14e9bff661e164dfff376", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181065, "uuid": "e417b620-63d0-4476-8ea4-b4a91e9da53e", "value": "12288:3tmox/Sl5vkKtAXjsoZ8wHonsfZga64x:9mW6l5vkKtAD8wIKZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675181065, "uuid": "3725ca3e-97e0-43cf-aee2-cadedb6b31b4", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675181065, "uuid": "cb6bc18e-81f7-4c6b-8023-30b90cc31908", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181065, "uuid": "0024123e-febc-4fc6-9b89-5dd1bc6dc18c", "value": "xgn0ikdaxKtZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e516a6-a11b-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675137624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675137624, "uuid": "882d891f-193c-478e-8d60-16c4c029a270", "comment": "Malware payload (Smoke Loader)", "value": "5fbfbfd2f019ffb3d9ad9a8ac0a1fb9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675137624, "uuid": "7788f623-e628-45e2-84bc-d383b5392cad", "comment": "Malware payload (Smoke Loader)", "value": "f70cd8773249bdc7a6b54825e65c4eda697a7836d02015518476f2a9439bda4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675137624, "uuid": "baf51fe4-d3f3-4ded-a5e0-ebd2232f9726", "comment": "Malware payload (Smoke Loader)", "value": "66fdbd5f49bf09bc2a4ef9a73df15d91614a683e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675137624, "uuid": "6b17792d-2a9f-4cc6-a06e-5731e82c0c92", "comment": "Malware payload (Smoke Loader)", "value": "c6eaf4b14a8592bb2bb2b99da51dd48f7659bbe81fa2641916a25c32e6d159b79ecc11616e7a1e235ed816fb8490fda0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675137624, "uuid": "73e8405f-b460-457a-8d1c-36a7a5b5bcf4", "value": "T17704D021B890E033C42654B51538D2907FBBAE722A7A8807FB451BEE5F702D176EE357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675137624, "uuid": "e1323562-acf1-4270-bd81-ba893d8418f1", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675137624, "uuid": "d6b63670-e301-4217-a742-9257ef76cbfe", "value": "3072:Oj9351BLMPGYOMt56Vf6LkUWhb/nLZW4Iy/rL2WCH:ULYG04iwUSbfLZW4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675137624, "uuid": "a1d43bfd-e8f2-4012-a234-775fb381de93", "value": 173568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675137624, "uuid": "86553e51-6cf6-4654-8878-d3e288f069df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675137624, "uuid": "e2af4d80-0848-49ae-971d-7e246ebaaf6b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8762ecd-a157-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675163364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675163364, "uuid": "689789d9-91d4-4226-aa13-a99fb9a5779a", "comment": "Malware payload (Gozi)", "value": "12b60158f29a0aecc0e0021545f00877", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675163364, "uuid": "1ae5277a-2ca2-442d-bf01-e97026e0cb59", "comment": "Malware payload (Gozi)", "value": "f7894939a617b36a04824fcd202a00304d3e19251fa27533f66becdf4ab29e16", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675163364, "uuid": "4378018d-ed5f-4311-bdee-3b9b60bce603", "comment": "Malware payload (Gozi)", "value": "23f0ab813846bd01a36901fcb3d9644dbba26316", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675163364, "uuid": "9c995e6b-68f1-4ea7-812f-5c411350c755", "comment": "Malware payload (Gozi)", "value": "8d99f0ee1826397a26f52bb8eba3248e8d314c609cf59a852ab21480e18de862cdddd338ad6a8ececff3cc098118a793", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675163364, "uuid": "36417d66-014a-4ad7-9433-ec7a9687e19c", "value": "T1AB734A19B786D886D65A1B3A5CD2C6E9B332FC416E9B83073244F77E5EB2690C903607", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675163364, "uuid": "e3024942-b8e4-4dae-b5a0-9d284daf1a34", "value": "1536:sblYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0TViWr41M8YQDokp0UARiC6pBGT:sblYkEIuPm3fNRZmbaoFhZhR0cixIHmR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675163364, "uuid": "bd557a38-82ab-4227-a482-972808261bd9", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675163364, "uuid": "be9d3eb1-3b72-4dba-9e61-58590e3abd66", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675163364, "uuid": "8afa97f4-8a0e-4097-a67f-2883b14e59e4", "value": "comunicazione(1).xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912abddd-a192-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675188639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188639, "uuid": "d2121047-a26d-4f89-8542-ca7d961b65d3", "comment": "Malware payload", "value": "a7fadc5ffccd272e1f3e5dc1717926de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188639, "uuid": "f793e4f1-84c0-41c5-ad2a-88795f65c089", "comment": "Malware payload", "value": "f7a1329e5d2d787c17e5357dfe8242f14dc9e1faf5981a1a4d9d8d1d6511f9ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188639, "uuid": "cf4555e3-b74e-4fc2-b0c6-f4c1c4d9e693", "comment": "Malware payload", "value": "d7ec968dbd537158f91b3493fd5f6657e7572836", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188639, "uuid": "3c485ba3-2583-4b7d-b85f-3c9e614fdca6", "comment": "Malware payload", "value": "8334d1f4ef7bd6650abc3b80713ad9d92c861173062f02273743482ec2146cd0be2177fb58e11d0a47429a87a793b06f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188639, "uuid": "2c44f82c-6abc-4348-93e3-c51a402abec4", "value": "T19EA52383F78384B2F46205335929AB96B97C7D201F244B7FF7986F5CC5304A1B624AA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188639, "uuid": "a6d936cb-f224-4fc4-9a9e-c559d619a596", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188639, "uuid": "d947b8c9-c1d8-4a17-9b87-c51039ccaf27", "value": "49152:V5OXoeI6Fye8Aivbktejn/dGiGf/vkADafh2KdOTD5Q1f:V5Youevbk2ngiwFafhLOT9Q1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675188639, "uuid": "51ddf5c1-7e54-420e-a9c2-929a865fd93d", "value": 2263673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675188639, "uuid": "f2382f73-74dd-4bd4-af10-59ff41887fbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188639, "uuid": "de26872b-04b1-432d-b34f-e4b67f1af996", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "218401df-a16d-11ed-88f6-42010a9c006e", "comment": "Malware payload (Formbook)", "timestamp": 1675172560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172560, "uuid": "50f3ef43-86b6-4cc9-9ff6-35ba24a6deda", "comment": "Malware payload (Formbook)", "value": "661b058e24c1376236b1a9a46293c877", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172560, "uuid": "825f543f-5e8f-4889-9449-cd3a0feaa84f", "comment": "Malware payload (Formbook)", "value": "f8578393ab35961870a480bc98ab7cf244cf40746d912e60b48a9c672f036b55", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172560, "uuid": "9339f556-17fa-40f7-a3c6-840e5249792e", "comment": "Malware payload (Formbook)", "value": "0bb07e846be4d67ee6eeeb0c7b99b762ed0cd5d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675172560, "uuid": "2bb3b2e9-c26e-46cf-9055-f4e5c2ef033a", "comment": "Malware payload (Formbook)", "value": "03f7f2d48c18f749128164147d7aacdec8d5c64fd718ef13d654bd44d105300d43488f8868907fb1042400ae17e1a199", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172560, "uuid": "66eb972e-a8e4-46d2-ae85-634b4b15a55c", "value": "T19D032A94A6AC8733EBAF4B7E58F9958257BC6173E405EB0D388C50DD34D279203A235B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172560, "uuid": "4beccb23-1299-4f53-a2c3-92001cab52d9", "value": "768:caHc5P5R9WoDAYsAYzWj8eVbu0w3R09VCBJif3p/i/30NZXggkX:casQw3s3z/eVKXR0zgJifZq3CZwhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675172560, "uuid": "2ab49901-e449-4771-89bd-9077252a195b", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675172560, "uuid": "11771d1d-5168-418b-abc5-2f03d71fa355", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675172560, "uuid": "b4574e1b-91f5-48ef-9da8-9367cc62f0a2", "value": "6TY2Qkw9KV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ed5b2b-a19c-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675192700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675192700, "uuid": "778421c9-0637-4094-b190-e0d76dbbcc8d", "comment": "Malware payload", "value": "d3375be95394e4d04751f2bc315c218b", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675192700, "uuid": "db206a82-ccf5-415e-9c4c-e1df9e6b9c84", "comment": "Malware payload", "value": "f91fd2c3249a82da7185ffe3c76cee4a625ebb7bf8a438a4ca8dd8b05e775ec7", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675192700, "uuid": "a9481697-3c1c-4548-8aa3-e38ecdc778e2", "comment": "Malware payload", "value": "2b6549d9a8a6cb8c78e919e141ed2008a81c734f", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675192700, "uuid": "e9848cfc-1cdf-48dd-85fc-f6e76a5dff0e", "comment": "Malware payload", "value": "98e896d141037289e2433ec1ee80bb75dd3c38d1b00e00860f131b0a17ae0491d5a53b668ce57ad93f1d3197dbec2ce8", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675192700, "uuid": "31efc0b3-40c9-4e55-9fc0-70ef005060f9", "value": "T146970292DB6F1FCE3D281D8C045E7A5A4DC9AD333D22C4F5DA9F250B82389D506B192B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675192700, "uuid": "b749b359-a26d-4ae3-94a1-c380cf17ec14", "value": "49152:+iNUwBAsNPnsP2hq1KbqJrRDm9m1H72c+v+fUo0l1uRz/oStI7/qOm1xu/Zkimlz:o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675192700, "uuid": "f1912235-5608-4ef1-a33f-ba12e3b53a8f", "value": 40329016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675192700, "uuid": "030ffd3c-c0b1-4f17-a968-49ff67058997", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675192700, "uuid": "883c7a8c-ca9c-491b-8ad5-d04245d9ff6d", "value": "Ancillary Relief.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3795004-a153-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675161638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161638, "uuid": "f8793f4c-74f0-4b20-b12c-adae4b14b018", "comment": "Malware payload (Mirai)", "value": "4286f41fb54f983d554fe39b9aeece3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161638, "uuid": "823ddadf-6d19-41dc-a232-5d32c3cf247e", "comment": "Malware payload (Mirai)", "value": "f9b15edb2a2a78c707137fe0b85e59e51ac7c908275ff4afc218c4b926302dcf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161638, "uuid": "d5f62b07-3598-494e-b0d0-0798d40740f0", "comment": "Malware payload (Mirai)", "value": "3902501ab3ec4eb0de41f0c949e0b976fa07b4f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161638, "uuid": "fc6e02e3-639b-4de4-96a2-cb008cdb2149", "comment": "Malware payload (Mirai)", "value": "4f0350715a19784cf430c8c24274b8358dfddd2ac24b45554a148be3b54ce460d4d5b783ec2f068769424c531bdf59b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161638, "uuid": "8f3168cc-f6f4-4266-adfd-d47a79e9795a", "value": "T165835B46F9829612C2D9177FFA4F128C331257E8E2DE7503CE295F6237DB55A0EA7020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161638, "uuid": "bb442850-453c-44c7-bd37-1fbb1cfbc497", "value": "1536:kVoXI9SH3avve8x04rQrDWKjPlsM5wEid65F8RnHDV4B3YvES:LIkz8xvAjs0wEk6n8RjmMES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675161638, "uuid": "aff5220b-774d-48d6-b03d-d3a3af38aedb", "value": 87568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675161638, "uuid": "ce91f4af-1363-4127-9ae2-036bd92a61aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161638, "uuid": "07446a59-76f7-42f3-a017-f43f8711ba72", "value": "4286f41fb54f983d554fe39b9aeece3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7ffeb80-a12a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675144036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144036, "uuid": "7709aa08-7dc1-4dfd-af58-8e946e8fd973", "comment": "Malware payload (Mirai)", "value": "0db03af0e46d8661aedb92cb8aa244a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144036, "uuid": "623a431a-5043-464a-a880-220da1ab9486", "comment": "Malware payload (Mirai)", "value": "f9fb87e669a7eec226018899d9716fef8324045d11a242cb67325571923d62d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144036, "uuid": "77c11116-1774-422f-baf6-969855f40027", "comment": "Malware payload (Mirai)", "value": "a5dd49286b3b996ba05477c298c0065836e9b75b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144036, "uuid": "0fd9ee8f-a95c-4ef8-ab81-96fdd750c454", "comment": "Malware payload (Mirai)", "value": "1fec72575790e36b16ed55f12187933664947bab5278bfecd2dbb4193beb105c4fafd7b50f13e39cd6a861883435738d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144036, "uuid": "a4cca38f-ebd5-4d2f-8294-371101e062eb", "value": "T1F6430856BC818A12C6E0127AF66F85CE3B2123E8E2DF77079D211B6136CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144036, "uuid": "0f328a23-6772-4358-b697-748e8dc60c54", "value": "1536:FH0Rv9hcS5f76tdOE1gSqwcO8rsRBXuL27P4hFBw:FH09gQ3jMBg27whF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675144036, "uuid": "a945bee3-f602-4056-9ebe-5e47ccbd9597", "value": 60476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675144036, "uuid": "ca13fdea-3d91-433b-9524-466cc6b0b3e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144036, "uuid": "4fc59a80-5da4-4d76-b257-2db12e53d197", "value": "0db03af0e46d8661aedb92cb8aa244a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df435859-a1c2-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675209385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675209385, "uuid": "9e6e4e1b-f744-4a24-9dd3-ff63834c28ae", "comment": "Malware payload", "value": "3b8cb18a3aa1dd5e3eff31da2fd1aebf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675209385, "uuid": "cc3d6f83-32cb-42f2-8a20-8ce1e48f4815", "comment": "Malware payload", "value": "fa0c5f16c7c78823b721cca2e63b6c2723379d0748cd0465a7718f8d4d88a940", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675209385, "uuid": "c5034eb9-4234-428c-a80e-b83117317eb1", "comment": "Malware payload", "value": "e31f217df449ca9216130f6d8c7749f864b864fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675209385, "uuid": "054ea8a7-bf68-4e8a-aadc-faf334e8cba9", "comment": "Malware payload", "value": "55843bd9baeb04e88566d0712a126b7d3083f91e28ce3401ef14ac0aa491b8388e0371199d01f48116bf1e9cece9fe57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675209385, "uuid": "c5560388-cf21-4ac7-ba08-30054b3fcb3d", "value": "T1D4548EC272F2BC62F931CA719F2EC6F4752EB5424E196766121BABDF25B01A1C1E3311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675209385, "uuid": "d4581a09-4cb0-42a2-9c48-12ca2ac5020f", "value": "d84aba910fd98bff40c3867e1dd713e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675209385, "uuid": "9c213066-06fe-435c-b55a-db2115b2a2e9", "value": "3072:Tznvz4LPqXRskmG/or72vePGedSLq5lao4WdMIQZKmqPUx6WfQz86YpRi3MM5A:Xz4LP9v2mPGa5/r2IHmqMoIdpg8M5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675209385, "uuid": "c2e4c5b9-abff-4d5e-8e72-06ef29aff608", "value": 306176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675209385, "uuid": "bf04d466-e74f-4402-883a-368321f89978", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675209385, "uuid": "1f389f2f-8792-4579-8403-01b1f434db15", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae583163-a133-11ed-88f6-42010a9c006e", "comment": "Malware payload (LockBit)", "timestamp": 1675147885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675147885, "uuid": "c6b2a71b-4e3a-489b-b9e8-7df18600cc13", "comment": "Malware payload (LockBit)", "value": "ea34ac6bf9e8a70bec84e37afeea458a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675147885, "uuid": "48d35c15-bb23-4a42-847d-09357165b948", "comment": "Malware payload (LockBit)", "value": "fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675147885, "uuid": "a63f8978-1698-456f-beda-4a6ad048e214", "comment": "Malware payload (LockBit)", "value": "fd443460ccd1110b0a77385f2f66a38d3f527966", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675147885, "uuid": "be1819ff-d951-4306-8433-2c2a9febc661", "comment": "Malware payload (LockBit)", "value": "5f973822069c13063ea0462a45102c440d0c1eb718b226e45553c4c01eb286e74f88e84f1da203938ac7a7232a36839d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675147885, "uuid": "17d2bdd1-b79b-491e-a0ee-09b07c325d67", "value": "T1DD341800F54ECBE9DA9343BC4956A602FEFB328067148AE7D7885A310D075C579BDFA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675147885, "uuid": "01df4964-8b5d-473a-a89d-943cf2a573e4", "value": "cf173f5b43e2dd8a6a3952081c406e61", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675147885, "uuid": "481bcbff-9070-456a-93c1-55b3bcdd68a4", "value": "3072:ZO459Ejzjz10wKaEcKBIacm6QBDOmkm9wXcIfGBF5UgbB67Z:T8HzKxhcKB0VQBLk7XcIkbkt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675147885, "uuid": "1882bfd1-b69f-4492-b350-b50434b9ef45", "value": 251392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675147885, "uuid": "5531b6f9-d1fe-45bf-ad38-67987a0f5e14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675147885, "uuid": "2d0a54a3-5fc8-4264-91ff-45b7cb3a6728", "value": "fb49b940570cfd241dea27ae768ac420e863d9f26c5d64f0d10aea4dd0bf0ce3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a23e5c-a181-11ed-88f6-42010a9c006e", "comment": "Malware payload (njrat)", "timestamp": 1675181241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181241, "uuid": "22786905-e01a-4ea5-b21b-e6495fcf6161", "comment": "Malware payload (njrat)", "value": "d9e8c553fd2b2384bd876b4acb9a92f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181241, "uuid": "65ec53d2-0aac-4f93-ac88-98ae3b2b06ab", "comment": "Malware payload (njrat)", "value": "fb9fdeb110ab64a155a610ecbdbaf7cc780d1c2dd1bb3cc9e544a13a56a992e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181241, "uuid": "085d396d-0e18-406a-8b95-f32459c89c41", "comment": "Malware payload (njrat)", "value": "3a4c043620a05ae3f182a0b6f63ead3d82f941db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675181241, "uuid": "59e88e06-ad70-4c56-88ad-4ba8c9d92d43", "comment": "Malware payload (njrat)", "value": "8c24db8436636e37cad84b6da2f144ed6e1d5c25937091e1cb36013b7ddc651e814d74224bf243ce8776f73223c777a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181241, "uuid": "9a341587-7b49-4cbe-89e6-bdedad7463df", "value": "T13CE208067BE98215D6BC5AFC8CB313214772E3438532EB6F5CDC88CA4B676D00655EE9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181241, "uuid": "5ee3fe93-cb22-4611-83af-52fda794e43b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181241, "uuid": "bc889c48-810b-4eec-8de2-2af37d30a695", "value": "384:w0bUe5XB4e0XfOVcsw0Q0mS03AWTxtTUFQqzFWObbR:1T9Bu26555d8bR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675181241, "uuid": "5e9f30ad-4d48-4ef5-a9b4-e69f973b9bad", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675181241, "uuid": "67549e66-5b6c-43e0-88de-4e6bb765ca8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675181241, "uuid": "ec35d892-c644-48c5-be2d-2392975fac52", "value": "bJrn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a80ff0-a153-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675161645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161645, "uuid": "57bc3cac-66a1-4fe7-acd0-dd27c1524d23", "comment": "Malware payload", "value": "49d5ac4f24d55b3690a4cda0090f6bd9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161645, "uuid": "254d9024-2e3c-4cd6-a8c4-93af0dab4c1c", "comment": "Malware payload", "value": "fbc30d81a31540674261740f6b52dbb9100e2983a148b53f7ad7a4f02995a184", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161645, "uuid": "888e2487-c55b-4029-aa6c-917172d785b8", "comment": "Malware payload", "value": "9316c1763b609177bc33dd4f5a619404868212a5", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675161645, "uuid": "5e9918c0-0562-4b35-b164-9873bcf28813", "comment": "Malware payload", "value": "d5ecc477906e353bd0f68cc7e7103a198924c1d300d0ef388cfdfcd620d4436c75a7ceb74fe2eb2ca1e7f4403cde0fa4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161645, "uuid": "9c1d312d-a5da-4b4c-bec4-e0d97b880d40", "value": "T1FED309427B47DE6FFC5887B41EA38F7923C894A315A58A8BF37E7B4C0E241915D086C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161645, "uuid": "3e2c21ca-7e3f-462e-a8cc-219d5369e2dd", "value": "1536:xaddvpKOwEJOU+tMPNb6SxoQojdj2eTDjTqSzVzV18f2g5z7uTV2TelsHH/rzjlB:xad3F+iHxoQcdj2kjf0lJ44VjzxCmwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675161645, "uuid": "0fc8399d-c607-4f2e-b3a8-eeb42a32aaa6", "value": 136928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675161645, "uuid": "7c994165-998b-4a33-b234-4e52bc42ab61", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675161645, "uuid": "c4f8e139-973d-4d24-8df2-62e8cf9e8bd9", "value": "49d5ac4f24d55b3690a4cda0090f6bd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea43393-a155-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675162462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162462, "uuid": "d2709b41-0c79-4d91-a47c-83d658fbf957", "comment": "Malware payload (Smoke Loader)", "value": "9e59335cdf1b0c8bb7bbd9c17fbf05ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162462, "uuid": "fc10ff3f-57ce-4add-a0d5-8b354d242ab7", "comment": "Malware payload (Smoke Loader)", "value": "fbcc05a4e85f5a4be99ed1b23cff7c69f1a2904f3fac7f1c136ca940f3521537", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162462, "uuid": "16c381f8-3e32-4038-a411-14d920062636", "comment": "Malware payload (Smoke Loader)", "value": "ae509bcfa1d569e37cfdb8303ccd7c0000ed0f94", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675162462, "uuid": "68c2d30c-e343-46e6-8404-b534b8ed6734", "comment": "Malware payload (Smoke Loader)", "value": "73fa1556d3d07ab6f125714c2f8f42e01db5024895e058b7f2d3d2e1ba50928a282f90095122c393e8d3b268749d0bf6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162462, "uuid": "1b7c82fd-8e11-4905-a079-36550c0ca4ea", "value": "T10E548E02B2A1BC40F56686758E1FD6E4F61EF592CE18A76A23187A1F25B71B3C773301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162462, "uuid": "226ae3e7-b9c0-4259-a706-e917b86227e9", "value": "78339dc1c5de0e493ea2b28607ce356e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162462, "uuid": "876e2e8c-727c-4629-8cc1-74bde74d9b1e", "value": "3072:ixu/pzSKLcWVwcRoZCMTxy1Rw3h/8ZPQE74qifP7f43H7BF8wtG8RCq:DxzSKLdVaZ1TxmCh/fE67f4Vewtv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675162462, "uuid": "4cfb039b-ded1-46f8-a855-3191089c5b06", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675162462, "uuid": "7bbe59c3-a3b9-4b71-afff-b867b5d22f8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675162462, "uuid": "0181edf9-1d5e-460b-bfdb-346ca860398e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5b05937-a130-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675146609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675146609, "uuid": "0ca9df8a-c28b-4b08-a211-76cad5478c4e", "comment": "Malware payload (GCleaner)", "value": "68caf6de993344e8be9f911a4366d257", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675146609, "uuid": "25a90fc0-7520-4bea-9fd4-07b884089c33", "comment": "Malware payload (GCleaner)", "value": "fbdb356e0b938d31d78e1a4adbaddb668eff6af9b86f7853715124d89dea3552", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675146609, "uuid": "2c0c2137-72aa-43ed-b549-347b7b34d545", "comment": "Malware payload (GCleaner)", "value": "c4cfa8f8b40d2fefac3d6fcbbf6c8b8e1485c290", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675146609, "uuid": "35676afd-0133-4217-b6b2-91e118d72ceb", "comment": "Malware payload (GCleaner)", "value": "8cf8980d69d09b459c2949dfcb22cdf9558b15672409ce35d6804ec51ab79449f402dd09100b27569ce29e59c3ba38ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675146609, "uuid": "92719fd5-c574-44be-913a-650f58344a2e", "value": "T1EDA533573A508E3BE2538BB110395111E6B5FBA7293910CC748E57832E77B92F48F369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675146609, "uuid": "eef988b1-3f8b-4022-8e2b-d7b877014f1b", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675146609, "uuid": "1f4a9ff2-9e22-4491-b98e-62101e1b9110", "value": "49152:C245SqNkFiuyIeJ+PJy/0AfMDdZjPJHdWP7W7bnyla1LCgv2MR:d45SE/yeJ+P9AEZlHdWy3iapv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675146609, "uuid": "303002ea-9b26-46ac-8414-c3a93a757ffa", "value": 2195402, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675146609, "uuid": "88bf5e9e-181b-4fe6-8cd6-4c0c45ef2de6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675146609, "uuid": "3d8b3784-72c5-4ee3-9c56-be175863d33c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810243eb-a192-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675188612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188612, "uuid": "c3d01518-f6a3-401a-bbbc-f59b26586699", "comment": "Malware payload", "value": "60fde703f93c5e7c40dc6db2130a8e3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188612, "uuid": "86d57871-8196-4291-9281-eb94fb96b7ba", "comment": "Malware payload", "value": "fbf75834669b2234a4c2d2963c9992d568243c43a78c144114305426d203a6bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188612, "uuid": "e4db5db7-27e0-4d2e-b146-93e85a955da1", "comment": "Malware payload", "value": "496a0d7a7f1b312b9bb5d4db771423f9705cd5b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675188612, "uuid": "aa9c0e73-7761-4c43-ac56-85428d6bf65f", "comment": "Malware payload", "value": "8e678fcb2ad7de86c31919bfec50c4ca9309aaa43bd692c9cd0d92c1083c06fa681fbbed721e94a99a275dc16b79442a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188612, "uuid": "26d44abd-e9e3-40b2-9a41-1b2c66080e2e", "value": "T1AB763351BAF8DDBDD126943ACDB01F8246FED6D82937DA3B53E904657EBA005F20224C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188612, "uuid": "01c4f5ba-f5d9-4475-8ec4-06365ae5b39d", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188612, "uuid": "394ccf1c-e0f2-45d1-b6fd-6677d6e5fb14", "value": "196608:91O/mEQI+9GW8HOUlCaldDDF0seWdm26FO4/N6I7BZ2:3O/YI+auUlCa7FFeymVFTtL2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675188612, "uuid": "6eea8f04-1e2a-400c-a1be-0c39192f5678", "value": 7583236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675188612, "uuid": "d907f907-6101-47c0-a596-052eef83bbae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675188612, "uuid": "b2f6e5bf-a678-4bb6-aeae-f0b4cee0f1e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db062b85-a157-11ed-88f6-42010a9c006e", "comment": "Malware payload (Gozi)", "timestamp": 1675163422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675163422, "uuid": "cc755d7f-c5ab-40be-9f2d-54f50468f8b2", "comment": "Malware payload (Gozi)", "value": "fe126e58d4aa4f8591254b0ec18bad59", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675163422, "uuid": "7700f9b0-cd19-4a05-ad2e-571c7fffdc86", "comment": "Malware payload (Gozi)", "value": "fc83217e920d36d6b322812d129919b67c7d241a7c77111ddf24d49b4c1b8cec", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675163422, "uuid": "6c535be3-30d8-47f9-b4d4-a0a852df63b9", "comment": "Malware payload (Gozi)", "value": "4b308e030f4f0769665d96c4d4e2e0d33dae0b07", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675163422, "uuid": "3e4c3cab-74dc-4dd2-b741-ba5a6271e64f", "comment": "Malware payload (Gozi)", "value": "64feeeb9f73dd80a5687c5e00ded2a52215353cf91d36d90026b4c83817d6c510fa8b92597ea5deddc7781297180e848", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675163422, "uuid": "157f5574-4854-411d-999a-ee357c674fa4", "value": "T152734A19B786D846D65A2B3A5CE2C6E9B332FC406E9783073284F77F5EB1690C903647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675163422, "uuid": "cfbcd294-0b69-49c6-a24a-93a804fbab2d", "value": "1536:LblYkEIbSkKBEqEXPgsRZmbaoFhZhR0cixIHm0zViWr41M8YQDokp0UARiOdBG5F:LblYkEIuPm3fNRZmbaoFhZhR0cixIHml", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675163422, "uuid": "8363ed77-eedc-4007-862f-cabd8a448414", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675163422, "uuid": "294503d4-a0c8-4baa-a706-e68d99ff2783", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675163422, "uuid": "44a4f6c6-27e0-4aef-bcec-3d9e4c095e6e", "value": "comunicazione.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87c7ffad-a12c-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675144814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144814, "uuid": "d4b98660-4b2e-446f-9df3-92359907307f", "comment": "Malware payload (GCleaner)", "value": "4339a928a283be13cec3c1acc3b43348", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144814, "uuid": "e98cbe16-089d-4d25-a6ea-0fd7bbe28e47", "comment": "Malware payload (GCleaner)", "value": "fcb6f00d829fe5a10f937be57f925cefec5252b516a17c1188dd6533da60ecaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144814, "uuid": "ebbd0c73-8c90-4d9a-852e-fa8aab1694f1", "comment": "Malware payload (GCleaner)", "value": "47755cdebac93e4b6ee99ecf5eff73f790e75f16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144814, "uuid": "300582b8-18f4-481b-b5a7-5bb49016451c", "comment": "Malware payload (GCleaner)", "value": "e2840fe1d92a56faff392fd6ac5def760b0dc8a58bee5ed87c16df6450c8efec20e87462420dd235cb5b692efe76125b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144814, "uuid": "a6583e58-14c1-4e1a-8008-f8602bb6b869", "value": "T1EDA53302D0B9F6BBE2D04A726D0CD9815FA3BC26793400767A5E674A8E76391BF1C34D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144814, "uuid": "b42672c2-e7d8-4ee0-8be4-df584a1e2497", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144814, "uuid": "7944a7da-7807-4caf-9eab-e39bf48cbfa7", "value": "49152:C2557lk9/g3uflmLtK9UyJlmTzKR4i4QK/YHqTGKDLCgv2MR:dz7e9g+tmLtHyJATKs/YKTxv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675144814, "uuid": "204b12b2-5068-4395-99f4-c746cd8d68ab", "value": 2156618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675144814, "uuid": "c9cf5770-6dfd-4973-aa9c-6c80a77e369b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144814, "uuid": "096f7441-621e-4fcb-9799-f8dde2e6f108", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c510c6c8-a186-11ed-88f6-42010a9c006e", "comment": "Malware payload (GCleaner)", "timestamp": 1675183572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675183572, "uuid": "1188e9aa-da8c-4ca8-b409-e126937d8442", "comment": "Malware payload (GCleaner)", "value": "a7898799a2b929981db2a26927e65e49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675183572, "uuid": "e056f8c0-935d-477e-89f4-6daf7269fc1e", "comment": "Malware payload (GCleaner)", "value": "fccf2a73dec7ddb5bb8d0856e9e98ce7422ac4fc2154e6f81edf61dbed99c18f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675183572, "uuid": "9f1c306e-7a5d-411a-9292-61f93a0c74e5", "comment": "Malware payload (GCleaner)", "value": "90e76201a95a6432234121cd55a562b09348f4ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675183572, "uuid": "89ca3504-fb77-48d0-bf28-c909c914c7ee", "comment": "Malware payload (GCleaner)", "value": "141e5e7326b1aed88b16aee68bba41df1ed84520c8362eabb95a999f87fd63dcd8de48b09e96427ef6a864eeafc6bd34", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675183572, "uuid": "4b1af388-14df-410b-a918-1ae4836d4a2b", "value": "T178A533068815047FF0B355B06D1EA84777BFBE6A68387272321C3ECA273B75628165B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675183572, "uuid": "081d409b-dda1-4c78-9edf-20d751bb2257", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675183572, "uuid": "dc02c268-f075-43f2-bdd2-0f50150a0d82", "value": "49152:C2hmDbvPLOAFWKBNxuTpcaqKnMuRADsanGv2Ls3eLCgv2MR:dhmDbKKBNQTpD7Bdfv2ouv2MR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675183572, "uuid": "71c6155f-53f6-484f-9c92-cdd5a63994f3", "value": 2197129, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675183572, "uuid": "a929daa2-f104-4a58-9332-32a4f1ec541e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675183572, "uuid": "451287f4-a02e-4e1b-bd5b-53dac6d58ffc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f291aa-a12a-11ed-88f6-42010a9c006e", "comment": "Malware payload (Mirai)", "timestamp": 1675144053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144053, "uuid": "3d426d43-ac60-4d5a-913e-67561418db74", "comment": "Malware payload (Mirai)", "value": "b32a7635546d5bf02bd1ada4cd005c97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144053, "uuid": "1f1a9250-5313-4db7-91fb-a5afaa1ff76f", "comment": "Malware payload (Mirai)", "value": "fdcc0cafacefb45efa20ce87992eb353209428dc9df76719e44b9e3e33cf45e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144053, "uuid": "3592cbea-97e5-41f6-baa0-1855a4976bc3", "comment": "Malware payload (Mirai)", "value": "bb6cff9f24e49d099a710e02dcd589e391519f8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675144053, "uuid": "d4a75e8b-7c9d-4ad3-b60e-62d12876a23a", "comment": "Malware payload (Mirai)", "value": "74546757cd4942dd0fddbf370fba7be4e6e3ccead562aa03251ca086d3f4f529c73b1b34012b990f3080ec4befedba47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144053, "uuid": "b23e7916-aaf4-4fb6-aefb-bd68c1063e6c", "value": "T1B8D34B46FB418F13C4D617BAF9AF424933229B94E3EB730649285FB43F8666E0E53905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144053, "uuid": "e894268e-c1c1-4999-b899-bf5683b81200", "value": "3072:f0DvinprSHrDqtVgZB3RJxQds/neqfasb2mKM/9M/zrr:f0DvinprSHrDeghJxQds/eqfb2vM/9Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675144053, "uuid": "2add56bb-4824-40bc-b2b6-a1d448bba7d3", "value": 134572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675144053, "uuid": "98d9fd27-4795-4db9-a986-9106432defb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675144053, "uuid": "3e33c060-e2be-4a14-9094-7d6ab2e0a7d5", "value": "b32a7635546d5bf02bd1ada4cd005c97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca50cb8d-a11e-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675138913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675138913, "uuid": "1dd94e2b-dbf9-4412-bc8c-10479b8ae2fe", "comment": "Malware payload (Smoke Loader)", "value": "fb2d11fdda1aaf45b3321ccfa7f73f9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675138913, "uuid": "6cbb53fb-7370-448c-a2a3-8f2b8814f286", "comment": "Malware payload (Smoke Loader)", "value": "fddd85913c5a9ea82d091cc9c612ef5327a479f592f856afc87dad13a92bc31f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675138913, "uuid": "f66349fa-ded0-4b83-8923-deba4ed572f4", "comment": "Malware payload (Smoke Loader)", "value": "07da560eb92370b9649c6e1dd4f26f28af61fc17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675138913, "uuid": "f3f38261-197b-4008-a1d3-07fe7e39c136", "comment": "Malware payload (Smoke Loader)", "value": "84e1cb727570b6033266cb9aaebaac0d7f59e578b199da6295d96c4ebf85dacaade6c8cfc007028ff58fe48a3eaed5a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675138913, "uuid": "23a0d33e-5861-4f9e-becc-9c285b1c9f97", "value": "T130F3E111BA90C033C70611B83538E2557E6EB9F25AB5D947BB860BAE5F711D0373A327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675138913, "uuid": "ac3cfb89-22fe-4437-93ec-babe6b24afe8", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675138913, "uuid": "fc24c10a-ac76-4f9e-91c4-eeee8aa2c56f", "value": "3072:NjmnCKWLU1c0vM65FSJC7AvkG5mVrkezggbW+j:WmLyc0UxJC9G5MkfsW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675138913, "uuid": "5d31b49a-d503-4af1-97c7-a71439582a90", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675138913, "uuid": "aa8c2586-28da-4401-b154-1274e4d8171b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675138913, "uuid": "b8c516ae-1fa9-4500-aef1-de0ea794af33", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5129c55-a16e-11ed-88f6-42010a9c006e", "comment": "Malware payload (AgentTesla)", "timestamp": 1675173344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675173344, "uuid": "610c424d-3faf-4bca-be3b-6f79873b6fb5", "comment": "Malware payload (AgentTesla)", "value": "3b66a4c59d3eadfbb396721c70834ddd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675173344, "uuid": "30c1f27e-550d-425f-ad71-fb50a360ea36", "comment": "Malware payload (AgentTesla)", "value": "fde6f4b70768e329b0d725843094cad8ee50638b32956c0edeefed2d551508d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675173344, "uuid": "ef73cb47-7c94-410a-b391-952f8ddd41c3", "comment": "Malware payload (AgentTesla)", "value": "cfc1c4a014b005431cf842a9a887b9fd84b1f575", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675173344, "uuid": "458e9e54-f4d6-46e3-bbad-34f5bf787b29", "comment": "Malware payload (AgentTesla)", "value": "21d8563232089aa8a53a7ff403a570c0a1d018d205ed9e9b4be60d29b392a12d1aadec077f6f3078aff550a7ecc1c550", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675173344, "uuid": "e9240ac5-50fa-45de-bd5a-a30c4ee18901", "value": "T188E412978335CEFAC788437B22B808589F3139A5F5A5DB08179FA225C49F3415A713FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675173344, "uuid": "309609b3-bb91-40d1-9ce7-f54e7ac174cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675173344, "uuid": "83ca87be-6077-4fe5-893a-d6a2c6db30c9", "value": "12288:J4reswkUI5NB9y+EdYHsGC29KWeh3ih9HfA:JBkUI54GCFBYT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675173344, "uuid": "8482f572-0810-42f3-80c3-8c5f22fcffef", "value": 675840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675173344, "uuid": "a73ba1ab-94d5-4e34-a013-8ebd33a88b0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675173344, "uuid": "de552a39-3d86-4a17-b347-7f425b9fb5cc", "value": "VDVxPCDw3o7Q9av.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286ea294-a119-11ed-88f6-42010a9c006e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1675136494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675136494, "uuid": "e14a97c1-3ae3-4f42-9410-346d46563d58", "comment": "Malware payload (Smoke Loader)", "value": "d7312278841e3c84a3e6d65a9c108494", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675136494, "uuid": "f1d96792-3f09-4808-a417-3723df8ac255", "comment": "Malware payload (Smoke Loader)", "value": "fe7626dff8ac5dd1ff2916f2ba81b23fae3fcd3018a00c1af3311df5ba788dc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675136494, "uuid": "09e6721e-6748-45eb-b39a-28b28564c950", "comment": "Malware payload (Smoke Loader)", "value": "6dae67fbc35ff4309a662c2917eb21831495137e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675136494, "uuid": "e6361cf6-8d29-4e7f-8927-7a5ed309cde9", "comment": "Malware payload (Smoke Loader)", "value": "6e88d2b0d94e6736854cb0556b94bf7cb4495b656d8857d09700bf2c13ae11f31a1848010b1b7607c4b205b4c0c8d1e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675136494, "uuid": "82a4e79d-5840-408a-85c5-66ce514865f6", "value": "T102F3E014B981D032C40515B02E28D6557ABBB9314F7E9807BB851BBF6F332D1663E3A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1675136494, "uuid": "eb85eefb-d700-401f-97ee-92d098d33dc4", "value": "a3b69b35f91a02fbe6dc09300555c500", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675136494, "uuid": "c940eb35-27f8-4087-a2a9-76d64eed2255", "value": "3072:ijJoYhLMKkFokz5rLUvrq64vBaDaskInAFoSVgtw6d+/:kLYok5W2ZYDaB5Vgtwt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675136494, "uuid": "6760f885-1df2-4f10-a031-bce89ee58d40", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675136494, "uuid": "47a1e372-d33d-45da-9e18-74086c120748", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675136494, "uuid": "a6ad8e5f-0b40-4a55-877a-25cf7a1bf611", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73a86595-a122-11ed-88f6-42010a9c006e", "comment": "Malware payload", "timestamp": 1675140485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140485, "uuid": "f0feae58-c6a3-4ab5-acf0-fdbfbb098557", "comment": "Malware payload", "value": "d7a7c1c8ba1aca21b8b6214ceb80d955", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140485, "uuid": "b99836c6-8bb8-4f06-92b5-ef73f42ccc6a", "comment": "Malware payload", "value": "fece0b9133eb7bf7acfb502972def3bf2d8c78230f592cbc108014c9e0f5a145", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140485, "uuid": "2608b3f6-04f1-46b1-888a-f21f0696aa97", "comment": "Malware payload", "value": "651a4a3b96132c5396111e55df846b48ab3b0ee6", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1675140485, "uuid": "a0d3475d-d88e-4b4f-9dd0-36c6d429227b", "comment": "Malware payload", "value": "1ffc4918ae8477d2f8d834d028d536522bfde8b4cee747a7e475180c01965de35a250eefc729708f68f84229a554bc5f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140485, "uuid": "c0d1e50a-e2ee-4032-b1ac-825a11f82bc7", "value": "T139363B15F817C56BC1A300353CAE9BF836BA7C498F25A613B55DB76E3CB6308E84A744", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140485, "uuid": "61400aa8-e9ec-4512-bf05-68217523fe55", "value": "98304:Av4K91f7vFpQ+g8RFpiLd+8kLD84tCEr0RtNiC5eSsNMt+r+WC1HnKHnn3BBXXXy:AvpvFa+g8RWLdPk/84tCEr0RtNiC5eST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1675140485, "uuid": "e11bda5b-b731-4e21-a065-019d7aed4d5c", "value": 4993536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1675140485, "uuid": "399886a8-7e39-43ea-88c2-2a4dd30c157f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1675140485, "uuid": "e78e7acc-8d43-4809-bb63-3feda75a6300", "value": "fece0b9133eb7bf7acfb502972def3bf2d8c78230f592cbc108014c9e0f5a145", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }