{ "Event": { "published": true, "date": "2021-10-07", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-10-07", "timestamp": 1633651381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "de55cf56-1a4d-4d46-954c-40f0f176d53e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ce07f42-2764-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633607255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607255, "uuid": "99f735ec-5c05-4fac-a2ba-ca80283d5029", "comment": "Malware payload", "value": "1be7f7b227794a5163676d8f017d516c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607255, "uuid": "72d1a843-7469-4d40-ad4f-aafbdc19a172", "comment": "Malware payload", "value": "00189ae30ede41db97df3adb41e962c6d08534ca421cf30147b23d1cd46f2228", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607255, "uuid": "8ea3a29f-55b8-4611-89b1-ebb5b9bddc12", "comment": "Malware payload", "value": "5fc6670e292f1d1b18d1df8868787a99c38fd1a5", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607255, "uuid": "8db7a284-212c-4a80-a25a-844aeb21b947", "comment": "Malware payload", "value": "0ff60bd51e4ca0a2fb578b9274b9411c9710faf5619da85cafe7d7bcd0062149b31477fa41f94af2679f3795d061643f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607255, "uuid": "824937e1-277f-4e33-8583-a790f34ad472", "value": "T15434E14AF575C84DFE4AC73A4CDB0B9B5276DC228BAF0746B285B1516EF0DBC290214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607255, "uuid": "f4004b81-2cc0-4146-9e21-c798f0210504", "value": "6144:HKpb8rGYrMPe3q7Q0XV5xtuEsi8/dgU9HW3cZZRprq15Obr4vO8PDklovS3WHA7h:Z9HVTrmkbr4vLDa3/Lvf/1eu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633607255, "uuid": "ea70a1bf-70b0-4ec3-96eb-2fa7e53ea0c3", "value": 240640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633607255, "uuid": "9078f384-4cb0-40e2-ada8-16a2562c8a80", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607255, "uuid": "17195d6b-c855-4bfc-8def-37bbb81fd1c6", "value": "doc-142175413.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9d635b3-2736-11ec-843c-42010a9c0014", "comment": "Malware payload (OskiStealer)", "timestamp": 1633587654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633587654, "uuid": "1ee3381b-625c-4a59-817c-aebe3426369e", "comment": "Malware payload (OskiStealer)", "value": "0ea4142f50a9df0a5f83523ae1740acc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633587654, "uuid": "372d4c98-842d-4837-91a3-be024faafd9e", "comment": "Malware payload (OskiStealer)", "value": "024a5c3d369e1459332682cad7931a426722fdc2ec0950adc598e0227d0ef043", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633587654, "uuid": "b72b196c-4e8b-4a6b-bb2d-59a692868a2a", "comment": "Malware payload (OskiStealer)", "value": "ca4c2c469afa7c393b3b4071b1b211d1a0d2d067", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633587654, "uuid": "805a807d-f68e-430c-9019-4f16de4e13ea", "comment": "Malware payload (OskiStealer)", "value": "32cf0cbefe181ca68193bc8441731ea9bc68b086f3448dd2c1759326a59e746ac622d18c1851886900450385825f6ecc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633587654, "uuid": "c8ca6310-9749-40c0-aab5-b37610284d90", "value": "T133746C8ADA800494DC3A5771253A9D3166EBBEBAE4F4B74D5BCE71316BE30E3143344A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633587654, "uuid": "2e2f3946-51b9-4a16-98ac-254d29af1a74", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633587654, "uuid": "bb57fd32-3bad-4a71-9747-d16177bc7181", "value": "6144:n8LxBalknMomsXXvQjgHtl3d1WRnckCtn2VveksBktE07dyWH86Z7Wd:rkMomsXXvQKt71cnckCVAltE07dNcu7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633587654, "uuid": "7917c537-e1a4-4730-9b80-89baba2f01f7", "value": 366277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633587654, "uuid": "3486e378-918d-4234-97cc-b08b414da961", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633587654, "uuid": "0b17d23d-04d0-4435-83cd-4dd97db2081d", "value": "MECB 29018736.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1c8695-2725-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633580170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580170, "uuid": "f4337a9b-69be-4de7-9ac6-02f8ebbdb736", "comment": "Malware payload (Gafgyt)", "value": "6a2eb4503cc7ab4332446c5eb8ccb3e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580170, "uuid": "007e1648-232d-49ea-add5-87b6f73c2e60", "comment": "Malware payload (Gafgyt)", "value": "042dbced3c4a8438dd8871c6a546f2203d42ff6f3540ef5d725c14bcb031b5fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580170, "uuid": "c5b640af-24a6-47c7-adcf-7231c280fd2b", "comment": "Malware payload (Gafgyt)", "value": "14894be98cd81c03d9a541935b452f48028f93be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580170, "uuid": "7e9058a0-777a-4646-93bf-98ff4b86ecbd", "comment": "Malware payload (Gafgyt)", "value": "87c86b7b8b3e24292a069bc2e3ee25d2540ea4656c813c493fcae13a8ff2d4c45a19c3dae5609585eff7609c060ce8c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580170, "uuid": "2d37163a-8efa-401d-9e1c-5aace29cfec9", "value": "T1E7B3942A7E22EFFFE56886310BF35F708795229227919386F26CD6181F6128C1C5F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580170, "uuid": "f286b7f6-0983-44f5-9d89-c11db1c27293", "value": "1536:a7ju1Tmpq+XvY52rKdXesxek49Med8VXRRT/oYNEvUmkiSFxfC7xbXe:tE8hxek49eZRloYNEvUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633580170, "uuid": "6bb9ca94-fd83-479d-bb02-bcd1732fea1e", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633580170, "uuid": "a3b02b6b-a163-4386-af24-21534a4cdd18", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580170, "uuid": "64b0fc43-e91f-4010-a8ab-cc64f7ad574b", "value": "6a2eb4503cc7ab4332446c5eb8ccb3e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "175aa7ef-2767-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633608426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608426, "uuid": "d7a299fc-8d21-43c3-946f-32367a7b5985", "comment": "Malware payload (RedLineStealer)", "value": "245cceafa613c14d48cd7465b27ba993", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608426, "uuid": "9c1b0b22-14a6-4241-9cbc-13b77adf5163", "comment": "Malware payload (RedLineStealer)", "value": "059afad6c9d4183c5b32b89465732dc6ea7bf7192c0ed7e9f1dabfe65a17da2e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608426, "uuid": "8e0da30d-5535-4028-b5b2-315587acbd06", "comment": "Malware payload (RedLineStealer)", "value": "632a7f6e681b1ab5cb019c964d82d4aaba30fe82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608426, "uuid": "3f2d9dd9-6a8a-4185-b76d-068073e2beb2", "comment": "Malware payload (RedLineStealer)", "value": "90cf8a5255f28891832b909745f87d13ad10829da376d331a76d5f2ae07d3213f8826f288929600a31d4ab5ba6f3f635", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608426, "uuid": "1a928ba1-c77c-4bd6-86a5-f246024801eb", "value": "T19D73A4B7016294A6C5882334F4710F0B3A7CD6341981B698F14FF2AADC5D69D8EF87B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608426, "uuid": "c69c203c-d317-4434-9b87-3a329f85d66b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608426, "uuid": "d2417869-3883-4a60-88d2-22f0c70cfad9", "value": "1536:Zeg1XZikr8WQaZ36IaS+SUNWxWdsXMT0VoeI:ZeG8V9cUsxUkoeI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633608426, "uuid": "0d7e655d-fcf5-4d13-ba7e-352cffdeff1c", "value": 76800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633608426, "uuid": "afe1776a-cd08-496f-b8a9-fac931742b0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608426, "uuid": "05bee9b3-5333-4106-936a-da630eef7134", "value": "245cceafa613c14d48cd7465b27ba993.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b30cfed5-2766-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633608258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608258, "uuid": "7e8363aa-b628-4bc5-bec2-62f423332dd2", "comment": "Malware payload (Metamorfo)", "value": "ae07add8451b748db021179c3d492bfd", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608258, "uuid": "398bc0c9-c949-45e8-858c-9425f4a43110", "comment": "Malware payload (Metamorfo)", "value": "0681ef04e84e57b6b92162bc802a62c97a8f2973876b9cba5c8e17822c1a5a84", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608258, "uuid": "bdde337d-eeba-4bc7-8093-83859b04e62e", "comment": "Malware payload (Metamorfo)", "value": "dbaee582f3d0784d8a64a1358c697a64f52e2893", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608258, "uuid": "41787689-ad89-4246-a0f0-71681c823794", "comment": "Malware payload (Metamorfo)", "value": "145b5b5bd8ed3924ef38c78fc465a8324a3ae2807c25fa7177d7dbe39208f00298f2200909b19111c9f259c88eca3964", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608258, "uuid": "a01c5fbc-d2dc-4394-b872-174e6c1839cc", "value": "T18E31BE051EEA0329C3B38F7A1077A2464A76FC52AE934F5D808497DE2851050EC34E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608258, "uuid": "c37829ea-c717-4cdb-9c7a-b9a2a1731ce3", "value": "24:8+JUHRlVo5kcbA+Pxm+/P+fMw41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+5Z51cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633608258, "uuid": "ba4407c9-d776-454e-a579-9d10fbb1b4b4", "value": 1544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633608258, "uuid": "cc525aee-7c07-4153-ada5-068ee041ba80", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608258, "uuid": "777db594-b41d-4440-b228-eb373e584d5f", "value": "Anexo - 045071021.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55de50f0-2743-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633593069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593069, "uuid": "f42c508c-123e-4c1a-ba25-cf80619b42d3", "comment": "Malware payload", "value": "d2d09c451fa3bc3bcbf8e347e6399f34", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593069, "uuid": "e2640db4-c421-4020-9d2e-91218bee8331", "comment": "Malware payload", "value": "071d0b2e8059071bfbc6ce8261774b3dbc8cb03a25514bdd2ee1f5e9f3683778", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593069, "uuid": "6d2ac4f2-a76c-42c2-bb38-db9be57116a5", "comment": "Malware payload", "value": "a3cbabe3775e154743b9371c71df79af5f215a19", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593069, "uuid": "a4c3bf33-73cc-48b6-99c3-782aeaa55a40", "comment": "Malware payload", "value": "d56c2e6c8be1c3da0d8a3edb825b91626c13fc8f9fa2978b5d81c5dde5912ec2c093f2697d87517a3b6289932bb109a5", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593069, "uuid": "365ad57b-3598-42a4-b964-fb7ef1c1cb6b", "value": "T1D2B58E23B2C28537D0772A3C8D6BA3A9A5297D111E3C985B3FE41D4C1F396817E2D297", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593069, "uuid": "3ce875c8-6df1-4fd0-9933-7c1f6f1e6d77", "value": "49152:ijV5wnmHaE4zEHz+492tADZOHh/QL4tMMQknE0v4WkOy9bOGY49TaPcox20Gx4cY:W5/6E4glwkW/cQOYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593069, "uuid": "d3afe07e-b8bf-4424-a77e-f023af5175d7", "value": 2338816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593069, "uuid": "ce146a6c-d0d4-40d4-8aa2-c7d7b2f1c55a", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593069, "uuid": "8e1a0ba3-03f1-4086-9270-cbd51f569d80", "value": "factura - liabmiuwufgjcijjulub.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e08f05-274f-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633598257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598257, "uuid": "b4366ebd-4996-4192-a7f9-29c417e1598e", "comment": "Malware payload (Formbook)", "value": "7484f649ed9c9efff9702d7ba819c8b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598257, "uuid": "8351d0f7-ec47-41b4-9f61-fa181d54227a", "comment": "Malware payload (Formbook)", "value": "071ff0663683acd797626d877df6a388efed518c61ab3c083034c27841a6742e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598257, "uuid": "e84282e9-df6e-4641-8e7d-e44b8c05019f", "comment": "Malware payload (Formbook)", "value": "68db40566a78c955c8d76d5a8eee42a360b0b70d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598257, "uuid": "03761d72-94eb-4815-a17e-8514e0af989c", "comment": "Malware payload (Formbook)", "value": "3dce927e66d1005a767d20d03cdad0695982d15ed5bb7a09fff900d4652e741f28e69d000d171b7be7f4f0ab87aba932", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598257, "uuid": "9fe6a6c5-3582-4c01-823c-2228b3815fbd", "value": "T14D84F1A8133B9708CE7C97F52819AB511334D006205ED3781BD9E0FC7E67BBA9AE0597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598257, "uuid": "38a19b6c-9677-41cd-8298-76dea4d9996b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598257, "uuid": "987725e3-9fcb-4af7-bb74-81cd26abcc00", "value": "6144:VCPZFDQ+3HwOdySD6P/Hs3UKSA2I92Nl3t3BudR0Kk0bsxNbzgjYZfu0/:akowSD6P/HskKH90PMP0rz3rJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598257, "uuid": "51417d45-33ad-46b1-88fd-5934597e29b7", "value": 392704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598257, "uuid": "997fcad9-db98-4320-b7c2-0436582aa470", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598257, "uuid": "ae686df4-4760-4883-8692-b98b666f3fba", "value": "7484f649ed9c9efff9702d7ba819c8b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "191a08eb-273a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633589102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589102, "uuid": "e8190a81-93d6-45ac-9e27-89ee3a683d97", "comment": "Malware payload (AgentTesla)", "value": "6628709b965e3d78138fecc048b98c68", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589102, "uuid": "ed8a49cd-ec09-434f-8081-998a29deaad8", "comment": "Malware payload (AgentTesla)", "value": "0759ade497395058c6baf8cb9270f6b072dba66df354adb179adf7aa8c4ab4e4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589102, "uuid": "7acb2c35-d152-41bc-8a01-55f94e1f7f77", "comment": "Malware payload (AgentTesla)", "value": "4be0cd967a7d115b87ea2b953da17494608e1538", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589102, "uuid": "6edc583e-eb55-4e11-a667-61aad3f83cdf", "comment": "Malware payload (AgentTesla)", "value": "a521fdbcb945a7c0c79e4593fbc7fdb8724a22d36de0a31ce576332f5eea735e4fdd01ddcea53b480f4932b0373b5ad2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589102, "uuid": "a121033f-ab8e-489d-80ec-e348fe1850c2", "value": "T15605DC5363AC8ED4C06792B4DFC0C4B96C19D9EE421A53B4AB12AB64F75FC031E6A473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589102, "uuid": "c350517a-31ea-4ffd-a05e-ef0e0c82a5b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589102, "uuid": "11cf09a6-ed6e-4271-b26c-151170a4cd61", "value": "6144:scgFT6UqfAgBqI1TLGb/t7szWPARWfI/k5dXU6Kvl2ZlTsqSzka:17Uhm1TLGLt74/sw/kdXed2HPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633589102, "uuid": "d42cc884-f964-440a-a40f-d9c5de6bdb08", "value": 806912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633589102, "uuid": "bc6f40b6-c1a7-4d6f-b46c-834d7973aeac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589102, "uuid": "de7810c7-5a53-4ff6-be46-745746c17d04", "value": "Request For Supply , Delivering and Installation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f2c4e2e-2776-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633614989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614989, "uuid": "0bea4205-80a7-446d-8c20-a0e651c3c4ad", "comment": "Malware payload (NanoCore)", "value": "05bb5e32b24a72ee5d3ac6455ebf7369", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614989, "uuid": "af6837b2-cfca-4c10-a936-e93e05b4d14c", "comment": "Malware payload (NanoCore)", "value": "07ba9fe884e4a20e057b66172d43c23870e88889fda0b02efeca1110dd34f567", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614989, "uuid": "4b918da4-5952-4742-8613-7dfc0e1eeca7", "comment": "Malware payload (NanoCore)", "value": "8234995d2e9647796007daa1e9a2e59eec3e19bb", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614989, "uuid": "c470f58b-27d4-45fd-8da3-6abb5b64951f", "comment": "Malware payload (NanoCore)", "value": "b8d5830cc7ffd130d8955c1357311939456f0a4078bb482ebecf0307d1b43a4247b2ae680157f976ad5669eb266ee8fe", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614989, "uuid": "504aec6b-74df-4830-93f4-44ec560d0636", "value": "T114615461DBA77AAF13E19C0C6044ECD04CBC988A0E2CE6CF2C55321D2BCD91BD95C579", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614989, "uuid": "ae60a862-4817-4956-8d36-a9f45d5fc77a", "value": "48:TLDHePTEEEEEEEEEEEEEErQ2EEEEEEEEEEEEEEoBRPVbJxXw2a8JL0wtjI:37Xc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633614989, "uuid": "d5455e6d-ff82-457b-8ea1-554cb879a9cf", "value": 3351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633614989, "uuid": "e384d65f-078b-432e-8bec-c73b22bd7301", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614989, "uuid": "a09d2ab9-5a1f-4cd1-8f55-4129c765f8b0", "value": "G100InvoiceCopy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca330cb0-2734-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633586822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586822, "uuid": "b758633b-38bf-409f-bb6b-f8e8ab8b6cf5", "comment": "Malware payload (AgentTesla)", "value": "bd956b7d8e042669f5493982595f000d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586822, "uuid": "3a416dd8-ed6b-4341-850b-2cf6986b7b00", "comment": "Malware payload (AgentTesla)", "value": "083ad173620976025361c6e348e48fed5298ad2e2b075549981a221915621c50", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586822, "uuid": "268e14f8-aef5-4d53-a5a6-252849ba2b62", "comment": "Malware payload (AgentTesla)", "value": "691b2899f6e2cdf1898f11795db22c4d851fb8ec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586822, "uuid": "570dacf9-351d-42d6-8578-ad1e47e851b0", "comment": "Malware payload (AgentTesla)", "value": "5ea86dffdf7bebecf4ac0e03f551b4ad2b595d7c15789346b5e77c6e144f8e97d7bb3c10f6108bb46ed8b9df24a7fcca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586822, "uuid": "7c92d879-5d86-49ab-82d1-2f0b51d8b9c9", "value": "T121F44B987673FD9ECD17C97789543C60AE2C2C66534BF243601735A8AE3CA96DE102E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586822, "uuid": "1c977297-2af7-41cd-a36d-1a946ea20dc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586822, "uuid": "03af0ab6-8666-4962-9051-5a5d8764c868", "value": "12288:ZS++REQizvdIs6t0/lq8pcoy1MjF6c4jMKSmgUfbRKXPDdqrs2xX1o:ZSbRECs6YljcoWMZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633586822, "uuid": "646197ee-9ea4-49d6-a776-16f13912fc46", "value": 784384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633586822, "uuid": "db6c7aa9-9ef0-4670-979e-1b9e442e322e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586822, "uuid": "6b7b6c0b-c7a6-4113-a719-bac82b16aba9", "value": "QUOTATION OF EQUIPMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ca1fd6-273e-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633590940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590940, "uuid": "d7d3e5e5-3aa6-40a6-9eef-ceda63acb346", "comment": "Malware payload (RaccoonStealer)", "value": "6c30290bedf555aab7b65c58923776f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590940, "uuid": "c0149a28-9db3-499b-bca9-cf7ba62a5b20", "comment": "Malware payload (RaccoonStealer)", "value": "088524a1bb8efd9ffe5f7f9e7ee536fa38c277a3309c8d4c52f2e9897b7190b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590940, "uuid": "df7ee31d-a0ff-4894-8e6c-97001fce83bf", "comment": "Malware payload (RaccoonStealer)", "value": "c75e3a5a276b7b01b8f232e6dcbc2e230f317f10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590940, "uuid": "0f551ec6-9ed2-4397-92da-4b93cb15a540", "comment": "Malware payload (RaccoonStealer)", "value": "c486ff9a532ef43fdc97a5a8fb88cefb598bca8e3ea7764566cf37e40eaf69ee769e6e01bdb27bebc16360fdb1535eea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590940, "uuid": "8fe3897e-efd0-48d1-a06c-1c2fa3ffa16b", "value": "T1CE348E00A7F0C035F4B712BA4A7AC3F8B529B9B16B2491CB63D527EA57356E4AC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590940, "uuid": "e8ea96a3-4b4e-4d21-b77a-4df6199f5143", "value": "558186eb4208ff26294240429e60d1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590940, "uuid": "651353cf-5d04-422a-a2a8-ac76d4ee4015", "value": "3072:nBFPfRzZnLvFeXIv6yV/hikSQghO0SX37ymyP6X9VHbXLIbRoU4Sh3SOq:BFPJhteXIvf/LSQGx6XDHbn9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633590940, "uuid": "cc34cff7-79e2-4617-9a11-5612992ef296", "value": 234496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633590940, "uuid": "c711f87e-11f6-4eae-94a7-7f9f1076c255", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590940, "uuid": "5321e620-ff58-41f9-9a5c-4a73f955f54c", "value": "6c30290bedf555aab7b65c58923776f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcfebdc7-279b-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633631145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633631145, "uuid": "8ed8dd74-124b-4736-be7b-28f90987752d", "comment": "Malware payload (RaccoonStealer)", "value": "0bed944b0b8e6b3ab811ecbaf95f3d12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633631145, "uuid": "67158654-eafa-408a-922b-1b438054b574", "comment": "Malware payload (RaccoonStealer)", "value": "08a423286efaf529700fe4b765df6b91d0643fc8adf3d7e934744bad76ca6ce2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633631145, "uuid": "bcd8a5b4-9a71-4ce7-957a-4f4e9c09b252", "comment": "Malware payload (RaccoonStealer)", "value": "110b9596d13a44dae3b0214fa828a3b05440e91e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633631145, "uuid": "02f67239-06f9-4b64-903f-48d5f9d7b63c", "comment": "Malware payload (RaccoonStealer)", "value": "8422184686be0b20ced329c6ddb51f24b2c96f53b5c30990716f30392559de7de285aad0cf23b522a233fdd55db682f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633631145, "uuid": "54fb7a7f-0914-4fc4-8020-b692eb460e67", "value": "T10EC4E1047BE0C039F2B652F84A7A92A9A93F7EB1673494CF12D516EA17346E1EC30717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633631145, "uuid": "4c4dd2e7-b0a9-4abe-a7e0-ef198932e9f1", "value": "5723d007fd3b79d5a0887de51ad72442", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633631145, "uuid": "e4a2a59f-69c3-46b9-a392-ed7ba5dc042e", "value": "12288:tGbhnPuAwESSAVtg0pYzFoOGpiLUgjsAMZpNF:cbhPuAwESSKn6FHGnA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633631145, "uuid": "3a8c0e11-d119-4940-b264-d82a83bb67c1", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633631145, "uuid": "2878f095-6569-4938-9858-2e8f2967b489", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633631145, "uuid": "f005353d-e84f-4078-b066-9b217d8e4106", "value": "0bed944b0b8e6b3ab811ecbaf95f3d12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd6c875-2790-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633626177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626177, "uuid": "f919b138-a75e-4dcd-9e7b-539353a5f657", "comment": "Malware payload (Gafgyt)", "value": "ec50a5f0aadcb9885984695f8c815e9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626177, "uuid": "525a8db0-4bcc-428d-87f4-cea631bd62c4", "comment": "Malware payload (Gafgyt)", "value": "09a7bc3871d07f513beae320779f1a64f47d786dacaa1346f4200097a88acda3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626177, "uuid": "2de82e13-c61a-4273-a513-e7c3e54a1579", "comment": "Malware payload (Gafgyt)", "value": "646f0a9375bfd2e43578612e23d18eeba6a24782", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626177, "uuid": "8f3d69cf-31f6-4c1d-8b5b-80bf71870455", "comment": "Malware payload (Gafgyt)", "value": "3378bc49f68b265934fb3a4f674e3498d8ceb8edcb556043eca32d712e8d3076dba86ca2cc2a05bfcb9907ecde58f452", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626177, "uuid": "c9f6dda0-5523-49c8-afc5-7ac6f4e90c91", "value": "T1CE930941FD418B27C2D237BAE78F435D37366A5467DB33016A396EB42BC27982E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626177, "uuid": "5b4c8a71-adf4-4797-8224-a392ef4a902b", "value": "1536:LBkF9VQPAGaHYyEfgcqpq1innPTxHOxCePczYrmREqQ4b/X7XSee:OQ2HYBv1WTnePcKmREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633626177, "uuid": "51173817-e535-4034-bc95-618748b09e28", "value": 92448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633626177, "uuid": "2462081b-951c-4c15-8b70-0a95c1975ff2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626177, "uuid": "0ab1fcd7-5949-40a2-af46-5223b80b547d", "value": "ec50a5f0aadcb9885984695f8c815e9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92627041-2743-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633593171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593171, "uuid": "570c5e82-f480-4d40-a662-0feb1021cf1e", "comment": "Malware payload", "value": "0f3e2d179ebb992b24cd68899b4bb580", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593171, "uuid": "1dd8290c-49ea-4da3-816a-1b32f100b8ff", "comment": "Malware payload", "value": "09d926c0c6b0826f6667e62fafa0abe9322122d0c10d16c5d419cb74594516fd", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593171, "uuid": "68c0eac8-4b75-43f5-b957-27361193611a", "comment": "Malware payload", "value": "bb1ab0976eae5e76d147b31be7f06308007e68b1", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593171, "uuid": "d964874c-6092-4349-a8e9-9d5e84fa54cc", "comment": "Malware payload", "value": "51fcbc6d5d78d649892b81b207848c04377bf0ff096c00f07c0161d4230ac3001273efea85f331ed0a75b0e2da7539c5", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593171, "uuid": "98508555-937f-4342-876c-05e39501d27e", "value": "T1DBF07841E1EDEABB4187B2EA59EAAC90F17912870B74A6993120E112D42A3F8C599183", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593171, "uuid": "33fc8d15-b232-4bb8-acd0-17586f5263d2", "value": "12:9BFql9yWYgd3pm9iV5R9Gg2IIxmZ9y5HBZV6/go6R9GgFW:97p2EUMg2IIxmZce/goeMgFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593171, "uuid": "98a9482c-65ef-4b6b-8497-a03e89dc72bd", "value": 637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593171, "uuid": "e8cb2071-43d5-4c34-a9c0-8a624cd94dad", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593171, "uuid": "af91da70-aa45-45e5-b160-7f9d8740143d", "value": "DFIGG-282.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2077987-271d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633576876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576876, "uuid": "963e37d8-efa5-4c05-b66a-fa647e91ba57", "comment": "Malware payload (Gafgyt)", "value": "34b7f06ba73eff414f374de74f251e0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576876, "uuid": "651019d8-566a-46f0-8049-fff96795e5f6", "comment": "Malware payload (Gafgyt)", "value": "0b36bd88e89bc9c6004681cefa0525dc2f616f2bcee0ab8ae0e3e0cb4b3d5ea1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576876, "uuid": "2ab7f0fb-c995-4595-a238-04e7e695050f", "comment": "Malware payload (Gafgyt)", "value": "50d284e0e343b9e3b23f35a41d4cd0d3c6ca2185", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576876, "uuid": "06c0a736-f748-4c29-95d8-dbbae242a14f", "comment": "Malware payload (Gafgyt)", "value": "1778c21f121bcf368d08388a321a60d55f5ee338db185ed131df9c4417fc69065f377b91aff3b0d26b6c3118d287c26a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576876, "uuid": "807c1bc0-c96d-451c-99c9-80c16212270c", "value": "T145730B56E743C7B3C81306F202A7A96F8931FE3A5836DA4AE3257D54E7338D06212B75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576876, "uuid": "a5935f3e-6d16-4bfa-b624-9b7d30fd7062", "value": "1536:txXVxzBt9UzYJmwaFuTWMKOXsqbL5SA5NFZi:tBzBt9Uz8mXZOXsqbL5S8X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633576876, "uuid": "ddbc646a-6d93-424e-a05e-530350771b82", "value": 74104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633576876, "uuid": "613ed087-958b-4842-bbb4-9499550fd211", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576876, "uuid": "9f5b4b99-1f80-45b6-81f8-104710b40b7c", "value": "34b7f06ba73eff414f374de74f251e0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aaaf288-2748-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633595225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633595225, "uuid": "4d9c1496-ea71-4423-a323-d0ffbb4a9ae5", "comment": "Malware payload (AgentTesla)", "value": "bc3ee5673642c6c9ee142d3a4def7a8d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633595225, "uuid": "8bdefe81-261d-4a53-b557-587077ab64fa", "comment": "Malware payload (AgentTesla)", "value": "0b66c77b36e765f63a2e3b4ce5e17ab7ff02001739288b4a6ee17732c183b90f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633595225, "uuid": "ba8ced8a-bf9e-4649-b341-5cd98f0ad67f", "comment": "Malware payload (AgentTesla)", "value": "b23ad886992f9dc7610ac3165dbcaeea5442ebe7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633595225, "uuid": "3b9a65fa-4987-4ce8-b0a5-e2efe2742b11", "comment": "Malware payload (AgentTesla)", "value": "5df960c930159a229a409293e35d952f943543ab58c1d46f952c2a3058b70e306dc5c2af439adb8c959b17eb257c90d8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633595225, "uuid": "bad5bead-f00c-4fee-8bb5-337e3f9cf51c", "value": "T10FA402782327C64ACD2982F11C54ABD167F84091296DD3B01AE8F17DBBD3BF849E425B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633595225, "uuid": "13b96d7d-2899-4f89-a732-6ed7182dc273", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633595225, "uuid": "d3009229-67dd-4e69-b7ce-bc989c2804f8", "value": "6144:1MPyLlOEJa/5e2Z4XNaiYF8Ds8qdAhIcAsLByl4tUzhr8Zqw0wMrEtsHCkxeM6tw:W8On0DNa/6KA+cFt2lPj6mopf4gk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633595225, "uuid": "f5f6bf18-0050-453d-8c28-c5bd9ca08240", "value": 449536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633595225, "uuid": "3c4b9631-b5db-4296-a676-eab3065c897b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633595225, "uuid": "982d2656-7700-458c-80a7-29d571fba72b", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366fa738-2771-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633612773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633612773, "uuid": "6c082b57-4598-4dca-b74f-592ebdebcdaf", "comment": "Malware payload (AgentTesla)", "value": "dbd36aa1470ec6f1968f9386f0b5c15c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633612773, "uuid": "097dfae1-34d6-49a4-a5a1-ec9174cc96d6", "comment": "Malware payload (AgentTesla)", "value": "0bf6b11dbdd3eb139b7acfd52dac96f65eb394aa2747bc7fe33eaa7a05434149", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633612773, "uuid": "1d9ab2e1-7a06-4211-8c55-e4cb4ef938df", "comment": "Malware payload (AgentTesla)", "value": "c63e95eb34135fd161b6a21b68fabc5d45a82d40", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633612773, "uuid": "a1cd268b-c512-4596-9e1f-97f0573f955f", "comment": "Malware payload (AgentTesla)", "value": "2b8e0f4cbb54bd770d60ae281a17fdfc4877bf6c9082739a89e250a6f7f2678e84e88337a0075e6a30d4cec0a1e29cbb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633612773, "uuid": "7bf4025c-093d-4a46-9f4e-c4e683b9e5b3", "value": "T173A402888727462ECC3897F0181A6BA01774547B615BC3783AA4F0BEBD637F545E227B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633612773, "uuid": "7ce61358-187b-4bce-8f42-5e4886af1636", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633612773, "uuid": "f49f27ad-55aa-4114-a099-ed8adce4ef75", "value": "12288:C8UkoF7AIpocw/cK153+vDDOAg5GZIL62yP/9:CBk07V9iPIOIh24/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633612773, "uuid": "2c3e1179-7d94-4b1c-aaaf-c8971662ec3d", "value": 455680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633612773, "uuid": "d427a050-f1ad-4d01-b88f-c2237aacdad9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633612773, "uuid": "43a5c474-9146-4751-b74e-7e802567e05e", "value": "Quotation for Fish Items #6676.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "592962fe-274f-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633598229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598229, "uuid": "848508a5-8438-47ee-96e7-a23264e8eff1", "comment": "Malware payload (NanoCore)", "value": "77e7c359cd4b72b1698280b71f4ec5c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598229, "uuid": "eac53cc3-e151-4419-92d1-51b71a524f56", "comment": "Malware payload (NanoCore)", "value": "0c0fb03ae8f2a44f05bb46d66a05377aa4aa38ca79924eb71be2aea3344a8d64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598229, "uuid": "b7aa0ca3-df2c-4714-9330-ba06f03cd065", "comment": "Malware payload (NanoCore)", "value": "afa378b045cb8ebb9e50cee90617f4041495bb68", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598229, "uuid": "25d528c9-c706-4e85-86fa-91bc6b8c317a", "comment": "Malware payload (NanoCore)", "value": "b31fb7d73dc6c5c59b35ec3797e47ae3db05b7f0d3c83e03809905b863e84dce900f313aa875420c352fdcaaabe33613", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598229, "uuid": "6132057c-4319-4153-8282-7727095249c5", "value": "T14B351242B6C188B1DA731E316A3A67206E3D3C201E28DA5FA3D44D5EDB751D1A234BF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598229, "uuid": "c466b8ce-621c-490f-9d92-988d2d3c31a0", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598229, "uuid": "14893c2a-604b-4e23-862f-d6e1a9d4d033", "value": "24576:rAOcZEhRM4gMB/3Bp43mDDBhV+UKqWTq6ai0bagi7vzJ6:tvM4gMB/3BLxKRTq6d4a5vg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598229, "uuid": "74da902b-07e8-4acd-b341-8dad628fd34d", "value": 1109556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598229, "uuid": "d3306de6-aa2a-4564-ba9b-2d3487fa3a04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598229, "uuid": "884824ca-a412-4fa5-920e-675c08049972", "value": "77e7c359cd4b72b1698280b71f4ec5c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c226d2-274f-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633598223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598223, "uuid": "1d6a7b29-87be-4787-b049-4d5636d48410", "comment": "Malware payload (TrickBot)", "value": "e10a920ab1b10e3440e3af618e2984ad", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598223, "uuid": "c3e7b16c-9486-4904-bfed-52dd4da2799a", "comment": "Malware payload (TrickBot)", "value": "0c447e49621b34d77ed3787c07cf0e52d2db4c33a113fb6aa9074df277fdf1eb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598223, "uuid": "ac6be68d-3f5d-43ce-9d4f-c214471c2391", "comment": "Malware payload (TrickBot)", "value": "5209323e47bfce4972eb67590a32f46c6771ef6e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598223, "uuid": "ff8177f7-20b8-4e88-b69e-e8bb3589f49b", "comment": "Malware payload (TrickBot)", "value": "5b04bd07b09d9e45a5b25a558a544117822ada3a1c456b09e768f2db112257ab0ff51ae4a224df86f6e855bf2730ea76", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598223, "uuid": "50c8f490-af31-4d11-847b-67e4615bcd51", "value": "T161B4DF02B3C08836D67B227A49ABD71933B9FC204F65C38726C47E5F6E326D55E26352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598223, "uuid": "52742224-6e73-4265-95eb-e05284290753", "value": "fd98f67a63ecc847a2028c66b8388afb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598223, "uuid": "6edb096f-2e0e-4377-85c4-e225814ac57a", "value": "6144:b3oOkxQXFDzaLtFD2aD39AKit6lltqFpaI28VwPHK6+TDrAo0dThI9eq0NIaP:b3ExQ1DzM1j7qFp12iwPqvDr2VI9bZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598223, "uuid": "318f3aa9-9e31-48e4-b03b-6442407089a0", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598223, "uuid": "efa3f398-51f2-43d3-a4cc-c590848807fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598223, "uuid": "1ca7ab4b-9f59-4b42-a2f4-6d6be9d18785", "value": "e10a920ab1b10e3440e3af618e2984ad.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "700748a4-2743-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633593113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593113, "uuid": "e4de5831-2698-49dc-8641-d92eeb7ca294", "comment": "Malware payload (AgentTesla)", "value": "7ed0350a5380ad0a4dd698cadbaa4eff", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BIH", "colour": "#3A81CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593113, "uuid": "475a8d4c-76c6-4d15-8495-ff283ed3e21f", "comment": "Malware payload (AgentTesla)", "value": "0c4869935447443d1d193e521b99d741a6668da2b0069ad88a5931a1376cd669", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BIH", "colour": "#3A81CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593113, "uuid": "078af70f-d3d6-41c4-b2f8-7e0ff97bfd88", "comment": "Malware payload (AgentTesla)", "value": "2c37208658b6b479d9c941d534c31933d7c0e180", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BIH", "colour": "#3A81CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593113, "uuid": "8420388a-63ac-4042-b571-3ccf10f0be4e", "comment": "Malware payload (AgentTesla)", "value": "95914e32baaac0c499b501e48dd8149cf12cea9774c65ccdb7d72967651379bded5921faeb338931438db70e5d4556e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "BIH", "colour": "#3A81CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593113, "uuid": "bb94c8a4-7ae4-4ee1-a026-cc9a75468c27", "value": "T1B3258D38B38EAF96E82D0E7AEC13404043E08C676736F66B68D16BDA0C55ED75B1F191", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593113, "uuid": "f8f8599e-7818-48cf-a1e2-9ea308d2d6c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593113, "uuid": "0186c52b-58d7-4a9a-94b8-9a3af18b0c98", "value": "24576:A9plKoQkLu7sSd3Zk46Oh1Vcn5OY7sabSW5DdRXVh:Abl2r7sSdpYOhgRbdpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593113, "uuid": "a5fd0a25-4eb3-450e-9951-d8d03cde281d", "value": 976896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593113, "uuid": "ee6dd19e-d709-4f10-8062-6b746e453213", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593113, "uuid": "ba3116f4-f169-4928-8e03-954cc7d0784b", "value": "FedExOVO PRA\u0106ENJE-pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b98c80-27ca-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633651103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633651103, "uuid": "73c92df4-9538-449f-b8ba-f6df68abb883", "comment": "Malware payload", "value": "514d7999fe66e570441ddfe29816318b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633651103, "uuid": "3f08917e-ae56-44f4-83b0-802aa069f387", "comment": "Malware payload", "value": "0d26ea04ba2af21fab0fbef4ebe8331db037f0d540bc569b5591c2f613a502f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633651103, "uuid": "b912af44-b792-4fd7-9b44-7d3fcc12cb50", "comment": "Malware payload", "value": "f5a7e31fb788f45741539604bf3848850a18f7fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633651103, "uuid": "487a9879-5b85-4f7a-87c1-4c24da78806a", "comment": "Malware payload", "value": "6037bbed26f6f79ca63c194c4b9725b499097258764f6fd08a7ebc8fe8cb2dc394aaef38edf26fcdb65ebdb84cb75801", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633651103, "uuid": "4e2ecaa2-c20e-481b-842e-dca716f91378", "value": "T181D4011136DA8438F67E6EB44A71CAA146777C21893094CB27F15BBD1F264F0AF25B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633651103, "uuid": "ec6e70ae-671b-4706-a62c-8408d8d2b900", "value": "be06676f0b26f3557b735abbe8be48ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633651103, "uuid": "661b3be6-ae61-442d-afa8-d6c106ff6772", "value": "12288:Z1tcJvaci06JbV+g8+7rR+haFpXYhIX3hZb3TOW:Z1tffPqCOqhZb5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633651103, "uuid": "a50a0744-9128-4286-8f76-c9d9265ec9d5", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633651103, "uuid": "58b607e6-2ef6-4dcd-b5bb-ed5a70a75c27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633651103, "uuid": "828a2d46-9deb-4c14-96a7-1a00669d3eda", "value": "514d7999fe66e570441ddfe29816318b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757a2f6e-2790-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633626194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626194, "uuid": "d14d6c26-cb32-4f71-8cfb-c0ea61040562", "comment": "Malware payload (Gafgyt)", "value": "980dc20521a3ac00a77439d3e54e5c7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626194, "uuid": "e0b7aefc-ac4a-4dc2-99fa-60621a358213", "comment": "Malware payload (Gafgyt)", "value": "0d8a1879405bc51e0ed732f217861b71faf68ccae302ef24632a31c527893636", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626194, "uuid": "c04b7584-0f5d-4569-93c0-c4eb0652c264", "comment": "Malware payload (Gafgyt)", "value": "420701c9b424cd5bc8065d40d4baf07e22abfe7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626194, "uuid": "eb6791fc-d952-4b1a-afb8-3adab8387fba", "comment": "Malware payload (Gafgyt)", "value": "2b8b48ecabeb9cf9b62a50d3a5965d2987d4aa002e0c1546169dccc178d548e66df2c6aac4469f7f8d806d587c959330", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626194, "uuid": "552fc32f-0680-4caa-921d-d5c51fd5cd5f", "value": "T1EF930892B900DFB6F40ED77A04D34724B670FBA24E532672731779A6AE322D43826F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626194, "uuid": "07f0ea02-ebfa-4b0f-8a87-9e7f0b714178", "value": "1536:4wZTvNTV8V9eEG8ktQmzn5h8Jn9/QT60ydwgzT2fDhXTmQ9VqXjewf2Le:BjT49m8KT8RQT60ydwK+RmQ9VqXywf26", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633626194, "uuid": "2f69293b-c2cf-44f4-8efb-7ab96263848f", "value": 91087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633626194, "uuid": "ce0abf3e-8915-420d-a45e-73f5d82aac7f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626194, "uuid": "d3e56a0a-cd52-4f87-acb8-2975e9bf4ff4", "value": "980dc20521a3ac00a77439d3e54e5c7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d5c31b7-274b-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633596545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596545, "uuid": "6b0f89f5-2b64-4770-84f3-07712c04875f", "comment": "Malware payload (RaccoonStealer)", "value": "e7f6b675c2ee28513e3a1b8078b3d4ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596545, "uuid": "255b1ae8-224f-4405-9b11-ae09ddcd8de8", "comment": "Malware payload (RaccoonStealer)", "value": "0d9bae8c6ba3fe8d9cace7e0b9a68721f9febcc73730b00d1b103c318ba6f361", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596545, "uuid": "2128a3ae-a92d-411c-a986-bd4d5bf2f8be", "comment": "Malware payload (RaccoonStealer)", "value": "2554c0e33a90c30bc1e8b95e8d590cbe8018fabc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596545, "uuid": "5a03eae8-0390-4f1f-95ef-2c9b84149102", "comment": "Malware payload (RaccoonStealer)", "value": "a4c79b1438aedac0c3b932ec4b5025c042aeeb908cd800f909480c85f07dbcf38afeedeed172a475c964746de2229280", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596545, "uuid": "8e190d5d-3e73-471b-b7c6-23819ef52d03", "value": "T11AA4F100ABE1C038F0B753B9497983E4B92D7AB05B6990CBA3C517FA5B356E4AC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596545, "uuid": "435a961a-85f7-4906-889a-209bc06a5322", "value": "dfddb4935ecfeccd8e67f98d0f98b8e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596545, "uuid": "ab3bac51-71aa-4553-b471-bf1fc1c7d59d", "value": "12288:1FxzOOQglVLw0667k3whdJsCnaBE2Q56ibyy7VTyO:1FhVL7o3kJsCaDAFbX7VTyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633596545, "uuid": "c8689cc4-424f-43ea-ba26-8006bcbe1104", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633596545, "uuid": "4fc1874d-fe93-42cf-bc8d-afc170b1a07b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596545, "uuid": "3b06e2f6-7604-4e3f-99dd-d8c876435424", "value": "e7f6b675c2ee28513e3a1b8078b3d4ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3750d47-279b-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633631103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633631103, "uuid": "c01d1648-9fd3-4988-9bee-0f6624f6ef8a", "comment": "Malware payload (AsyncRAT)", "value": "94289a2eedf546dd9dc0624908d1dfba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633631103, "uuid": "9885cde7-da8e-4851-bf7a-0216c44f37f7", "comment": "Malware payload (AsyncRAT)", "value": "0e4c750ad5a103cea722035958040e4c37647afaf7699c78c235463991f1caaa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633631103, "uuid": "80810eeb-bfcc-4c47-9746-4eb03fd6e2bc", "comment": "Malware payload (AsyncRAT)", "value": "84d1c403e52f982604e144a8053a3f566c741f2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633631103, "uuid": "6a49e465-02a5-4977-8049-812c555f8f82", "comment": "Malware payload (AsyncRAT)", "value": "b0cca86ed26532a04d8268b05a35e310bbff5b4cdcdc983951e2241abb0a1e5c72c121e248bb790d3144a54af89ff34a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633631103, "uuid": "2c1e0263-4cee-489c-8f91-e589d8db442e", "value": "T1FFC4E47C266E5E4CF39094BCB2B58DFF27A1BC1F45A7B4F3901CA1D70AA9BD05502226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633631103, "uuid": "341bc809-d6ad-480d-9487-df2308cfeb77", "value": "903119b637f155dd7ab6c6a49ae6012a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633631103, "uuid": "d04f6f74-d8a8-47ab-b3e3-afc574be4058", "value": "6144:jC4w8juap56y9dg4sIo9ZCf6YRZDYooV3FtlyPG4wYeVKiEgoaratgMZ:2napvg4sz9dYRZsx1tvpE9ar3MZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633631103, "uuid": "f009c7a3-954d-4f51-92a8-bf3ec38259f1", "value": 583050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633631103, "uuid": "436256e7-de5b-4707-91ec-563d382e705f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633631103, "uuid": "de9c3c36-71fb-4094-ac3e-56769f67d40a", "value": "94289a2eedf546dd9dc0624908d1dfba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef97e80d-2740-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1633592039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592039, "uuid": "e6274608-0eba-46c3-bfab-4816960db66a", "comment": "Malware payload (Neshta)", "value": "fbc1ed64be96f47d5cc3fbcb21cce10f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592039, "uuid": "1e054708-9c3d-4597-849a-24836c997ab6", "comment": "Malware payload (Neshta)", "value": "0fb3c7511c6494252676592eea6db4da4bc89977c066a5e4f7ea599c3c9ad8d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592039, "uuid": "c0bdd1c8-d276-4398-b081-ed858064fc6c", "comment": "Malware payload (Neshta)", "value": "a2c3c2aa059f835a54f26aa385153690afc3510a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592039, "uuid": "8b65005f-663a-4f78-8696-c24edfe0ffca", "comment": "Malware payload (Neshta)", "value": "ab4315282346d2b5ac84c82e61411b6ddac0b4b2ad5986e839b944135b989a2d48ffdc4abcab5664eea08a743173d440", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592039, "uuid": "14498efd-87c7-4c8b-99f1-c4d340e7cf96", "value": "T1C294F16913674718CE7587F07C78D29217B9641A609EC3781F9CA0BE3E637788AE0793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592039, "uuid": "53598cd9-8edf-4e4b-869d-8b1af73c9218", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592039, "uuid": "9d3a6678-eb8f-4811-8091-eec950e0cbce", "value": "12288:t4fzkoaLVjuE/Uve9ATOS/UJIjViCUoZ:Kzk/juE7/XuiCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633592039, "uuid": "62576c16-4259-4d7d-a830-1a4d48111d57", "value": 424448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633592039, "uuid": "8ddbdc40-e04d-43d8-a760-4c274e198193", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592039, "uuid": "3412ab4a-04a8-4d55-a946-64cf28a8bb06", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53107c4e-2743-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633593065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593065, "uuid": "9cd9a36a-c027-42b8-9245-5998b5280f66", "comment": "Malware payload (AgentTesla)", "value": "9713274ac94c4ddfc04462800b61b720", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CZE", "colour": "#9FD7C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593065, "uuid": "6b7cb473-3425-47a2-9285-0b954ccf5a79", "comment": "Malware payload (AgentTesla)", "value": "0ff188becc639cfad99d2e1cc8ac47b6ba50b1326d70ab2381a23785cb428880", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CZE", "colour": "#9FD7C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593065, "uuid": "7ca2723a-b604-4874-879d-6f8d92983a94", "comment": "Malware payload (AgentTesla)", "value": "1830737542e4f99aca1f4385b14c98e079f4ea84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CZE", "colour": "#9FD7C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593065, "uuid": "06adb6c2-7426-470d-885c-993f7f87099a", "comment": "Malware payload (AgentTesla)", "value": "58bf0c014bea176ad1d28ff708318709bf70bb104578197ee9bcb6893011c841a20b2192eaa244532acb540020e80522", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CZE", "colour": "#9FD7C1", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593065, "uuid": "18431043-b501-4764-aa2a-5293ecc3a67b", "value": "T10F055B14A3DDD61BC82D1E3E483F5B4B43E2F5CE7335EA8A65CC2B933701A52AD8A544", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593065, "uuid": "6f8c31d1-ac37-42d9-97fc-cdb828f0e37c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593065, "uuid": "11b2cc40-ec86-4799-8000-f68fe8ae7d17", "value": "12288:KQqdd4EZvH2T6ZVCFerceerJuPp9NgC4C4i:ZqY8H86ZAIuxC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593065, "uuid": "68392676-8151-4415-b059-b36b6e57df70", "value": 867328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593065, "uuid": "5f6a226d-c957-4169-9c8a-85020bfc76d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593065, "uuid": "000367fa-864a-47d0-b3c9-aed6ee3325b6", "value": "Potvrzen\u00ed z\u016fstatku 10.07. 2021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0145b1c9-2767-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633608389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608389, "uuid": "954bac76-7c31-4c76-a056-55ae57ca4623", "comment": "Malware payload (Mirai)", "value": "5325140b3ba7592a7d8a86766ae22b65", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608389, "uuid": "521f76d3-6b18-4330-815f-29f651836351", "comment": "Malware payload (Mirai)", "value": "10d49d922a328a32d69271cee3eed0b96b1b7c76891459149a282527f3850be9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608389, "uuid": "1f658261-1d8f-4c2d-987f-8d965697ae7c", "comment": "Malware payload (Mirai)", "value": "3d9850b2b84624908245415cb0841b2bd3cacb2b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608389, "uuid": "8f0e00e7-1727-4606-b828-767c504a31f2", "comment": "Malware payload (Mirai)", "value": "c4d5490b8244581914f81fbf4f0f3a4b0c458123a99076c27e1edf4e55b60d5eeb873d49c01ba42d330429d2e9d7fbe0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608389, "uuid": "756b975d-4b01-4ecf-bc76-1de946d305f4", "value": "T1DAA34A56BD918A12C6D4237BFA2E008D371563ECE2DB3213CD195F5477CA92E0DBB2A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608389, "uuid": "bc80b005-6679-4b0f-9f49-5aa1210770a2", "value": "1536:SPeX+H2fXf57sZ24zqezSPaHzgqpiRCrMmGXixRTMMdk2fiv64fvlll0MP:SPzHOX02PaHbQm5TwMXavllllb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633608389, "uuid": "2bb7ee5a-8212-46c6-8b31-952aa77e1c5f", "value": 104012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633608389, "uuid": "3a89b03f-71fb-4a41-8e3d-339595f9f74b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608389, "uuid": "e84b8bca-edbb-41fa-ab0c-2fd8107ba467", "value": "arm-20211007-1206", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ac209d4-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633597399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597399, "uuid": "4b8af610-44de-41bc-b4d4-7e75bf98a5fc", "comment": "Malware payload (NanoCore)", "value": "251887937145c5fc6ecde0c38131f076", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597399, "uuid": "c0e57cc4-a110-44bd-9f7e-21596da81e97", "comment": "Malware payload (NanoCore)", "value": "124293d19cb354c1060067ae0be884092e21905b90329eca9da037dc4a49733d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597399, "uuid": "c57ee878-30df-4dcd-9ea9-9416dd120b57", "comment": "Malware payload (NanoCore)", "value": "3253ee1d5102ee0b158aa59f5e03d277e2a79d62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597399, "uuid": "1886ad4a-9517-48c7-b14c-e7a7b2390c99", "comment": "Malware payload (NanoCore)", "value": "ebd558013238bdb89304f4380335e21fe08c837d9782c54e6d26c90ead232f4e1b738ec3374901df37c402d5697fde32", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597399, "uuid": "d3b1184f-411d-406e-ba46-ccbae03defd1", "value": "T1E853D883718254FED8EA59F2E11B982016036C2AF575986D03E9777A09F336351EBF0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597399, "uuid": "eb13dd09-0e4d-4128-acfe-ff6e9fb44cd8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597399, "uuid": "3198cfec-8922-46e8-8062-bd7b2d52186d", "value": "1536:D8KkfOM5YwwbkZ/R9hH9BGK2osztFsEzLaURroCoU30+HG58F2g7ELBw44444Hbj:D8KkfOM5Yw6kZ/R9hH9BGK2osztFsEzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597399, "uuid": "60b274f8-9390-4852-aeab-87bfdea27dba", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597399, "uuid": "eb6b6624-11a4-4b14-b37c-5c1f4fbd13c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597399, "uuid": "a1d48350-d69a-43b7-9a88-b76e01c7653d", "value": "251887937145c5fc6ecde0c38131f076.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7a4ff6c-2743-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633593233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593233, "uuid": "6b040d72-c858-4948-9bda-766f96ae7b7d", "comment": "Malware payload (Metamorfo)", "value": "8fda4f36d6df7c1b1bce2bc1c6a51e21", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593233, "uuid": "f2df0e32-3173-4ea9-890d-03092604b1a3", "comment": "Malware payload (Metamorfo)", "value": "1271ac7fe2dbbd5af9c64d1cc0528da929424713f6efe61a53917140b39fd250", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593233, "uuid": "7bcd21b8-cd1c-4720-b8ad-a56d5e7a3cc3", "comment": "Malware payload (Metamorfo)", "value": "de019442865aba52cf53bcb0189a4de93a43b96a", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593233, "uuid": "2c474378-c3a0-4f47-bbc9-cdfb21585aba", "comment": "Malware payload (Metamorfo)", "value": "f02d1d650773aa54f0be57be67e488a6d5bbfee0867d46dce66ca310234d60f371cdf70e0e8af8ea9da603c7036353e3", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593233, "uuid": "35a4bd25-cafa-4f9d-b56e-1399b6177a18", "value": "T17631E1091AE6172AC3B3CF7A007BA2064A37FC51ED934F9D84C447CA2895040FC34E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593233, "uuid": "fbcf0698-f81f-4f30-8b20-86dc72db0f48", "value": "24:8+JUHRlVo5kcbA+PsO+/P+1ZWSz41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+Ywe1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593233, "uuid": "52729544-a6b1-4175-b765-adccbf06c214", "value": 1568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593233, "uuid": "69906e41-a7d8-452a-9cf6-c38670ce4a0d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593233, "uuid": "f1687919-02b1-44ee-b210-efd6e9af15f6", "value": "Anexo - 0471061021.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77e8b41-2753-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633600105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600105, "uuid": "2db62755-d26c-4216-adc2-4cbf4e5928ed", "comment": "Malware payload (Metamorfo)", "value": "de9f22501e06c2d0ecaf14862823d457", "object_relation": "md5", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600105, "uuid": "ca36447c-6671-4271-b8f5-ed48be9bca5f", "comment": "Malware payload (Metamorfo)", "value": "12863ed0e87a424168e6a6c470014609b3cdd7253d4aadb1d122251f469f5466", "object_relation": "sha256", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600105, "uuid": "0fc077f8-89d9-4698-9fde-ecdd4463d755", "comment": "Malware payload (Metamorfo)", "value": "91a75535941b373b40b768aa6fcafe9670aac1ef", "object_relation": "sha1", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600105, "uuid": "7bdf0878-0636-47c9-824c-47f501858afd", "comment": "Malware payload (Metamorfo)", "value": "306581fcd7a61ed5dec7e1e8d169e85974a7c9213bed62fe2194d4849a78e68710dd821666cbd492a870551e867d52ee", "object_relation": "sha3-384", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600105, "uuid": "55650edb-69b1-48af-934f-ea708e471ecc", "value": "T125447D06B3D5437AE4DB13322B8F93628B72EC788663412B1259750E2EF1554B7B73E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600105, "uuid": "b0e6c0a4-431a-4eb2-8c33-e7e2248c2337", "value": "3072:Fmci/0903DaYGAxwgz88ereWn/7w05g0yMcB3RUN46ILJ9+ZB5yOanHI:FmZ3DaYGAM8er1nzTrrgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633600105, "uuid": "b4561cb1-92cc-4956-85ea-502578bcae06", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633600105, "uuid": "ad4aae45-af84-4313-8c6e-bef52fb76ab8", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600105, "uuid": "0dcc1824-b167-4e6e-92cd-d3c4ac9157e7", "value": "de9f22501e06c2d0ecaf14862823d457.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9365d06-273b-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633589773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589773, "uuid": "bc320867-93a1-4904-adc4-16332a1208e6", "comment": "Malware payload (Loki)", "value": "e39482b2bc1add7c1b181a8b1bd705bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589773, "uuid": "c84af041-329e-472f-bbaa-0c201b78d787", "comment": "Malware payload (Loki)", "value": "13404bd37fb5ffbe300e5875febb1934d03344f4c6e7dbc0d2dc2def3253ef34", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589773, "uuid": "9aa43187-31d4-469d-9822-bf34ccc5961b", "comment": "Malware payload (Loki)", "value": "a12c5c204db3cd5be5baea04d30781a7c26ac5f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589773, "uuid": "ba317a3b-082e-4dbf-b45c-dc112b45306e", "comment": "Malware payload (Loki)", "value": "7bb214d29cf0be4a3583225b2b58fcf0ec28bbf62c1b71794f7abff6936aafea2230a8fd0efd3813d891028a83f1922e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589773, "uuid": "336ecf3e-a6b9-4ddb-a120-2fd19fcdb971", "value": "T155D46A701202FFAAD16A4938D0473913BC857B2F1770419DAAB73AB99DA61019BFFC74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589773, "uuid": "25d82a4e-70a9-4f39-bb68-803308ca1816", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589773, "uuid": "351a9cd9-9b51-43e5-b3f8-d446467eb71f", "value": "12288:eraEZp2r46ZhvH71q3VYFMgog0Y4uvE7bXdb+xjN5WEm5:ct6Z1HZqmFZ0YtvEfdb+xjNMH5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633589773, "uuid": "fdcc345c-bb44-4119-a3b8-95508edbbc29", "value": 639488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633589773, "uuid": "a7b782e6-de34-408d-b5e1-c019c55d3d18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589773, "uuid": "99b175a3-1ab4-4089-99dc-5c6cd63a4a7f", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e30aa5-274e-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633597653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597653, "uuid": "10710a40-e051-4105-b0c9-f8a81a2fbabe", "comment": "Malware payload (ArkeiStealer)", "value": "2354ba28ef06dac16392bca2b55ae460", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597653, "uuid": "72e45ba1-896e-4929-a59d-6c42973eb78e", "comment": "Malware payload (ArkeiStealer)", "value": "134e50b02298dad887961598fe034b2104606ab3c0c9ae90274738d032f88888", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597653, "uuid": "0116a6a3-14e7-4369-8a1f-94d55dc96819", "comment": "Malware payload (ArkeiStealer)", "value": "b9b659775117d3b13c5bda039f511927f52586cd", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597653, "uuid": "56916e7a-ad1c-47c6-b8d5-d9fe36981b9b", "comment": "Malware payload (ArkeiStealer)", "value": "59bb150e405418632269979a3dae74c9ba4219d146ab603decdd27b48569995b4659e9d117ba859799c7230ca4635fea", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597653, "uuid": "8262ec9d-6a5e-4bd8-8722-89cbf1e0c8a9", "value": "T1E8E4023031D28BF1FA6311706D65C7B0877AB9AE7962B08B3B90262E1F7D1D0C667316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597653, "uuid": "fdb234be-72f2-4820-84a5-7056b3077f85", "value": "b53fbcd1371b756c61ce06a61be781ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597653, "uuid": "45cf8f43-ffc2-4a27-b43c-8ddad3cb183a", "value": "12288:WS6Am4uWcYGWblHed94NJV563aWSK3zFWlI4p5zVOnmQkFvx1r2CCOn0B19b:WS6bWrRpedIyqWCl/5EdkTNgXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597653, "uuid": "4390c644-db12-47ea-8ba2-61b20ced29cb", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597653, "uuid": "cb54d708-9a5b-4e89-aba4-d09c52e4ba35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597653, "uuid": "58ead780-354f-4550-bf2d-41b360df28f4", "value": "2354ba28ef06dac16392bca2b55ae460.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ade3ab-2771-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633613067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633613067, "uuid": "f96e8a24-70d6-4003-b0a2-3057769901e7", "comment": "Malware payload (Metamorfo)", "value": "6f2a01dcadd6cc1fc099fe59fde97171", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633613067, "uuid": "9a16fe08-7c44-4a91-ab84-00897187b28d", "comment": "Malware payload (Metamorfo)", "value": "1351445d377427f918d0b086e1017f43b19b836b8c8c69ccfef6ed7bef7102fb", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633613067, "uuid": "6d9e3f5f-6541-4b29-9402-6ec823d9ad21", "comment": "Malware payload (Metamorfo)", "value": "57154167acace25adebd346c4cb8b111f3bf4e1f", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633613067, "uuid": "0b091f82-3645-416f-ba82-104449982af0", "comment": "Malware payload (Metamorfo)", "value": "7cbb7ed02a70b59d5ac3c6a2ae52df42aac7418fa6be76b9375013fd878ee013f03e08afded16d07c6035170708c37db", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633613067, "uuid": "b302c287-aab4-40b5-8f52-0f3eb9182b86", "value": "T1C7318E091AEA1329C3B3CF7A5077A2464A76FC51AE934F9D80C497DE2891454FC34E6F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633613067, "uuid": "3d2260f7-82cd-4e77-b044-c07af97bf386", "value": "24:8+JUHRlVo5kcbA+Px5+/P+PZ63Mw41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+5GkD1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633613067, "uuid": "8f792e56-46ff-442d-bb13-ee062b5c0f52", "value": 1544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633613067, "uuid": "886dc6bb-178e-47f1-9f16-ccf37f6eabda", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633613067, "uuid": "663b5339-58b8-4a3a-ae10-703f86849a47", "value": "curriculum.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4896325e-2723-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633579303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579303, "uuid": "40efffcb-1d7a-4ad0-b936-3a6a6e491b51", "comment": "Malware payload (AgentTesla)", "value": "dc09e6dec88a18b5631ff8a221593a1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579303, "uuid": "01f61d7f-60a8-42b8-8bab-dc651487674a", "comment": "Malware payload (AgentTesla)", "value": "141c6b8848fa3cabc916fd0c8048c2a2a7ddbe9009520cab75154843d7cddbe9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579303, "uuid": "602cf4ec-29ad-472c-a1c8-d03746dc82a2", "comment": "Malware payload (AgentTesla)", "value": "0b878e9c0950de8b6a1bf434d296650df66bedbd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579303, "uuid": "80f3e3fc-dab3-46fb-8cb0-12b868f6f5df", "comment": "Malware payload (AgentTesla)", "value": "3ecf2ea04f18a9c5a72c77c27e413b36f0fe1de29fb05fa8a5586d7dff81ab312f582c0a03c02d3c4562497dfc97d85d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633579303, "uuid": "7c5341b2-ea18-4ae5-ba59-1e5c5a7e07f6", "value": "T17245E003E38544B7D47A073155A75B207EBAA8301BB6971B9BB0497DAE323417E34FE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633579303, "uuid": "083ea71b-f8bf-43c8-8c1d-8865192543b0", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633579303, "uuid": "00272fc6-80d2-4a4f-a337-1bf83ec3ee8d", "value": "24576:rAOcZEhRZfrz4oHKyhTUwrKXYgnRFw9LV1Ocjh0IB6n:trZfwoJhTH2I+wj1LjOy6n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633579303, "uuid": "54372f91-ca74-47b1-9e13-f7dff6abbbdf", "value": 1203067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633579303, "uuid": "c7c4e94d-626a-423e-901b-5df85441cd1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633579303, "uuid": "6d6e6a65-5f83-4297-abb6-35b49cdce28b", "value": "NEW PO65422.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a6bce99-274c-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633596969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596969, "uuid": "bdb7e334-14ac-41cf-9711-7d0b0332fdcf", "comment": "Malware payload (TrickBot)", "value": "936483a6f1d7755a6b581987533ccbae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596969, "uuid": "d235c6d6-8ecc-4cd7-bc36-90b2aa4c51e2", "comment": "Malware payload (TrickBot)", "value": "145616da4b93278dbfc89aaaa231090241544507ceb4dd74468848867cd88836", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596969, "uuid": "43f489a3-d355-4a59-8474-8f8c847a36d6", "comment": "Malware payload (TrickBot)", "value": "dfc4f036b65de215f6e44fed44b025ea18d4f69d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596969, "uuid": "42938102-a1dd-4bd8-bd77-177c79dfa251", "comment": "Malware payload (TrickBot)", "value": "c310c6a157ca8894947a4408a13bd0a36fb13e9902cf97d3696af7ba0b9a31348bb1a0d60d291ab3089846240574c543", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596969, "uuid": "6e106504-1fba-4c59-ad22-fb9ed2360f6b", "value": "T1C9D4C012BBD08876C99322324AE3A735A7FDEC015B22C7CB57D46E1EAC726C54D36316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596969, "uuid": "fc57153b-4926-4fdd-a18d-23b89582c417", "value": "96459f3ac5474c1f5d7b0f19d0d0d7ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596969, "uuid": "2940a128-ab5e-4bb7-8e2e-1edfe619b62f", "value": "12288:f+t405GC8+pDum1o7RBBun3vDNopBzZ3a:eB5GC8+pDybBMvB4BFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633596969, "uuid": "42ad9734-9a2d-4cb1-a420-1c145e571e8d", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633596969, "uuid": "49954d1f-3bef-4865-b8e2-d8bf3d27c431", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596969, "uuid": "5f64b798-3650-4949-a10c-7dec8d1af049", "value": "936483a6f1d7755a6b581987533ccbae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dac7ce3-274c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633596948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596948, "uuid": "17373f2f-63aa-448e-b1f8-98c0229a38e1", "comment": "Malware payload (RedLineStealer)", "value": "afed93c127e63cdb7f04cd0d855a5ad2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596948, "uuid": "e58a1915-8fb6-4951-86ed-9744725fa9b4", "comment": "Malware payload (RedLineStealer)", "value": "147a81a818e41f31acd78476ad65f7e59ff3c3bbd85626d91456838c8acacd11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596948, "uuid": "d34ba0be-08dc-481c-8425-5f9e17b6ffbb", "comment": "Malware payload (RedLineStealer)", "value": "77c3aab568172d67bccfaa7394ce2bc9426529e2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596948, "uuid": "02645785-bd1a-4bbd-8e35-98e92b799202", "comment": "Malware payload (RedLineStealer)", "value": "3fc7d886a23c524574973ae4992fd75b9852f32de5520c204497fb0f869fe4baa057df133c96cf47ac1c0329c360d1e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596948, "uuid": "a9c6bc4e-2786-480c-86b5-ba44de73268c", "value": "T1A964BF00AAE0C035F5B712FD497993B9A83E7D715B2890CF62D526EA5A397E4EC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596948, "uuid": "0d413128-d862-41f4-ab6e-19d28c437cda", "value": "654aff1ee1bc89531bd3b96ebe76ae67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596948, "uuid": "edb38e4b-be3b-4350-956b-bcaeac53db28", "value": "6144:DQ0pxdeRn6E7/AMiYAXIG++2IljSFgosSqrLGpdPUlLxw0:DQ0jdecE7/nGl2AmFgKqrSpdP3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633596948, "uuid": "8dc26543-afda-4a09-a82b-4bfe087dae8d", "value": 336896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633596948, "uuid": "d5f651d3-0557-4bf3-b93b-531d160c5441", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596948, "uuid": "58e4a1c6-8a19-466a-8696-b3f21866da2b", "value": "afed93c127e63cdb7f04cd0d855a5ad2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e69e323-2771-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1633612921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633612921, "uuid": "b33b924f-713f-4481-bf19-7688aec94a12", "comment": "Malware payload (BitRAT)", "value": "7d0a56315fea6d4cbc66a746c567baec", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633612921, "uuid": "8479becb-5746-47ad-af62-8be24ded56c3", "comment": "Malware payload (BitRAT)", "value": "147db571f4663d61a2d6b6aa6b99fb3ed2b1d4436bb4764db7ced65f4459f7b5", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633612921, "uuid": "60d33eaf-d7ca-4171-b07f-f52386430968", "comment": "Malware payload (BitRAT)", "value": "f9ad425f002fbaeecb84da1b3d0495df3500b2c8", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633612921, "uuid": "bcf6d674-14c8-495b-ae6b-028e6e531c75", "comment": "Malware payload (BitRAT)", "value": "95ebf3cf2a0e9c05a13c850f0cb8392288357f2bb59e8ea8b626293610c3646dc667a1d2eb5c2f4e5a847ecf922b917c", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633612921, "uuid": "18ed7c57-1901-4a98-b2cf-dee28dbb52de", "value": "T1FF71E9BD2B8948C0D75A49F291687C741F1173694CC7618A386DCE530B2E95ECC5B4CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633612921, "uuid": "cd013dfe-6d52-4c17-aa46-a7d59567f633", "value": "96:khdMbrJu0pofpMuf1gNhX50MqPqBeWywSGIa:khdAqHyNhCMmqM/wvIa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633612921, "uuid": "6a8f6aae-026a-4058-a9b5-d9ed9b12cbda", "value": 3525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633612921, "uuid": "4acc6551-f761-424d-9eff-935a8b75d8d9", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633612921, "uuid": "7d6ca420-9946-4bd6-8eec-0d49835dec41", "value": "Inquiry 001742021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6bfcce-2769-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633609487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633609487, "uuid": "4fab8b37-a1f3-4d40-99ba-c17a59f71b85", "comment": "Malware payload (Formbook)", "value": "864b47d06b1d8e596b300de16fbd851e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633609487, "uuid": "1c3b9c35-16d6-45ed-b270-a438ce150bc9", "comment": "Malware payload (Formbook)", "value": "1496d44be4c4e531ed56f7e3f3e6798cd7bf66727a235918c518177b27420c08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633609487, "uuid": "9fef055c-a680-4b00-85e8-1517ffa7cf1e", "comment": "Malware payload (Formbook)", "value": "79e733a2859a1dd17495c9cb2f5f57c83e25e8a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633609487, "uuid": "c1e127fa-cbb5-4f21-8571-f43e728e0927", "comment": "Malware payload (Formbook)", "value": "0e5e7152fa4ba4ac5951df242706a245b2edbce6386b3e5152890c534c8450e0e524854fe8a0816ffe880f4339ff5ff6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633609487, "uuid": "66b19e19-3249-4bcc-8fa2-b50a29f13c26", "value": "T1A494012803B75708DD7D83F93921A7A157399116605EC3380BE8F0BD3E67BBA09D568B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633609487, "uuid": "ccefbd0f-f577-478f-aef7-9303ce26c38c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633609487, "uuid": "04f5bc50-9643-4013-b061-ea0a6b1eee87", "value": "6144:FQNIZWDQ+3HwORsN1QvNvPp1BFkAAUPLcD5rz3Oj4g5wD5URomaXysTH137Ji46:UkoRsN1QxPlFkkjcByj4M+URZsTHhp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633609487, "uuid": "147e5bcc-6c53-4d68-8f02-050f7538c7be", "value": 417792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633609487, "uuid": "6f9fe564-9ef7-4bb6-be35-2180c99c9c4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633609487, "uuid": "b1e39bb2-5944-4a95-b65a-fd0a30dbdfe7", "value": "Quote -0071021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6bc3fe-2740-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633592003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592003, "uuid": "5b64c252-d5f1-4221-9110-23c7af6fdc4d", "comment": "Malware payload", "value": "173e5d9618dc2c299e4ed0eda1b20c11", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592003, "uuid": "3f0f75e3-4a48-4bb1-9ba8-6cddc4a1a284", "comment": "Malware payload", "value": "1577b04bc818c4be8c965e42c533dcbda7a7ed48a69408de8c9d488cf85b32de", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592003, "uuid": "159dd141-1c49-4ec3-8245-e776eeaea2ba", "comment": "Malware payload", "value": "fb76ac9b7d9bc6ebb6628a54bf9bd559243a2a66", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592003, "uuid": "ab84f761-e518-4b9d-bd58-3bcd8397e743", "comment": "Malware payload", "value": "adad6c28cc53abfed765e0dc665b8e722bfa44155358923c19344aa01099e3891a4861b3af6c773b3b4c941208e62b35", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592003, "uuid": "beb408a6-c825-445e-a3d0-084ce66a2fb8", "value": "T1E7A4235937D48A1AD69389B437BB952964D1FE0A4203ECE3F5CD726AC234F533297207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592003, "uuid": "5823b857-2a8b-432c-8c30-99cc3f9dd9a6", "value": "12288:eVtx+19HezpCE5EkGyxPEQ5OlEdf3k8ax3MuMlUfSZe:gtx+14CEMyxZ5O6df086ZYUfSZe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633592003, "uuid": "574871d6-3cce-4e24-bd68-885ec37c33a6", "value": 492008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633592003, "uuid": "be47917e-73ba-4ae8-9afe-134a354f4023", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592003, "uuid": "c1c83a26-8527-4d55-b836-7b93dc4f1ad0", "value": "VpskOperation_406095778.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a5108c-2754-11ec-843c-42010a9c0014", "comment": "Malware payload (IcedID)", "timestamp": 1633600320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600320, "uuid": "f63a0be9-1fbc-4053-b75c-6a3750ad5a36", "comment": "Malware payload (IcedID)", "value": "a58edc5efc060ae051d22ad9235a6c3a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600320, "uuid": "6f73005b-d2a7-4dbd-8320-62f0ce422325", "comment": "Malware payload (IcedID)", "value": "1607c0428dccd746d88d39759d285eadbf508d228b6934da9bac171315193009", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600320, "uuid": "ce2cf54b-e52d-4ba3-9211-f7692d72a3f6", "comment": "Malware payload (IcedID)", "value": "c0443d53bf43871c9f5aac9b7f23af96574f8f05", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600320, "uuid": "1693d0fe-c822-4eb0-bffc-db30273ebf98", "comment": "Malware payload (IcedID)", "value": "4b5868ec88ac8f87e2fd2f4336704654a1bac8b57517599aab63d5d320a86bdb9a08ae870c0a95a9245e57e817e66b33", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600320, "uuid": "9c9657fb-2d9f-458c-8107-73fccfc6534a", "value": "T13F342A864945B34BFA628C79DCC4B2E3DA472B396E3EDAF36DF4E03128284A4D457153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600320, "uuid": "ebf13391-c7f8-4c4c-b472-d9fea052e842", "value": "e6019496b12f5e1405335a7e52aa06ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600320, "uuid": "f8f537e7-8a49-4769-b391-7eb6cfb29dc2", "value": "3072:P5A0WiyUOmloGyKX8HO9is2SSExDz1r11VqkYd9pFF7nvt94hnAvvk:8GoG99AL+HHCL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633600320, "uuid": "ea4cc084-1078-43fe-b4ef-2b1904fca528", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633600320, "uuid": "edb6e3d1-4cf9-4dd6-95a0-648ea1a0d6d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600320, "uuid": "1338c24d-7c1e-4e94-a412-39c602807167", "value": "1607C0428DCCD746D88D39759D285EADBF508D228B693.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "260134e8-273a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633589124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589124, "uuid": "9d4fe278-de3a-403b-9399-6ca962c74cd7", "comment": "Malware payload (SnakeKeylogger)", "value": "1d32444cfbbc689dceaba55e4e55ec63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589124, "uuid": "b087884b-6c8d-41aa-8a21-e48d83b24c9b", "comment": "Malware payload (SnakeKeylogger)", "value": "161a71907a3c56372ee4f3a455ea1cd759d56be7ffa893eab1d057c0ddb2cc1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589124, "uuid": "4baa4e1f-9229-454d-8e56-dcdd7d8131f5", "comment": "Malware payload (SnakeKeylogger)", "value": "fd35cb6a904aa0195c4bf9eee6876271293ff9f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589124, "uuid": "bf5f37b6-d095-4f48-9b9e-31c151ec2c39", "comment": "Malware payload (SnakeKeylogger)", "value": "4d3a20dfd7775ed5a02ccc4ea5983e7c55a0cf41d6bad262cf9d5f3c06e869c436a5c95df525c119b28407fc0fdf51a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589124, "uuid": "c0e2d476-8937-4a8f-be5a-99d5a80d8cae", "value": "T132B401C2A19057B6C4A38FB1343D6EB73A573C1351D8298B77E0BE7569B3892803B953", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589124, "uuid": "73f18f42-02cc-4271-ad85-8bf697c437a9", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589124, "uuid": "e7d4fd0c-8ff4-481b-b906-8acc59f3e067", "value": "6144:z8LxBPlXbJZEKMor21Kjp/UBmN7lV58ifs8K+XVWcTDcuBrzU00Ohh35mILtSgod:2wKMorK0drz8iT1TDcu9jHvJtMI81b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633589124, "uuid": "5009084d-e7b0-4414-8dd7-c0315cc904d4", "value": 497177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633589124, "uuid": "57c1c6d9-2ecb-45f9-ad5c-96b934574763", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589124, "uuid": "a7cd9795-bd02-46b3-b660-20c1a1519008", "value": "23456780987654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c1cc00-274c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633597143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597143, "uuid": "b4bd3bdc-43f3-44eb-b348-17606d36529b", "comment": "Malware payload", "value": "50dbda56cbee5a049315bbcbae5a331d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597143, "uuid": "e2d0b5c6-ed2d-441e-a169-2cdd2c77d6ae", "comment": "Malware payload", "value": "16908223087766cbfd94e79078a0fb7cf16cfbaf56ef046b1b147e0a4d075461", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597143, "uuid": "27cd0c94-9bf3-47a8-86a9-b38083785565", "comment": "Malware payload", "value": "8e038f9820ffdc6b2c278330153176de1cb10d74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597143, "uuid": "15b0bc5d-3c2a-4113-a8e4-c8c044e00144", "comment": "Malware payload", "value": "ae6ac4299beffff9a6358f9c2419710dc962979146916a13d148b3962ced3dd256b425f6521070d76750db04bf17c2dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597143, "uuid": "89831983-2402-4849-a645-51c09858cc72", "value": "T19363323D1AB82B2BC0AAC325CBF2881770A445AF3125FD95ACC587664747F57768323E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597143, "uuid": "cdae8618-d5b1-4b97-b312-9716e2f1e3d8", "value": "768:OJPjt2Cb7UlsPMfx4isF5on2J8D6bTN8m5DNoio5iL:E2e7fP66lmn2J8D6bTN8m5DNoio5iL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597143, "uuid": "9ba1fd08-b4f2-4b65-b0a1-3f395a53741f", "value": 69172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597143, "uuid": "a2910a6f-f862-42e6-b7fd-59d030c70f52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597143, "uuid": "ad10a6f1-007b-4d25-8393-9cc15c2aefdf", "value": "50dbda56cbee5a049315bbcbae5a331d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4799b8f-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633597550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597550, "uuid": "e74d72df-c0c0-4f27-be83-e677090d25ce", "comment": "Malware payload (DanaBot)", "value": "93848e9e0db07adb45c4c34aa8812863", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597550, "uuid": "d09552ec-2695-4031-98c4-a161a5f0b6ff", "comment": "Malware payload (DanaBot)", "value": "16c3ce2453189f69668a590fc5f37a192abeb70d04d6aac5d6e7fbc793bf9f1b", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597550, "uuid": "d236cbd9-89bc-4684-be37-534e50c915bc", "comment": "Malware payload (DanaBot)", "value": "fc660af3ecb3b8654a2dfc4a42963597d3eebd39", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597550, "uuid": "ef259c4e-fc8f-4d31-b0a1-682654030416", "comment": "Malware payload (DanaBot)", "value": "785df760012c63a6b7bbd0808a5e4d84761bd1940dff9fb6dd8d6771a8a648a773bc47deed08dd1294a6a2e83a1511a5", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597550, "uuid": "cc1f7ed1-d87f-42b2-b31f-052a2515b510", "value": "T12135223132A4C075E7A36A345D71CBF11A2B78305BB180CF97A94A7ECF652D0DE9835A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597550, "uuid": "3414660b-674c-4aa3-a8ae-addcd16e05e6", "value": "51f224c09b57224d474ba4b21025bdd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597550, "uuid": "9ca6d559-36d1-44ac-ada1-fa635ee6cea7", "value": "24576:e7FMR9dW0W9kl4Eymvqr79OWAYmjEHJ/paf8fw665NuKXfpKKl:e7O9ymvqP9GjEHJYfXNL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597550, "uuid": "c2d1bc99-b703-4153-a8a7-f50492c36a4e", "value": 1145344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597550, "uuid": "424bc2e7-9dd9-4199-91fa-6582e8cc809f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597550, "uuid": "47ec8179-5d13-44e5-a458-4e9e5ec80ab4", "value": "93848e9e0db07adb45c4c34aa8812863.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc6a5a0-277e-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633618393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618393, "uuid": "fc58abfa-e483-4b12-8e1e-95b3afeda43b", "comment": "Malware payload (RemcosRAT)", "value": "a3e458f7e2e1f940b0c62042afe607d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618393, "uuid": "55f56734-b23d-4f32-8188-fbe543533b1d", "comment": "Malware payload (RemcosRAT)", "value": "1730338ca0fbfe0985bed5638fc8599a6dd38761ab8b89e3d8a076947a320028", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618393, "uuid": "43b631b0-3c78-4d24-87d7-fbb42e7ec3db", "comment": "Malware payload (RemcosRAT)", "value": "6fb0a031365530ebb273f47f034181a530e31b70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618393, "uuid": "15f4ec10-bbe0-4729-babf-495fd85c2178", "comment": "Malware payload (RemcosRAT)", "value": "28a97345f1e7558fc899cf9e47b405cecaac620453950351671e21877771acffe0d21d15d199afb131f5b6e37aa3dfa3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618393, "uuid": "0961cce2-befa-48d5-8554-9b883beaf74f", "value": "T1A0438C60EA846A98DADECB32E46BC38447F05D451C26C49C0FE53AAF5E733D4691A13B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618393, "uuid": "c57b814f-9489-40d1-a78d-17d1d4f83ce0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618393, "uuid": "8fdcb859-cfb0-4bba-a195-ab1acea41260", "value": "1536:IpDibfoA3wDu3Y6Uk9jg+rr6GbOsKpeQiQKWZ:IpDib+Dud7r6GiX8QiQ/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633618393, "uuid": "d1347f62-fbcc-4586-afb3-06703054d6fa", "value": 56832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633618393, "uuid": "4627969e-f96e-4dcb-a702-9792a05b1e91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618393, "uuid": "08551793-273a-47dd-a7f2-f6c2447094d8", "value": "ShippingDocs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c207497c-27a7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633636200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636200, "uuid": "74689ab7-ac8f-4ddc-b709-51523249f014", "comment": "Malware payload", "value": "8d1454096bc0e82042437d911d695a2c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636200, "uuid": "0c905adc-a43a-42a8-81e0-dee951a713c2", "comment": "Malware payload", "value": "175d13ee2b706361ae450c1705e92433216bdf52a40ea35312f4b2c393098954", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636200, "uuid": "1e334e4f-b490-42d0-980b-e8c6d470d738", "comment": "Malware payload", "value": "7a960d3cab7dfb5f2ec06531214e4817211c23e8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636200, "uuid": "fe5cf0e3-6e7f-449f-9a76-fab94495682f", "comment": "Malware payload", "value": "a29a78d7f824c3ca27ae41b667b2de0c03492447380059565b2916f61c26f375b54f5dd4f734236a4e129f2f2191020f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636200, "uuid": "ba82021a-c581-45f3-bb8a-03838bc5a334", "value": "T100A412A6F6C0DF92D78706BCA4B2A6C932204C798701FBF3E665B52F3A745D07462394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636200, "uuid": "51516406-d026-4f53-b3b8-98fdade3586f", "value": "6144:+7fZyHKQYIpyFR8hs4dAX5rnOAUbWtlwYC44u8XOqL5t6mEfzI/BzzRClBg+pr15:AuuIpkKhaQWMYD8eqtMmD/IYWH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633636200, "uuid": "51fa07d2-d1ce-485b-a403-b20fde95b0cf", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633636200, "uuid": "d0f8253d-9ec6-486d-908b-ef5b1f2a5009", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636200, "uuid": "53eea114-2d64-423a-a419-c0041b7fd4c8", "value": "8d1454096bc0e82042437d911d695a2c.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0543156-2783-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633620709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620709, "uuid": "22f0e668-abd4-46be-a7ec-a9b0a0fc359e", "comment": "Malware payload (NanoCore)", "value": "0b46928579a8cd569151f31f50224b54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620709, "uuid": "5f3d1064-b5b9-4ec7-babd-a0a82e0bcc2b", "comment": "Malware payload (NanoCore)", "value": "1776a9bcaded852aa7bd8262b7416ef77537c17b8c03e874fd858d08759e2cc6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620709, "uuid": "cab5753b-9e69-4daf-b05f-23b5f93fbb5a", "comment": "Malware payload (NanoCore)", "value": "61f7425cff81b4f74268cd97925724071e2136b1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620709, "uuid": "dbe6f79b-29c9-497b-bcf5-49aa20e61a90", "comment": "Malware payload (NanoCore)", "value": "78e370c9246d4ab720e68ba52fb72d72b183cbe2a0338ad01a9cbfee847683dd79a1b696294f5df4aa7af6fbcd680359", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620709, "uuid": "c4a467d6-5572-4508-9e74-384309f996f3", "value": "T12335F6002695C601D1B637F4D860CAF097656D55DA29C28B2DF1BEEF79B1B03CE01AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620709, "uuid": "a7ee1cc9-4d56-4a5a-9400-773089997ad3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620709, "uuid": "b72f3fc9-8297-4363-9e01-f1fde5c8e64d", "value": "12288:WAj0EycWUDyL9pD3n+0SQubA/OTdUFfxMfX/PVi1740sqG94:HnycWU+L7D3+1ZbA/dAXnVia0I9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633620709, "uuid": "4697c830-f2ca-458a-97b9-f1f87578a6cc", "value": 1065472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633620709, "uuid": "47f7afb9-36cc-4c11-ab33-8caab341bd4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620709, "uuid": "a665a885-7812-4a35-a039-f08d31c24528", "value": "O0284726662894977263PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488041f0-278a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633623541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623541, "uuid": "9dbdaeda-0c50-4d2e-b384-4e80a0bcf784", "comment": "Malware payload (Mirai)", "value": "f13199ec659f7ac7d68d7ceaf6794afd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623541, "uuid": "b821fd38-0e6f-434f-bfd8-b73208be43b0", "comment": "Malware payload (Mirai)", "value": "17aaa360195d26e0f77e2c746f4be24ee26b23a83f312888ba2b8a194a84b348", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623541, "uuid": "414fd071-f9aa-43ef-8f4b-6b9eb3ecaf08", "comment": "Malware payload (Mirai)", "value": "f9717f08644b17a571eb29fa44533086be47ebf4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623541, "uuid": "d8c3605b-4172-4bc6-8762-43c0f0711a99", "comment": "Malware payload (Mirai)", "value": "c46a54a95780cfba94632cffd5533899b046badb996f8669e4f8af6c75bd1bfff55f4a4bddc5c01efbb02247b1e4dc01", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623541, "uuid": "e6c0c998-a9c5-428e-bdb1-18035a524127", "value": "T123B3B60E2E358F7CFBAD823587F78A219748339627E1C585D15CFA021EB064E741BB69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623541, "uuid": "9e9c3144-c973-4ec6-a42c-a05707714d5c", "value": "1536:Ym2mymkLvMNR4jOA6i3NCmxRmQJ18Sc0N6LwOFGu2pax+5cFOd42+LaV3ssnsq:5LymeOAR3EJAnyqpax+5C6HuU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633623541, "uuid": "30bc6005-2a00-40ad-b121-bf3e5dead59c", "value": 114184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633623541, "uuid": "a3c9bff9-e8fc-4a10-8a79-1beeccc21da1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623541, "uuid": "f0646053-4440-4e78-afb7-589ae9f0e2c3", "value": "mips-20211007-1618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17eb30f7-274e-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633597690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597690, "uuid": "204b2838-cc2d-4d0f-89f9-98116fa9076b", "comment": "Malware payload (RemcosRAT)", "value": "7dd1c147cfdeb366218af59dc3d146c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597690, "uuid": "9411b830-9a43-4cfb-8f2d-b7542f8c66d0", "comment": "Malware payload (RemcosRAT)", "value": "19cf9c7906d5c5c1cc1188d6b5aa386178378fc1fa013a72daf3fceb6e335160", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597690, "uuid": "28725115-cd56-4081-bde8-f390f245e51a", "comment": "Malware payload (RemcosRAT)", "value": "497efb389177fb013a1ebd981a467002eb151c76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597690, "uuid": "fd1b6b93-5ac9-48d7-9ce6-690dcf64ce36", "comment": "Malware payload (RemcosRAT)", "value": "f89fac140ba88a0aba4e93534ee086864146d7362405e43b166f6bb3171788351b6da2a6c681e2e46c45353787fbe331", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597690, "uuid": "6bce1925-7b55-438e-8642-33ed8af8c969", "value": "T1D4254AD453CB99C4B57B2239B0122CFBB47D630DF29ECF1155A33A938CBA750562DA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597690, "uuid": "9aa2e1df-84c4-4968-9326-2188af32d3fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597690, "uuid": "09314e77-f642-4af5-a288-b4e411a1594b", "value": "24576:lLbhXZw6yA9XUz1i8NNZOy2XZw6yA9XU:Vbvw09X+15tOyUw09X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597690, "uuid": "933ab22b-bae0-4b59-b1a4-944786f4c088", "value": 998912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597690, "uuid": "065d9701-93e2-415f-9e39-cb46ab2c2a37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597690, "uuid": "e3944663-266b-4b53-bf50-4958c93296fe", "value": "7dd1c147cfdeb366218af59dc3d146c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "687914ff-274d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633597396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597396, "uuid": "e535c39c-286f-45ca-b161-796ea1cb1e24", "comment": "Malware payload", "value": "0c7c9ca3e6218cd314a3267b94cd4b68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597396, "uuid": "6318a677-d745-4a85-b094-ceeac72298de", "comment": "Malware payload", "value": "19f6d1d147adbcb69a055ccabfb54a36a2361b1bde17ec8a7de772e8d91fe983", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597396, "uuid": "e2e87974-847f-4161-aecc-bc114198564d", "comment": "Malware payload", "value": "7dab6aeacff02b4442426a946da595e8dd8611e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597396, "uuid": "b2d12e40-5d39-4b6c-8de2-7b3f1c393928", "comment": "Malware payload", "value": "bd03f6e511a2c20a7ca09f29d8a074d6c2c6ff07a15f7d072f504b917d1ca0e56258bc843104cf2b21ee66d3a76e8c28", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597396, "uuid": "47cc4b60-e664-417d-b2fe-4b9885b89837", "value": "T17A93EE3D16B8262BC0AAC365CBF28817709489EF3125BDA5ACC587664747F5376C323E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597396, "uuid": "12ecd50d-e37e-4ace-9479-7835e90870bc", "value": "1536:E2e7fP66lmn2J8D6bTN8m5DNoio5ijzFzxprRu:3eu6Yn2J8D6bTN8m5DNoio5ijzFzxpr4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597396, "uuid": "b68ec524-4af3-4d9e-bdb4-bd91f8a5b792", "value": 90892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597396, "uuid": "f07d2938-07e6-42bc-9cfc-860456621a00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597396, "uuid": "e54b3a83-3030-4ba4-8880-d7d5b3ee1c9c", "value": "0c7c9ca3e6218cd314a3267b94cd4b68.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01a7cf1b-2735-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633586915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586915, "uuid": "4b9f328f-d450-41ba-8bd8-15effac31ad0", "comment": "Malware payload (RemcosRAT)", "value": "09679d8bcb4b3c973defac75a715d2ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586915, "uuid": "825f8779-254d-4273-90c2-8fa330785e92", "comment": "Malware payload (RemcosRAT)", "value": "1a02ac67d12089aa0a7230ff45bd78d924a5cc95f16f878db6facccd1099a4df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586915, "uuid": "6a935989-42b3-47f7-bf5c-2090036848ca", "comment": "Malware payload (RemcosRAT)", "value": "c9bc60fd566db6d7a6a0ce176c8eb53ad932580e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586915, "uuid": "d48f14ee-1ebd-46e2-97a9-5b6361f051af", "comment": "Malware payload (RemcosRAT)", "value": "528dbf37cff7ab9df8d24c67df30b4dffc79ec06fc0d83763c86bd13c97213c1bdea1b3d2c6687ff8c04fe769176c921", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586915, "uuid": "ed4f6e6b-a233-4032-bb7d-d702fcf8eff1", "value": "T105540252B4C288E2EDA663705961FB20F277EE1C91754E9F03687C712B37183667289F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586915, "uuid": "33f39de7-4077-495f-8734-5b9885eba10e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586915, "uuid": "5d8b6a4c-5d4b-4fbc-901e-5cf0f672ca24", "value": "6144:F8LxBdMt21l75I1zctt784ur0lurKhbH5ciq0rCig6V/8MaDd:xClmCttPS0lWKhbHh5CaVURx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633586915, "uuid": "87865c30-e4fe-4579-a1ba-d6956d637852", "value": 298995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633586915, "uuid": "5e40e2c4-f307-4a45-baef-647f2d4679a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586915, "uuid": "cc804e29-7ada-4bfc-80a4-5d212b1003db", "value": "1012617429350,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12eafee6-274e-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633597681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597681, "uuid": "9321e519-02d7-411c-9a38-6aeedc7cf6f1", "comment": "Malware payload (TrickBot)", "value": "1b44d7f9a351214acd55379f24658089", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lib159", "colour": "#0C11DF", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597681, "uuid": "e6c1e7bb-5399-4272-8490-0f4871563464", "comment": "Malware payload (TrickBot)", "value": "1a5526a7c65478e83d438029e313afa8520cb8bd42bfadbe55ea018112a46f54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lib159", "colour": "#0C11DF", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597681, "uuid": "352707d6-13d7-4d5d-a3bd-4413630d6171", "comment": "Malware payload (TrickBot)", "value": "4cf4bcdc2860577c204056fd24dc55c025102c25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lib159", "colour": "#0C11DF", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597681, "uuid": "e80f18e1-be98-458d-b40a-71f236b8b2ad", "comment": "Malware payload (TrickBot)", "value": "03ced25272b4c304b4dfccf9a25855d8b5cd20df462df5bfb5444d7a163bc30f2c1120722f58d96c20d23fad93b1cc5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lib159", "colour": "#0C11DF", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597681, "uuid": "f01e81f0-6163-474f-92c4-3a77ec358823", "value": "T105F4AE0631D0E1BAD5E321B4CED1EB3956F9DD9287290BCB6B81F91E6E326C0453B712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597681, "uuid": "c6f0373f-f423-4569-805b-e71673ee1922", "value": "0f4296a776e183d43c9748b7869d4228", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597681, "uuid": "53b92b2d-563c-4643-8702-88a675838d93", "value": "12288:vJMtObg6CM2wUbyh/pSRNlW96QZk6BSb9XQox4e6oqu:vTbxCM2rc/+sL/Bo9XQ64f/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597681, "uuid": "0a83ef3e-47b3-4d89-8f32-6768648db21c", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597681, "uuid": "b86d48b3-a4b6-4de2-8423-2f533b6156c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597681, "uuid": "72f492a9-c257-4444-a641-328c8fe06f6d", "value": "1b44d7f9a351214acd55379f24658089.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e7bb7b-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633597358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597358, "uuid": "0468bc1d-a220-4fd6-a8b7-f988ca826861", "comment": "Malware payload (RedLineStealer)", "value": "9b1d51520fe82868b7ee96721fc8120c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597358, "uuid": "68d92b30-33df-414b-ace1-bab6457bed3a", "comment": "Malware payload (RedLineStealer)", "value": "1aaf1aad9484bc7d2fb24f4f9a7687b8d81af24a25ad12230bb3874985ba4f91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597358, "uuid": "86c96a5c-e801-4958-bacc-27d9a9cc711e", "comment": "Malware payload (RedLineStealer)", "value": "b609a4d2dd5297b65da6e22002924304dacbf2fb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597358, "uuid": "0fbaee51-c16b-48f8-9bec-406cea453190", "comment": "Malware payload (RedLineStealer)", "value": "71c9cfa130d499a18c8b608a762a900f9c71d76d27ce2185dc56932cce6be57c6057c343a83848ca4d8ad0ef85cf8b3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597358, "uuid": "e9b2f06b-fa5d-4d9e-b6da-4c0c2795fcc0", "value": "T1AB25110295445F3FF2BD63758859F6012326AD32C75023F6C6D9B5994FF00D32968EAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597358, "uuid": "f8252565-890c-4426-a285-5d46e672ab09", "value": "0ebb3c09b06b1666d307952e824c8697", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597358, "uuid": "4ec43ce1-65be-4c43-a5b3-2931f6b65272", "value": "24576:CpyC4C5eooptieYcMFoxJMwDZgNz7zkrdpzpnQj1:NClAtiemWZgaZ3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597358, "uuid": "a580835d-cde3-44ac-bea3-23b249022e55", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597358, "uuid": "4855cbed-2533-4194-8bf6-2870c1157230", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597358, "uuid": "68cabac9-05d2-4118-b511-fc6a5182d30c", "value": "9b1d51520fe82868b7ee96721fc8120c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4c214f-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633597613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597613, "uuid": "3f736dce-4b50-46f0-b8f4-c00fca5d19db", "comment": "Malware payload (RedLineStealer)", "value": "c0a3be8ab7f809c4e2678b6365e46290", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597613, "uuid": "ce6d8cc9-84eb-48ba-8460-f556d435be70", "comment": "Malware payload (RedLineStealer)", "value": "1abadd3fb21dbf1da2254539c73517d2af43ef9bdc3c67de66466fb961cb3fe6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597613, "uuid": "97467bfb-75ab-482d-97bb-ea5c98bc9f37", "comment": "Malware payload (RedLineStealer)", "value": "8697406d4721bece062b437230a4164024ac5078", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597613, "uuid": "b1f8591a-798e-4abc-8214-8ac76f40bbcc", "comment": "Malware payload (RedLineStealer)", "value": "f19586e6321a300d727d0866ec9efb36cd9c601d9010527487d848b5ebb2238144e2ddcbc97b0a17dd9a36f6c41764d2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597613, "uuid": "cdc8325a-0cb2-4ff4-8009-c43b4c408fbc", "value": "T11356236353B10088E1E48C3E8637BEE075F60BAB9F41B87955EE65D033166B6F352A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597613, "uuid": "52846291-98a6-4a8c-9119-c4a37c99e7a9", "value": "f054065b5627efa75960a094c4ceb3ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597613, "uuid": "14bf334c-7ea3-4e06-b016-206e336010ef", "value": "98304:DBd1StTicc6qSrcpPwlgrmHfdQ/NZ2a4yF/nhKzTyFTEwskg:td1Swcc6qSIWmrmHfXa4yxnEn9l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597613, "uuid": "767712f0-07bb-4eab-a787-886429021029", "value": 6157792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597613, "uuid": "e17e2414-eb47-4fe5-96e9-ad31160ee892", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597613, "uuid": "e730e525-1dc0-4161-8cfb-28fa76e25a63", "value": "c0a3be8ab7f809c4e2678b6365e46290.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "856789fc-2747-11ec-843c-42010a9c0014", "comment": "Malware payload (OskiStealer)", "timestamp": 1633594867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633594867, "uuid": "01249d36-c618-4c8e-b3be-f6afee6ec396", "comment": "Malware payload (OskiStealer)", "value": "92a49eaa18692b792a18f32c8cab5396", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633594867, "uuid": "7578eb84-b321-4f85-b30c-193be5792a05", "comment": "Malware payload (OskiStealer)", "value": "1ad022fe6f175e63e599e94fcc39c0e909e4f733f34e290dd3a6ce9692aa2f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633594867, "uuid": "b053f000-268f-4581-b365-f315f5c329ee", "comment": "Malware payload (OskiStealer)", "value": "130e3c698ccdb7767b28e59ebeb8626993ef849f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633594867, "uuid": "956dbd0c-af49-434b-b6bb-4cac58f850e1", "comment": "Malware payload (OskiStealer)", "value": "de47faa1f9d11495956cc928a5749e9708aff392219423c62482f8d0daa9cb9b4825797959a7ac7fb7f83e38de5033d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633594867, "uuid": "c30ea369-e2aa-45c7-b677-8a1784c44c77", "value": "T1B694019813778608CD3807F46828ABA12774E00A21AED3785BE4F4FD7FA77B449E4597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633594867, "uuid": "7b7e036b-e271-4a00-aa02-4956da4ab28d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633594867, "uuid": "037319bd-a44b-4245-a0d8-dd43d5d352c4", "value": "12288:ZlkoBn3ovMqzB1YeESiFeJtF6o9SmZsS:Zlk23ovMqbikjsmyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633594867, "uuid": "b564ba9e-9dfc-40de-a607-e83ff88eeeb1", "value": 443392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633594867, "uuid": "36394789-c9c8-4f76-b65d-f70ffcbcd92b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633594867, "uuid": "962cda22-d2d8-4a87-85ee-faa5a36f0b92", "value": "92a49eaa18692b792a18f32c8cab5396.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88673ee7-2726-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633580699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580699, "uuid": "806f69b2-4cba-4bc2-ab21-123f8f2abffb", "comment": "Malware payload (Gafgyt)", "value": "a30dc315fd0ca51519e4cecaf79960ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580699, "uuid": "b44877b5-c395-45ec-8b1b-c1864b8f5d6b", "comment": "Malware payload (Gafgyt)", "value": "1ae0393224a31ea0528056a654ec00d3d690286b78d01248dd87ea6dde633aaa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580699, "uuid": "489a0ac7-1a57-4a5b-9b66-bec9724dd6c3", "comment": "Malware payload (Gafgyt)", "value": "80e590e84a59ad6ac3026d8e5127f4cdf734295c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580699, "uuid": "1bb8cc2a-bd7e-4365-b73e-f94e971066ef", "comment": "Malware payload (Gafgyt)", "value": "f0eab782bf9fed8763607ebfdf1eca30082b4e9f02f418b2926eb180d933cd5f185cf46a4997541f55ee57108a62d4d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580699, "uuid": "8634fa52-19e6-4eb9-bcd3-fae0df480179", "value": "T10F930793B801EFB7F40ED77644D34B247630BBA24A532636721739A6AE322C43827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580699, "uuid": "81eae0a9-5283-46a1-95fc-a710bf558d00", "value": "1536:5cEN6Ts8ZsmkGgGuQm+SE4lyI9afAhWydYgsFkSTmQ9VqXjewf2Le:OU6Tvs2gbTc3fAhWydYtSmmQ9VqXywfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633580699, "uuid": "579a754b-cac5-4768-adab-ad9401d8814c", "value": 90723, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633580699, "uuid": "ed1f6f2f-d60f-407f-bfa1-09c89caa8cf5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580699, "uuid": "b41d4537-cee1-4fb4-87da-a9c3edb707c3", "value": "a30dc315fd0ca51519e4cecaf79960ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2ede25-2758-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633602235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602235, "uuid": "6061186d-2535-4874-975f-0ca455c1b820", "comment": "Malware payload", "value": "869151c9d8a7334bf76f918e500f22da", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602235, "uuid": "e6e7212a-a313-4d43-a782-2710734bf89d", "comment": "Malware payload", "value": "1b0499aba16c560d9d0dca9078f6a9e027d93d1c5051c03492c01698f38f19a4", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602235, "uuid": "c266ecda-0dec-4efd-b2fd-2701458f9cf6", "comment": "Malware payload", "value": "2e179fabea2b8707b0d64bece1e281cb3540c469", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602235, "uuid": "1bb79a10-1542-4186-8e7b-79793d65c2bf", "comment": "Malware payload", "value": "a8a74e3aca65ddcac47a6ee7f9d63aeab474c9c09a8d70995bb40f19fcde614a5ff126137d6f55164225174df0e15cde", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602235, "uuid": "21178a4d-9b43-41cb-8a68-7f111594c486", "value": "T158A1253F0E9E00A2ED73AF30D4E52202A82F79C4BCB996C944D98A0C5557193D6F5B6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602235, "uuid": "7e58b7b3-9ff0-4ae9-b3ba-2de93ad93643", "value": "48:8DPOg4bJPL1gwaF8Qv3sX85uM8IPXmKBv7LhdlxIPSM4klC5KfSmfnXPz7yG:8zh4VBtG8eftL7nIDpY5QXL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633602235, "uuid": "bec72af3-168f-470f-aa0c-3d806936771f", "value": 4994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633602235, "uuid": "0c5393bb-70ac-422a-a209-6cdaf8c37b72", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602235, "uuid": "f9890d3d-984d-441b-8b05-86ae7c1a12a4", "value": "1b0499aba16c560d9d0dca9078f6a9e027d93d1c5051c03492c01698f38f19a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac57b494-277c-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1633617696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633617696, "uuid": "e61d97cf-6511-4ba3-8db8-ed3a6f244285", "comment": "Malware payload (Vjw0rm)", "value": "c9a4080c136c2d305d37f042d503af84", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633617696, "uuid": "44603e06-bb17-463d-9ed0-5f5b198ac65e", "comment": "Malware payload (Vjw0rm)", "value": "1b65aec578ebf43b7d606921d841e8bd61cae6ee767dd2b1e122b8c92e6d8dcb", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633617696, "uuid": "d24adb0e-e6be-4d9b-b167-8f00ed9632f8", "comment": "Malware payload (Vjw0rm)", "value": "6eac72068c47ccb5297545ccf2c192002bc28979", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633617696, "uuid": "e8c09e57-46c5-4d98-8b0e-76e173b3216a", "comment": "Malware payload (Vjw0rm)", "value": "c6ba8692fd5d5976c2e4186c2aae9b4f3b9dd685f6a32572809ecc38d1ae375013b6d9014fe69dfd052285da4f988388", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633617696, "uuid": "1454edac-ceaa-4cea-afe3-97c4969d8e64", "value": "T19242C10C5C089AE0D007ABBBDA1D4503DD81AE5B1E95BA6690B6EEA81F3B35DC2B5470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633617696, "uuid": "e021c795-c90e-461d-a19f-c5270f6447f3", "value": "384:N152vsu0BkvZnHQ8922X0+JPd/3KAs6+Z6o8Q:H52T0utN9/0oPJ3ps6+sQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633617696, "uuid": "a736ddb7-cee4-4503-ba44-bb76bfeea5fb", "value": 12883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633617696, "uuid": "f16faf26-a753-4b03-a038-4192fbeba616", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633617696, "uuid": "5c7a3152-3ea9-474e-b5a0-b65805e88dea", "value": "G001Invoice.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c6de581-2765-11ec-843c-42010a9c0014", "comment": "Malware payload (XpertRAT)", "timestamp": 1633607683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607683, "uuid": "27a37634-e0fc-47db-97e2-e5fc9b79904b", "comment": "Malware payload (XpertRAT)", "value": "c977721c2b6e22a4bb29bc723e88dc14", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607683, "uuid": "f47095a1-8f7d-4985-8ecd-adc057b28d1c", "comment": "Malware payload (XpertRAT)", "value": "1c9bbe414128de9b946727e8ac7fe2edf9c28731fabbc564dee935a97721d358", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607683, "uuid": "6d4465f1-59d7-4e03-b897-53b2086d8063", "comment": "Malware payload (XpertRAT)", "value": "33e5d7488767291024cbf2581fbe360384c7d67a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607683, "uuid": "90c811f0-a8c0-4a70-9d16-8e9c1de8defe", "comment": "Malware payload (XpertRAT)", "value": "a4c1cbe2d0c3968dc03034b9a35cf47843d500dd25ce58ac8eac0e540f05ff209c01a7ab08ce839b3ea38c914453cd5e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607683, "uuid": "94534000-2828-43ff-9651-4b5647e20a95", "value": "T15FB4B541912E7D6FF62FE8181693E0C8386E957AE4F0056C93AEF014DE259EAED4C17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607683, "uuid": "4a9880b6-1b74-4404-a2e2-25ce91f5938a", "value": "3072:i9DDDDDDDHDDDDDDD55PpdzFtr5RDAw5wf3:qPpdzFt1RDAUwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633607683, "uuid": "891be37f-3034-42b3-ab52-91566456797b", "value": 512842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633607683, "uuid": "414fc3e6-8e9f-4910-b16e-838b5f75c410", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607683, "uuid": "b5f58a78-92bf-4545-812b-7c2ed9bf56c4", "value": "RF Oferta_07102021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a94fecd-2740-11ec-843c-42010a9c0014", "comment": "Malware payload (OskiStealer)", "timestamp": 1633591708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591708, "uuid": "1d5ec2c7-370e-447f-bd85-9475a36bbe99", "comment": "Malware payload (OskiStealer)", "value": "c8cd8336f0508813d452b5062a78c655", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591708, "uuid": "dd29aac5-f363-43bd-a7f9-1247f323027e", "comment": "Malware payload (OskiStealer)", "value": "1de4bad50f143311dbb23b9a0128887aeb0041f17d44cd831c10048957c1f47a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591708, "uuid": "5e3a0db4-1154-4a5f-971f-6ad0309719d7", "comment": "Malware payload (OskiStealer)", "value": "817d701a836ad14b1acdc2fd7ba9c6b26c9ffd0d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591708, "uuid": "03ff89a3-efd4-4ba6-839e-2fb7483e070b", "comment": "Malware payload (OskiStealer)", "value": "768f2c33189cc4853dde55c8a0cfe34678dbbb3c0cde61998c4aec4ee23863486f0a19fecf17820f8bd9b22996261d96", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591708, "uuid": "535302d7-c72e-4ae3-8afd-10b5d3964151", "value": "T1B2F2557DF18B0A988F4693B8170B2F41164CF51CF3D985B236B8DB3866D5D7A922293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591708, "uuid": "8a876ecb-4984-4c57-8608-5c4c858d8d49", "value": "768:EE3WigeR84wYeQDlVJxHDck7LcjJgjx/l:FmigeR84wYeQDlVJxHDck7LcjJgjx9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591708, "uuid": "56dd976b-f20e-4d24-a193-ec753e263f05", "value": 34930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591708, "uuid": "b534142f-8f44-4792-a84b-6dc5cf4f9d37", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591708, "uuid": "e567c11e-7065-4226-808d-ddd9520de12e", "value": "5400040115 Pratincole Pacific PRAT-RR-21-H070 DELMAR MARINE SERVICES PTE LTD.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4405047e-2743-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633593039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593039, "uuid": "76466a70-f0f7-4488-968f-29616f26347d", "comment": "Malware payload (Formbook)", "value": "edcb0cd82bc5fa4959a54a6258614c8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593039, "uuid": "8654e26f-aed0-4f7a-9a51-2ee6895e2d1b", "comment": "Malware payload (Formbook)", "value": "1e72b496568d5e3642cc7fd51eb254a9003bcfed6726b52a341125155fa92e6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593039, "uuid": "4262b6e8-a9d6-42a2-a48e-912175e12eaf", "comment": "Malware payload (Formbook)", "value": "32d57b03ce3224fe713d68f1d977e30db34dd797", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593039, "uuid": "ebef3157-3ab2-47e9-a61c-58f12738dddb", "comment": "Malware payload (Formbook)", "value": "cbc78d29237ac1d214dcb9b7265b79cffe663c72584d54220ad25e5ba4e3b91ba74e6668dbc407ea7cfa75c56f8bd38f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593039, "uuid": "a15685a6-11d9-4083-b4c7-f6a9e308e329", "value": "T1DEF46C36E25E467AC1933BB2AD0E91F754287D94A608F2C708EEDB8D79743D69B104C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593039, "uuid": "34156b0e-1cf8-43bf-818a-166c92d3bd87", "value": "084e48e92f4580f89c1870369272c803", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593039, "uuid": "884099d1-26ac-4bfb-a9ba-8743c68e3c30", "value": "12288:/JaPNAThXhtarJfdFnAdNFBZEz81O+tIin4uq8:mWVhtsJVFnAZ3o81Ohin4t8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593039, "uuid": "28106bd3-e78e-4fac-9c1f-8d6776cf4535", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593039, "uuid": "1ad0a11a-74eb-4547-980b-8902823fdbf7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593039, "uuid": "11b41a8f-ef20-45df-8d4c-da687eb6f3eb", "value": "Factura de proforma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a797f10-273a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633589131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589131, "uuid": "5e73acac-6791-4bf0-a722-cfde2583b346", "comment": "Malware payload (SnakeKeylogger)", "value": "ee796ee96de691124ab2edc23b372ec1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589131, "uuid": "4a3d35f8-da69-4c7c-afdf-115fdad1547f", "comment": "Malware payload (SnakeKeylogger)", "value": "1f64ea7bbfcb3f16d849667ae8994788caee241cd95ff9aa40ffcf797946fb79", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589131, "uuid": "3678ef63-4bc4-4ca4-9064-3581c71a7fc9", "comment": "Malware payload (SnakeKeylogger)", "value": "17c8f82f559599ef3c4e5b74f05032afb2187478", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589131, "uuid": "a1f0206b-e138-49f6-8904-68e0d4849552", "comment": "Malware payload (SnakeKeylogger)", "value": "31431698a7b05e781a5cb48ee20f2b383280096c71c70af4f94a35322b839388cf174f19a621b02088197e4d4db2b384", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589131, "uuid": "56f65e7b-9547-401b-8c2b-bb0869653e7a", "value": "T1B99423C2A5E14CE7E58912B52FF7862DF3F6D44DB4065EC357880BF22EA64C3A6A5013", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589131, "uuid": "8c755c2a-28bd-4543-8760-f33e4c6c8c86", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589131, "uuid": "c16fb12a-5339-4800-a74e-e6039b17214b", "value": "6144:b8LxBBXspsQVeeB+wQ/9EowCuu728E3grfKB0hUBnfueLVD84t1YprjqVGLELZus:yszgeoqDCj72tifK8unfueLpnWqIQXD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633589131, "uuid": "1758af98-6871-4c46-bf7b-18c1f3c682b4", "value": 429511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633589131, "uuid": "1a2c2060-835f-4e3d-9206-9fd607ff3637", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589131, "uuid": "4c448b37-adda-44c7-881f-88458070a054", "value": "26789098765423567890987654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b1310e-2790-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633626159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626159, "uuid": "22ad9856-3fd2-49f6-9e44-2490261b485a", "comment": "Malware payload (Gafgyt)", "value": "e584b699b8d69e9f2f115e40b352b28d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626159, "uuid": "777951e2-2026-433a-b86a-68b32b1b1fa1", "comment": "Malware payload (Gafgyt)", "value": "20120e687e9ead34980211a3450dcc0645deb72cfd8e13bfdde2b82aed3a3c01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626159, "uuid": "0cf0d0e3-0bde-4fc4-aad0-c98de1d1b41c", "comment": "Malware payload (Gafgyt)", "value": "582803931a9246a7c61634195cd71fb6cb9618e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626159, "uuid": "9eaaf8a8-05e5-4b1e-af72-b22794722343", "comment": "Malware payload (Gafgyt)", "value": "1592dc447a6d1cea777fd5cd5825ff0d3e495bb0f2099e88455132a5e90f1fc55362474b60cde9b51d9ce31def10aa61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626159, "uuid": "5ed944b7-7151-4b9e-b12c-41a755723c3e", "value": "T183831943B72D0B43C49B6AF12DF72BF08769F96117A76180A11EBFC44772AB02522F65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626159, "uuid": "cceaa806-e339-495c-bc70-922ec4a3336a", "value": "1536:BQOc40ozMPjej5qckA39ikRFaLnrWBfOEmQ9VqXjtWf2Xe:Bl+3y4ckA3BCrWZOEmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633626159, "uuid": "678ce3b0-7198-4224-a490-1732ff0f192a", "value": 84796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633626159, "uuid": "78b9d545-4510-473a-9a23-66091941858e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626159, "uuid": "2e7a0e80-27a0-4007-b6e0-20c42f76f0ac", "value": "e584b699b8d69e9f2f115e40b352b28d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dce92951-2785-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633621643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621643, "uuid": "70d04cc2-00a9-4f7e-91b9-b05467cb817a", "comment": "Malware payload (Mirai)", "value": "e93d94c925e85ee790066df984b0f69e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621643, "uuid": "b48a5edc-5c42-4ec0-9c28-25203eb2a82a", "comment": "Malware payload (Mirai)", "value": "2147bdefa3beb32e9777aa288fcae2fd4f325ce94262f6af6270d9ae6a27a859", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621643, "uuid": "ffe7ea8e-fa28-4506-9eb6-b9eb3e37b106", "comment": "Malware payload (Mirai)", "value": "a7784602a251ec10a3791c456436984e9fbb3d13", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621643, "uuid": "83cbea7c-2f24-4bbb-acaa-f04fef85c594", "comment": "Malware payload (Mirai)", "value": "48f6c91671b117c23ab6243f4fd7387f10e9c3234c9dc16a6ad5cc09e3303e959e108155d62a8a72d3587967117fd80c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621643, "uuid": "66ae580d-3e59-4558-b6be-46e288c0186e", "value": "T1FEE34C46FA418A53C4D627BAFAAF01493332A7A4D3DB73068D145FB43F86B6E0D63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621643, "uuid": "c051be02-c084-49db-8d60-eadf55608955", "value": "3072:ww0j/vnFQAUrDJwtgcloFngsexfFtH+xYXoy4cSXXSx0EM/9orEbaTS8:wwcFQAUXJagcloFnDsfFtH+qYy+XSxDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633621643, "uuid": "c37cca6c-aae6-4f87-a62c-6c83d7c5e41a", "value": 156648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633621643, "uuid": "0f70232c-acc2-42b2-ae9a-b188c15749c0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621643, "uuid": "ee6029f3-a3aa-4c7d-ba82-f76be1030a8a", "value": "arm7-20211007-1547", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b0b4ef2-2740-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633591897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591897, "uuid": "135306a7-0b75-41a2-886f-566fca7e57d6", "comment": "Malware payload (GuLoader)", "value": "57859619c87c24e406eced28190ff93c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591897, "uuid": "a189dac4-6192-4c38-a7b6-3604eb27e31a", "comment": "Malware payload (GuLoader)", "value": "21a825a9e3fde6f6dd8b36b8d6ed714df2dc631061b829cd1b7510bea60e8576", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591897, "uuid": "0178e1e8-b912-4e5e-be1a-6d604cb94307", "comment": "Malware payload (GuLoader)", "value": "e4646a4224b3e489f4ced37ae0636e6ff564c653", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591897, "uuid": "5cc9cc8f-9b73-4083-b078-90e457ee23e6", "comment": "Malware payload (GuLoader)", "value": "3468f2e6540c3cf30f2d0ba8d5903292439493514b0df78baf46b776bf826c2212c513dd7e5c4f590826c74240f0787e", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591897, "uuid": "7161be36-7a3b-4a21-95f7-ddd2adabd351", "value": "T1D5A3F1E737520079EB468F70C97AE510F2BC2DA4432AB16651E13A81CDB76E87D0359E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591897, "uuid": "1c3629d6-16c1-4c89-978a-379791a8e04c", "value": "1536:wIZ/C7EJnAiBBxPZ/TjJ7lP3J11YJQ4656D0aDVldgG92s4qfvfuPo1:wIeS3VVTF7l/ruJcQB9uYvt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591897, "uuid": "c54c35a3-4893-430d-ac44-cef5d882b496", "value": 100352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591897, "uuid": "fd7bca9d-8807-4571-b30b-19143d618ccb", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591897, "uuid": "4b9121a5-736e-427e-b9c7-a03a5765c694", "value": "DB_aaaabgddd8hdfys_Booking.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ac36684-2735-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633587065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633587065, "uuid": "d8cae2d7-2ea1-4566-b412-adfe04b483be", "comment": "Malware payload (RemcosRAT)", "value": "e92654f27c4cd3ad6a3a12f3a0be1469", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633587065, "uuid": "a6a0565b-8db7-4ac9-9526-e8e6f7cdecea", "comment": "Malware payload (RemcosRAT)", "value": "226d0ea20dccb9f0b091d02ccacaec73b537fc9b61157eff759b74d742d48b00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633587065, "uuid": "6ac1f74b-9869-48c7-902a-677453b7c762", "comment": "Malware payload (RemcosRAT)", "value": "af1a1a0fc3565f7dcbeceab6928655e52d917627", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633587065, "uuid": "513109b0-c97b-42e6-9d97-1e793f1920c5", "comment": "Malware payload (RemcosRAT)", "value": "d205a9bcc84033e70f1e750839bc15ffaea91d91c29ef923edb662b5e8ad559a29ef4bfe005ef4db92da667bb9897ac8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633587065, "uuid": "997e0a33-3c8f-4a90-8e83-c8eb20503871", "value": "T19F641203F2D1C9B7E1A01F3245F5B938E3BA435CE0595C838374ED6B2AA29E78358C46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633587065, "uuid": "e5f04beb-e067-4f18-a65c-2084c2cdfa67", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633587065, "uuid": "7058bf73-67fb-4e27-b907-3dd4b48eae27", "value": "6144:b8LxBqW4Ci9iLUGoOeMqci94cR7hbFbSPVx6tgsnzcbD2rFKquh3dyLN:nW4n8GOeMJLcRDSPH6tioFK9htyh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633587065, "uuid": "05ffba52-cbf3-4669-9704-17fd99f3a8f7", "value": 310140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633587065, "uuid": "2734fdb2-4ea6-4421-b0df-dba6e1efa62c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633587065, "uuid": "ab89af4c-af82-4295-b5bb-9860e31de268", "value": "Scan3094-03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65b7b664-27a5-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633635187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635187, "uuid": "5ec54f20-f33c-478e-9523-b49f7db432f3", "comment": "Malware payload (Formbook)", "value": "dce1f11e0536192d09a3de13e0cfd7cb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635187, "uuid": "b5424e62-b97b-4962-9c97-ff6e7ac6dcf2", "comment": "Malware payload (Formbook)", "value": "227271a1c7928e925f85a48d80853ab380962dac81155d6b9234c32ab2764762", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635187, "uuid": "2321ed67-d236-4457-b41f-b31bafc8a9b8", "comment": "Malware payload (Formbook)", "value": "0fca1bdb967984685ad7d499c1ecbe2a56cbebac", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635187, "uuid": "080fb241-940e-4a5a-801b-5f66e975bba7", "comment": "Malware payload (Formbook)", "value": "dec392194fdc17139d96242b8bcfdaa4c4284ddffe4c3505241ac93407eddff5a8efc6757966df2bbdc343f18a3b0834", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635187, "uuid": "dc5195a7-a7f2-4606-894e-1c765297297f", "value": "T102F2ED7DF1970A88CF8687B8071B6F45168CB51CF3D885B236ACDB3866C1D7A921293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635187, "uuid": "584ab3f4-4ad7-4fee-98e9-9f37e3f45cc4", "value": "768:Qk2CWuWdk3yckLtUgN7UodbpbySWxdx1A5Kofb8R4HZjzPKyIjF3tUWwVzun23:Qk2CTIk3yckLtUgN7UodbpbySWxdx1oP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633635187, "uuid": "1f045b90-6762-44ef-8025-2ce466035d81", "value": 34818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633635187, "uuid": "63c1b97c-88c8-4c61-99fa-8c4f69e53199", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635187, "uuid": "4c9dab99-195a-4afe-a87f-28a73217a1ef", "value": "MT103-384849392983.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5438316d-2725-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633580182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580182, "uuid": "3fc4616c-1151-469d-a6f3-b0e4dc515875", "comment": "Malware payload (Gafgyt)", "value": "b2aa16c6662c73d926664c64cf6133da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580182, "uuid": "858e1098-11b3-4b3b-a83b-01aef2376b13", "comment": "Malware payload (Gafgyt)", "value": "235bad1ad235f82e261dd5558f4a7cd923dd5931a2733de435411a89f131b70f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580182, "uuid": "71f6fefc-e11f-4dbe-ae56-a482a0507034", "comment": "Malware payload (Gafgyt)", "value": "367a4df86cb3d922b987e98a5fdf63e49a0b24aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580182, "uuid": "c6bc0a40-1c8e-4c42-ba48-269e637d2a88", "comment": "Malware payload (Gafgyt)", "value": "fc7e638bf2e9743019086c58dd516ad48de0d9f11589e39a719f8d162b8abe282940de9b06712c387b3eff71ab146941", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580182, "uuid": "182f5e4b-9021-4893-9415-67885f653715", "value": "T11B933B0748615F77C0456DB126EB59340B67BE224F4F1F9A792C9AF40B4B8CEB40EBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580182, "uuid": "5cf8e82b-9d4b-422d-8062-1127d9c9a8be", "value": "1536:nA4w0o7o4gTA3NnKn/PgN1hqpGo0ab5HCR5hsR+cDuRMnhR090jUeQfXm:zioadKnAxqpGEHI5hsRMMhR090QeQfXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633580182, "uuid": "4cc12ae8-9203-473a-99d4-f672d606a77f", "value": 95921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633580182, "uuid": "696b7087-c34c-49a5-9b1c-fdf3fff46138", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580182, "uuid": "f84507b1-c8e6-4a07-932c-327f8435f4aa", "value": "b2aa16c6662c73d926664c64cf6133da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc8fcade-2791-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633626742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626742, "uuid": "ebced5b3-192a-46f5-9279-685263d28790", "comment": "Malware payload (Formbook)", "value": "4c2ef8adb226b2cbd30b450ead567e2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626742, "uuid": "2f4f6f3f-5cb4-4ef0-a512-e96841b06363", "comment": "Malware payload (Formbook)", "value": "2361714a402b085426e5712ff07a8ada008ae9bf76e8ee248cc7ca651c7ac752", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626742, "uuid": "f060472e-6fe0-47ca-8c89-08c30f00b71b", "comment": "Malware payload (Formbook)", "value": "9ade24a0bf020a4d4e9fea5f4330d5e894e39e21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626742, "uuid": "bb2bf074-19ed-40b1-9c4e-4da38d2b0190", "comment": "Malware payload (Formbook)", "value": "44636af6ff3e294be5faceaf3c191548eeed4219c01de1ddb0720ef9b6213bd40495c808fd36a7cdc48ad95ed370f7b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626742, "uuid": "5ea33151-afb6-40cf-bb4d-fc956c2ce573", "value": "T1B794019813635B08CD7883F53865ABA14739D026901ED3784BD4F1BD3EA77B84EE42A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626742, "uuid": "56055a70-8415-4ac0-95eb-05ac7ce2ee09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626742, "uuid": "850b6168-eaf8-4b71-8cce-3d9cd5721e32", "value": "12288:Nkowoc8XuZFiAqKJhyCXpN4j/sGqkOpDN:NkBkVAqKqC5N4j/Sk0DN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633626742, "uuid": "0edbb4bc-14c8-4175-8a01-2f79c324c588", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633626742, "uuid": "d884d11c-8cf5-4605-a86b-1a5803326f0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626742, "uuid": "c6be7aac-a13f-4993-b178-455071f475d3", "value": "q0M51KeCwlm8dzc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5460181-274d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633597578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597578, "uuid": "7ce6d3f3-7381-45bc-b5f8-9da4faffbda8", "comment": "Malware payload", "value": "a54c615d9053400c3f160c75081f4d08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597578, "uuid": "ba568ec3-2689-48b1-bf56-c8b2480b39c1", "comment": "Malware payload", "value": "23f725498a107dd110eccfa4c8728fbeb6073b7c207a4509f19057082d82e6f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597578, "uuid": "a26d78c3-909f-4d0d-ac99-36641c195720", "comment": "Malware payload", "value": "aadb0bcf49055c199005eadf38f6383bda98978e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597578, "uuid": "0eb429fd-7f14-40c3-9860-735327a89dc3", "comment": "Malware payload", "value": "17e76ac46a128fdfafdb7a53ac13e8058c0259b58d29b27e3187f9784a08f24a3c7f1af7a1af0bb880e69cf6208751f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597578, "uuid": "9c5fcc4e-351c-478d-b715-95a39590db7f", "value": "T16D95335706858E21D42207BC18EBDB0423A2D650EA415CE732ED9ABFD49958E33F63ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597578, "uuid": "cca97a3f-5fd8-4f4c-98e2-85397eb85efb", "value": "49152:u2XWoS9CdCpP7I0flBKH6UfvcwBbp1az4Jis/itinqd:uHoCBP7LfjKHffvckaRsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597578, "uuid": "450417a5-4a7f-4257-9ca5-e5e8ae56a324", "value": 2045952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597578, "uuid": "1c70f92a-56be-4cbe-96fe-222fce02a2f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597578, "uuid": "68c0d4e7-7eea-4428-96e1-68c1ac416a73", "value": "a54c615d9053400c3f160c75081f4d08.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4afa8b53-276c-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633610660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633610660, "uuid": "1be876d0-6857-4e49-b25c-a6203a5d0ea0", "comment": "Malware payload (RemcosRAT)", "value": "9e77fbb6117c67df73060a9f34bbf85c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633610660, "uuid": "0de6273d-34b5-473e-8d75-2550b218b516", "comment": "Malware payload (RemcosRAT)", "value": "248a810cd338e14e7cc0753a34b254dff29361b35fa0355df4f9418b33d24b7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633610660, "uuid": "fb39d46a-bd0f-4662-ab2c-25e4dbfc7cc0", "comment": "Malware payload (RemcosRAT)", "value": "af2052ea4e45aecf9e876194b5f1c8aadb5a8585", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633610660, "uuid": "fbabaa4d-b7d0-4872-8ef4-ccfc35c7ce52", "comment": "Malware payload (RemcosRAT)", "value": "aff5fbbcd7b9e70ddd1847f9726a28d4c56a638323617e1c9929731116a965c1c98d4b8ed055f2245f53422cf2176b7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633610660, "uuid": "cf339203-0b5b-402f-b7c4-29a47722eaad", "value": "T15164E121137B8618EE75C7F4BD24E29117B5A427205DC7784FA8F0BD3E63B748AE0A52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633610660, "uuid": "80438546-0463-4486-9856-ce314936a12e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633610660, "uuid": "18447bd4-7401-453f-8502-03c2f7a08f54", "value": "6144:A4kts3IDQ+3HwO9t6LdIGdeXn/JSftBW03GPYMpRQl0r:3/Yko98IFRSlBW0wYMB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633610660, "uuid": "f789efc1-b758-4070-ac82-ccedc35ed09c", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633610660, "uuid": "5bb92593-7b96-427e-99ef-e0ca2c8e4f0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633610660, "uuid": "30132f1d-948b-4af4-9d61-96650deea3f6", "value": "9e77fbb6117c67df73060a9f34bbf85c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f261c4ad-27a2-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633634134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633634134, "uuid": "e20abefc-138d-4fdb-9fa7-74b62ea907fc", "comment": "Malware payload (RaccoonStealer)", "value": "02a5c5f5f691ca3487016b4d1a79840c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633634134, "uuid": "f0128480-5534-41f0-90e2-02d97c4a73e3", "comment": "Malware payload (RaccoonStealer)", "value": "25620d528306a61fca60319a4a166df951d335e016b19b245390a3c5cf514710", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633634134, "uuid": "732623f4-00e4-4223-9ecd-1ba5694f1c8c", "comment": "Malware payload (RaccoonStealer)", "value": "ba99ac38485a941136d7957368099ccd64014618", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633634134, "uuid": "f50a02a1-de18-43d8-8fcb-4b728133a608", "comment": "Malware payload (RaccoonStealer)", "value": "da6eb45bb586f1517a7a5b926322837d6aa4887d747536e8fe1d0ce50cd7451998f12bba0e20686683969474060168cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633634134, "uuid": "7bdf8d73-4803-42de-8edc-05cdc55302b4", "value": "T113C4E001A7A0C039F5F353F94A759268A53E7AA1673994CF23D426EA1B34AE1FC71307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633634134, "uuid": "c4937059-bb90-4eca-a889-e62f754d71a4", "value": "54bf62ec6910c4bfd61455c421ef149b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633634134, "uuid": "9d37d20f-469b-4009-993e-0974ae8d42a2", "value": "12288:46ajl3tm+REFODNo98OYojvQxeXGAUC7gvUEkCCdy:4Pjl9m+REqNzBhuGqEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633634134, "uuid": "6f106f2b-4271-4f59-b2e3-f29f23b0fcd9", "value": 565760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633634134, "uuid": "4cd783ea-e0df-44b7-b9c3-87f34e8a62e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633634134, "uuid": "47d1189a-3e25-42eb-b0ba-af2725053095", "value": "02a5c5f5f691ca3487016b4d1a79840c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0516b185-271c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633576183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576183, "uuid": "47c5abcd-0af6-4f7e-9495-a7229b1d45be", "comment": "Malware payload (Mirai)", "value": "7cb3f71772005426cddf61f3db67c5cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576183, "uuid": "00028541-2cd2-4bdb-99d6-33071716053d", "comment": "Malware payload (Mirai)", "value": "25c0b910cba520bb132104a9155ccb702138ea5c3d23c61347ad30894601f401", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576183, "uuid": "9c7bea2e-c4b4-4c8d-af3b-878cf49277cc", "comment": "Malware payload (Mirai)", "value": "a67f4b4ec2e0a6be554a6a4edfd8d80d40824b79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576183, "uuid": "0be755c5-55c1-4dde-aeb1-c06dca87f0a6", "comment": "Malware payload (Mirai)", "value": "f6ee50e3fe8dbd60415bdf312fba5f8c3795711e3d220b0ebb877334a9d1c66748f02f99e66a946ea5f049ed39766064", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576183, "uuid": "d010dfb1-a715-4b59-9e74-82cb97e5d82b", "value": "T1D6C35426AB619FB7D81ECE3305A94901108CAD5A12D92F6FF1B0E61CE36BD4F48D3D58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576183, "uuid": "82c97862-fe4c-4e12-a9e1-39b9052a680e", "value": "1536:UVeTCZ/ekn8gVT/7i/8ZGGX+yGCVKZlCb2ZyAzR2sA4hsqg:UN2XGX+JwKCrGRpTg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633576183, "uuid": "6e560c35-36df-4366-98ea-f2ec8670b5df", "value": 129688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633576183, "uuid": "84b7917f-7021-45b7-ba35-d188bb798da9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576183, "uuid": "577bc4bb-a7c4-484a-92aa-c64b2f33b851", "value": "7cb3f71772005426cddf61f3db67c5cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3c21e56-2746-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633594623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633594623, "uuid": "7024bd9e-07a0-4af1-bb94-d9c22a1a4f85", "comment": "Malware payload (AgentTesla)", "value": "2cf0ac9cf1356eae4e634a72b546a076", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633594623, "uuid": "a137e53a-88b2-4bf1-b6ce-380062811404", "comment": "Malware payload (AgentTesla)", "value": "25c8a17c03bd4072384bd1320d9e46014ad9e24a4d697a9401b9d5f988ea0f1a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633594623, "uuid": "717cbdf4-85a7-4b60-a830-9bdebf7306e7", "comment": "Malware payload (AgentTesla)", "value": "fe42934520c62c263120d58b85960433361dbf00", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633594623, "uuid": "02b6bcfe-6c33-4745-acac-c769b3ab3c28", "comment": "Malware payload (AgentTesla)", "value": "ad4f8db1a98330659487d30fafd0bfa6c35c677347ea1eaee15ad811125c5d1c438c4ac1c8f51986c2efcadd527d2516", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633594623, "uuid": "6c6fef26-692d-4826-813f-1812a96fee2d", "value": "T11C94015423778709CD7C87F5682867914734D126215EC3B89AAAF0FC7EA737C8AF8246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633594623, "uuid": "2b761528-421c-4267-b48e-99036b94f673", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633594623, "uuid": "ffa30a7b-3c22-4471-8680-5a9d4a05d501", "value": "6144:Np9qZFDQ+3HwO6wr/deV05Q81dlBlhdQbj65l80sdOCyXQ7oudqBookEEoSUQ:Wko6mIMZ1dPdQX6QyXMivLUF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633594623, "uuid": "8963afc9-b42c-40e9-a2b8-edc6b235b1cb", "value": 440832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633594623, "uuid": "25514763-72f7-4c52-a0dd-ba037c46cc11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633594623, "uuid": "aeb130ee-5d39-4317-bfe7-7d8483489a5e", "value": "RFQ_99705546,99805546_Mark Cansick.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c2508f6-2750-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633598529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598529, "uuid": "b2750763-37ab-4021-8896-54e60fbc66be", "comment": "Malware payload (TrickBot)", "value": "9e9f6820918e25457661ad5372bfc981", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598529, "uuid": "50a817e6-2829-49ed-8385-e16efb799c14", "comment": "Malware payload (TrickBot)", "value": "264d7d0ebc4021d88ade472d059651d2b5b622badf6b7bc98c95216767533e98", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598529, "uuid": "2e46e00d-edf6-4b1a-919c-b80b827ec25d", "comment": "Malware payload (TrickBot)", "value": "4d497f28729fdd9ecf77a988c21b8bf14fb00bf1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598529, "uuid": "1c38c5a3-7cf7-4564-87d2-6f63e134c565", "comment": "Malware payload (TrickBot)", "value": "7d04652bb4e2b6134b50f942071f3139ab25262e8db5865a8ce0314417c5d57c5d95ac4def16787c04f94d43fa610913", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598529, "uuid": "6be45c0c-cc1e-4bdd-a4be-8c31325dbb4e", "value": "T1A8B4DF02B3C08836D67B227A49ABD71933B9FC204F65C38726C47E5F6E326D55E26352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598529, "uuid": "1a30aefb-14a9-45df-b7a8-f8d523b41456", "value": "fd98f67a63ecc847a2028c66b8388afb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598529, "uuid": "61e5eff0-0927-4af3-83e1-650657aeb00f", "value": "6144:b3oOkxQXFDzaLtFD2aD3tAKit6lltqFpaI28VwPHK6+TDrAo0dThI9eq0NIaP:b3ExQ1DzM1b7qFp12iwPqvDr2VI9bZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598529, "uuid": "02eb3ba7-88b8-4ad1-b8dc-8a7076e68764", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598529, "uuid": "33b3fbaf-3c1d-41bc-8d2c-eba64edf94c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598529, "uuid": "6f5a5431-458f-4f26-b8b6-2c5557c3db7f", "value": "9e9f6820918e25457661ad5372bfc981.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070bed84-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633597232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597232, "uuid": "1e70b384-8355-4cca-8705-b3b534f32b55", "comment": "Malware payload (ArkeiStealer)", "value": "2d9c92381b01663c1187a865719c3f3a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597232, "uuid": "6d0143ce-bc06-4c70-8bad-135517109ab2", "comment": "Malware payload (ArkeiStealer)", "value": "270069811dc8c6472a1b4213abefc46f5d0ebdfa1791624d072f28e3a9a25c98", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597232, "uuid": "523b1d0c-bc2f-47f0-bbab-9a48220fbb29", "comment": "Malware payload (ArkeiStealer)", "value": "4fb1dd253389b87cd45a8eba7fd0f5917188dbb2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597232, "uuid": "311cb455-2e01-46ec-ae9a-54242adc4383", "comment": "Malware payload (ArkeiStealer)", "value": "1feabde56c486156de061dd0ff157cb5d5c45f21c7b6d56e22abccd6039875d987433dc8e0bf9bac60122ae12e1b5c3e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597232, "uuid": "cf05b055-884a-4dd7-92a6-8e6a81dd491c", "value": "T14AE40210BBE0D035F4B316F94A7692B8B92EBE715B2590CF12D125ED8A386E4EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597232, "uuid": "283df465-0523-40f1-86c0-2013754a6200", "value": "654aff1ee1bc89531bd3b96ebe76ae67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597232, "uuid": "b9e15a32-289f-4545-b2a0-e634e7998e3f", "value": "12288:jQjSQrI8rE75rPDSs4+50gPXUXyE975Hh8jQVQE1PS0MipOxjj9djCDu/:jQe8irbhz0yA7thyQVJVSKs9d6u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597232, "uuid": "155d588d-e76f-4263-a1a4-1e226ab1d268", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597232, "uuid": "986e9890-2566-4d18-8450-8d43173c8108", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597232, "uuid": "809e93e8-9eb2-47cf-aad7-8f9d446e20ef", "value": "2d9c92381b01663c1187a865719c3f3a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c367a7aa-2788-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633622888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622888, "uuid": "7d4634e5-266f-45b2-83eb-3a2b911457bd", "comment": "Malware payload (Quakbot)", "value": "4e31958084b4e3c2b9baf4654b43955d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622888, "uuid": "870b3539-cbaf-46ec-9821-c7e65303e66f", "comment": "Malware payload (Quakbot)", "value": "27ea142bdbb8854faad6fd9e8796a8c9dc85ee819c5d76d281177327184f1438", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622888, "uuid": "437cf499-5394-4d4e-bf65-ef7271ac76f4", "comment": "Malware payload (Quakbot)", "value": "0542b1ecedc18a8295edafb32471146c60f1447e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622888, "uuid": "5b1e9c5a-0f23-4a34-ae3f-896577ea8ef9", "comment": "Malware payload (Quakbot)", "value": "cc662ed9647fc3f58b8e809fbe338603b382cfa63d892a6c19b5fa2a6ff9e7b064431cc747e86f80b2104f872191f529", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622888, "uuid": "531a7ba0-e175-4aa9-bfae-0378f3a1e52c", "value": "T1DED39C463797C99BE58803398ED3C79B3B72FC21DE22470336467B0E5E7A6A18C16653", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622888, "uuid": "248eb2de-6857-4866-b164-ce314cb79b27", "value": "3072:kk3hOdsylKlgxopeiBNhZFGzE+cL2kdAxc6YehWfG0tUHKGDbpmsiiyNuUti+RLL:kk3hOdsylKlgxopeiBNhZF+E+W2kdAxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633622888, "uuid": "2c8aaf72-090b-474b-a073-bc11d7e13635", "value": 137216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633622888, "uuid": "6e53347f-3b83-469a-bc4d-ec39903f48f6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622888, "uuid": "40623b31-db46-4f48-9ae7-d8e70b22a4c0", "value": "AMLRPT_1422078719.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdcef061-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633597539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597539, "uuid": "3eee1d06-5fac-4dcb-81cf-a8ac3e501904", "comment": "Malware payload (AgentTesla)", "value": "2a737981b54760eaa09845a810955475", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597539, "uuid": "bcbea523-9e6c-4450-a163-1eb9f178f070", "comment": "Malware payload (AgentTesla)", "value": "27ef60135810c20378a8e748e48b40c344a5f8b1209be4566c69c32ddf280df5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597539, "uuid": "bb56ae4d-d628-4226-aa75-b19362d5ee41", "comment": "Malware payload (AgentTesla)", "value": "7890790fbce890111139f41a3beb680042ddfb73", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597539, "uuid": "722b0c25-0975-4bc2-891b-1748cc49bada", "comment": "Malware payload (AgentTesla)", "value": "2ef1178426cee2976e4f994591ad35c444784b3402ccedf800e92f119bfa9b5980400faf70b19156700cfe2bebfc34ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597539, "uuid": "e89d3293-0aa7-417c-9610-b87e562cb41f", "value": "T1E3356BD453CB99C4B53B2539B0122CFBB47D620DF2AECF1155A33A938CBA750562DE88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597539, "uuid": "08c938cd-23b5-4df6-b035-0df575a67780", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597539, "uuid": "383e4fe5-ac09-487c-bfa4-e0fc2c0b6a32", "value": "24576:0SbhXZw6yA9XU9fpWJTHHdSWdZ0xMjMtv2XZw6yA9XU:1bvw09XofpsH9OKjMtvUw09X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597539, "uuid": "b2feeaf5-8c16-42fa-a24f-d807d704cde4", "value": 1118208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597539, "uuid": "0cc12f35-e3cf-4384-8a70-d706e330265a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597539, "uuid": "818a0940-ec07-4b16-9000-a21b02139485", "value": "2a737981b54760eaa09845a810955475.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdb897a3-2731-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633585539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633585539, "uuid": "47de199c-fe6f-4309-8907-fe62e9babec3", "comment": "Malware payload (RaccoonStealer)", "value": "20fe04db84440825021dabb5857ba4fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633585539, "uuid": "1f7439bc-5a93-4664-b8c0-acda0e381204", "comment": "Malware payload (RaccoonStealer)", "value": "27fedb8ef3fb428492824755d575ca2f19c7c02e95a5c153edffaea3a7560787", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633585539, "uuid": "e09dd4ee-b44d-4339-b5d7-631568e640d9", "comment": "Malware payload (RaccoonStealer)", "value": "9f9adb583f1e71d2fbc88435d231900ef304e3e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633585539, "uuid": "ee268695-440e-45e6-be3e-6a89cd6123ab", "comment": "Malware payload (RaccoonStealer)", "value": "23d35fbcd38ac781089bd7a89a4a0cf9e3641c69351007a890883687570f04cee365218559d547bbc9877bb79f8f9cac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633585539, "uuid": "c6f71105-6c34-491f-a2bc-5e3de092200f", "value": "T17CB4E210A7E0C038F4F726B949B5C7B4A93ABDA15725D0CF52D52AEA5A387E4EC30353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633585539, "uuid": "3a860cb4-8771-47b9-aad1-672f6f8b3141", "value": "654aff1ee1bc89531bd3b96ebe76ae67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633585539, "uuid": "40e8917f-bbc7-4b6b-b03a-1195e9741dce", "value": "12288:uQw6MdwncuW4VCS1FJIhclil9kPp/s0zDRvM2:uQBnXe2il2x/sk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633585539, "uuid": "ea017c19-37ee-4328-ad2d-6ae9f4813d5f", "value": 496128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633585539, "uuid": "b6dc1089-28da-4538-9a41-f3784faa7e50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633585539, "uuid": "ef5e1635-88a7-41ef-a29b-ade41f4fc175", "value": "20fe04db84440825021dabb5857ba4fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2332511c-27a7-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633635934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635934, "uuid": "37a53e02-79b9-4fa3-8b12-680d6ce66c32", "comment": "Malware payload (RaccoonStealer)", "value": "965037d05dcc60513ddf7b407eda58dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635934, "uuid": "bad678d6-5879-4f9b-a9ae-a3c8852eb082", "comment": "Malware payload (RaccoonStealer)", "value": "28520ee298fdd4ba65380e1bd9330643db263aa0b4f5d740beb2cd57301bc94a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635934, "uuid": "fdd8e878-7002-490b-bfd1-f813c5c94e74", "comment": "Malware payload (RaccoonStealer)", "value": "08a68b602eea6f72439c3d4446732ba4f376abf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635934, "uuid": "279eeb13-775e-4f3b-bcf4-29ab0dc6e3ff", "comment": "Malware payload (RaccoonStealer)", "value": "d2a75555712a6c116367c344e320ba43c55eb995a78fdfa7a387e2af45e796294630f3cadf7e71230ca5d3e1fbd42749", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635934, "uuid": "add03ed5-d21d-4a32-8bab-4661943b3c1c", "value": "T1DDC423039283C693D3D586B24A73F035B2FAC4456423A20B67426F6F677831D7646FDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635934, "uuid": "55172624-d616-4391-99ec-ce0e175e7c12", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635934, "uuid": "0ab240f4-44e6-443a-8cb7-ee9da7ddf2f1", "value": "12288:/KlD3I0AS4fgpU0C0dRnkQfs40R4G5i545xXqe8G4T7cR2L7W5pUiUNANsq:/Kl/AVCCam/D46i5wxnX4XcRzQGsq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633635934, "uuid": "0b14738e-4b54-4864-82ed-82e10c73abfd", "value": 569740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633635934, "uuid": "1ed1c734-56e5-43c0-a1e2-70fe0bd6c21c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635934, "uuid": "62e42236-e51b-4895-b73a-d83f184f058b", "value": "SKMC07102021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4f9f18-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633597560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597560, "uuid": "e7708a75-208e-4b5f-a837-211574292b6b", "comment": "Malware payload (ArkeiStealer)", "value": "da16beba0dcfb2d30bbcfb356faed2c1", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597560, "uuid": "4150900e-26ae-4f86-9166-d886c00e95a1", "comment": "Malware payload (ArkeiStealer)", "value": "286b0ce53257e9ce376ceb4a6352392326f4ab868199553fac6b1f90d6a3ed33", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597560, "uuid": "a8b93850-024d-4756-b729-211c941b900b", "comment": "Malware payload (ArkeiStealer)", "value": "6f87069b3c8c80286a52e3f8c7dc7a0c60e003ab", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597560, "uuid": "958b6684-6666-4f12-98d0-5b7312009c83", "comment": "Malware payload (ArkeiStealer)", "value": "a0883d38d331a7a2ec9451a3f27e2c514a8176bcbae0bca43c93630c1f48a36b699b13aaaeee073f5bfb0ca4404345ba", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597560, "uuid": "d9b067ec-b068-44aa-b7ae-b7540166e3b2", "value": "T175E4013136D1C071E7BF17798E71C2B24A67B8B3593081BB17A056BE9F392C58D2934A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597560, "uuid": "05b0dd2b-67a9-49b2-817d-229139e47cdb", "value": "51f224c09b57224d474ba4b21025bdd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597560, "uuid": "9fa80548-1a31-4c42-8fdb-a8fa575bfe97", "value": "12288:MHPmGTCkZ1ro3DDcBshyGcwE2b6VNLzthmctL2+T63pKqPOfaE2tOd8pn:MHqkID0sKCEtBc+8eaE2r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597560, "uuid": "2fb290c7-47b2-4bdf-84b3-247ce58a5b29", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597560, "uuid": "4ff90df4-aff4-453b-bcfe-cce1027be0e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597560, "uuid": "38adeb03-50ae-4461-a3cc-e701185b5894", "value": "da16beba0dcfb2d30bbcfb356faed2c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "264f842d-2740-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633591701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591701, "uuid": "23160398-e9c2-44b7-ba6b-03cc3b15af8a", "comment": "Malware payload", "value": "fd436b2007cfdbef69366c5c4ceef9ef", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591701, "uuid": "add749d4-4be6-437a-80c1-b5d3e1b290e4", "comment": "Malware payload", "value": "29a01a4410471e679e150944195bd592314beaa00b1e99de5f115ee7e9df44de", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591701, "uuid": "66384bf0-c163-4b2d-835c-9bef1da22416", "comment": "Malware payload", "value": "166ac95713d2df544c4770fbb816f905cd965f65", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591701, "uuid": "c1c30074-2bd9-40d3-8f8e-09bb84afc17a", "comment": "Malware payload", "value": "3080e90b889aad8b06903cb88fb992be434faa0182d391cc130d8a1249e96c062a147ad6a0b9966195049ed97aaac5d7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591701, "uuid": "c457a2d9-e815-4427-b5dd-eb24d085a126", "value": "T15235AFF875087DE6667F536BDA96ACDC13B616239A8BA4CC80647BC305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591701, "uuid": "91971273-5820-40ae-a226-e8a6b1c085f0", "value": "24576:L9XsJwT0r99vaHbXnqfPpdmEYzkzDRYSGexJmV3nqTtwBoM0m:n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591701, "uuid": "6336a206-0a37-401c-8024-06ffdeef0cf7", "value": 1110557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591701, "uuid": "1dedcd07-b89a-4476-97ca-a62aa70ba0a1", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591701, "uuid": "2ae893d5-3c4a-46e4-a13c-139958616f1d", "value": "NESMA RFQ EQUIPMENTS AND DOCUMENTS REQUIRED.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59584202-2785-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1633621422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621422, "uuid": "824fecaa-6851-45df-80f8-2a65c64dfac1", "comment": "Malware payload (Vjw0rm)", "value": "9fb6723be237a72c8e0cb6622db940b7", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621422, "uuid": "ea541167-329b-4690-b841-dd5a9ee4b637", "comment": "Malware payload (Vjw0rm)", "value": "2a1be7d69e5ac0c8e53caf808c1de217c90f2351af6310aa7134f5fa5284db96", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621422, "uuid": "23dd5d73-d5c4-4479-b92e-99ed74444c6e", "comment": "Malware payload (Vjw0rm)", "value": "497d9d5e827ef3e28e5786faf011cff5592d5545", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621422, "uuid": "65fa5b8e-ad7f-41d0-88ee-072fad811822", "comment": "Malware payload (Vjw0rm)", "value": "7a25dadea669583facd9dba4b91a4201f1981b42928226ad510b682f819c589a5c1ca37631d9e097ec495384742b5998", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621422, "uuid": "72d06031-ba55-49d8-bd29-3e1ff1ebf4f6", "value": "T161838F019E431CC6F5B5D6A2209800E4DE17A6F4CF6AE4DADE4249CE0EEF24767C7E61", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621422, "uuid": "c69bf042-bf9b-41be-be67-c41bfd701565", "value": "384:wPnPI1gYzbBg55m/dguLJd+7X/g/W/W/w//a/t3J/QSkm6wUgn:fBdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633621422, "uuid": "e98643be-42e5-4e84-8182-d31e192fbe20", "value": 83710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633621422, "uuid": "98a7f731-595b-464f-a6d2-3027f9cb89a2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621422, "uuid": "6cb5c3a9-88bf-4d29-8303-2275c687cd00", "value": "D61N28A9X6.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22907a9f-2772-11ec-843c-42010a9c0014", "comment": "Malware payload (MirrorBlast)", "timestamp": 1633613170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633613170, "uuid": "d4d3c123-6656-4a7c-a16e-4383a77d6b64", "comment": "Malware payload (MirrorBlast)", "value": "bb6169cac9a125cd63eedeb3893b920b", "object_relation": "md5", "Tag": [ { "name": "MirrorBlast", "colour": "#08A768", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633613170, "uuid": "81a3ee22-ff9c-4d3d-b978-e92052879acf", "comment": "Malware payload (MirrorBlast)", "value": "2acdd04554feb1ef8b0307d5fb2c1bf7fd6a8e1157f9d3753119e64b30c16c30", "object_relation": "sha256", "Tag": [ { "name": "MirrorBlast", "colour": "#08A768", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633613170, "uuid": "e9d64de1-1999-4690-bb03-332bb7b3527d", "comment": "Malware payload (MirrorBlast)", "value": "849cf017216ecc77a9ad2aa773ccbf976755c9dc", "object_relation": "sha1", "Tag": [ { "name": "MirrorBlast", "colour": "#08A768", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633613170, "uuid": "db2b5344-2b03-4382-9192-31d21909f8bc", "comment": "Malware payload (MirrorBlast)", "value": "dbd5116ba46a7fa5c0d66941be08662186506c2574b44d34d2bbad74d27a27950b94e72f2d706ec1090a9da4feae963b", "object_relation": "sha3-384", "Tag": [ { "name": "MirrorBlast", "colour": "#08A768", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633613170, "uuid": "0813f630-1cc3-4f16-9442-2fef0a0cfdb6", "value": "T1D46306A2F2A5DC46D95483320DDB87E26722FCC88E7E57473288BB0E2F3C6D45D02656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633613170, "uuid": "937edea8-fd1c-44ce-9666-ee37a960f20f", "value": "1536:zScKoSsxz1PDZL2Qiw+4868O8K/5Le+k3hbdlylKsgqopeJBWhZFGkE+cL2NdAPy:zScKoSsxzNDZL2Qiw+4868O8K/5Le+kC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633613170, "uuid": "044d9281-38ff-4a34-ac9c-e47484c124ce", "value": 70144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633613170, "uuid": "94a8049e-17ae-42c5-8eda-8e75a171c988", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633613170, "uuid": "5bd5a791-bff5-488a-9b5f-958072dd1935", "value": "Employee Update - Covid.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2a30c8a-2743-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633593252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593252, "uuid": "73b11152-6aa3-4388-8c5a-9181cb921bcf", "comment": "Malware payload (AsyncRAT)", "value": "e3f80aec10ae1e683eee37a746a63d99", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593252, "uuid": "affbf408-6149-44cd-bd35-51f3f3d9d62e", "comment": "Malware payload (AsyncRAT)", "value": "2b3eb5eef955fda1c9723955098abb64290044abd13656de2556e0591c0bbc99", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593252, "uuid": "9aea4667-f2e6-4a8a-82ec-089e07b27b5f", "comment": "Malware payload (AsyncRAT)", "value": "1cf888ee055ce4095382ab64e9dd3babb8a79215", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593252, "uuid": "bc875112-432f-4c81-9ece-f15eac78c6d3", "comment": "Malware payload (AsyncRAT)", "value": "762bd9630cd819ae7096d28c84df1871ce384cfb8ec19be7bbc589425ed7cfffe3374868807386fe3286db6025b9fe26", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593252, "uuid": "b7a88e00-edb9-4c1d-96e0-381c34de8a1e", "value": "T1F501EF83501EACFB4153F26659EAE880EC78118213B0C759B529D51ADA2C4F5E895DC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593252, "uuid": "69641fc1-4e22-44c6-9b9b-2a3f82dd65b3", "value": "24:g4T0DPe2EUMg24c5QTcyRykI/kM2XoeMgn:ga0r7EUMmcMcyRyRkMTeMW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593252, "uuid": "b362bf21-7b90-4ce6-b771-4f7f2996114a", "value": 835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593252, "uuid": "8f7f49c6-c1bf-4ba2-859a-138c994ec169", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593252, "uuid": "aacdcd16-7a75-4146-9c12-42878fa6bc87", "value": "DMTRRZMIQXJWJ_(10-6-2021).xlsx.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d22a9990-2783-11ec-843c-42010a9c0014", "comment": "Malware payload (a310Logger)", "timestamp": 1633620766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620766, "uuid": "e378651a-4bd8-465c-b0f3-7753a880300a", "comment": "Malware payload (a310Logger)", "value": "48974b4b2d9e9387f982f7c0e5caf82c", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620766, "uuid": "9b3368f4-6982-472d-a025-73b54f0394a2", "comment": "Malware payload (a310Logger)", "value": "2be3ed94c370d790f744031f9836daf27b4caf7799d3dfbf85f7da2ccb0f4463", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620766, "uuid": "305003bc-897f-4e5c-908a-0e21abb8bd5b", "comment": "Malware payload (a310Logger)", "value": "cd968493c76c2fc03d871a7a756d66611e98f69f", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620766, "uuid": "a49e95ed-8c8c-4a3f-8e57-851bbce1d85e", "comment": "Malware payload (a310Logger)", "value": "2463c5077becee9743cd5466716c1622f2bab6ae8a8a2f506fcef23c856a9734ea956a5c1bd3ab1f76ec477836645c94", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620766, "uuid": "9c605d74-9800-4b5b-9413-d74be7f36267", "value": "T1D4B23F15E298CA21D4B77A3A5C6A82B80524FE5BFD539B5B24CC3F1F7DF23000752925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620766, "uuid": "0be19dc6-de49-44fe-b9d5-b7bedf7eba87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620766, "uuid": "2db37578-7ede-43c4-914b-18e3a772c7ae", "value": "96:/QiTMQQ0h/sUXuCvBJ8n9TRZj4P3bXeSJQj9JgJf6/uC0pfcXUkTDLotUlAczNt:/TQo1gn5TsvKSqIw/ufVQIlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633620766, "uuid": "ac201dd7-e405-455f-9a7a-4a5a0a67bee5", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633620766, "uuid": "b86d3c21-3dc0-41c5-83d5-c1ed97f7bf5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620766, "uuid": "ac89d394-5bf0-42c4-b0a6-cb0329ef57c7", "value": "IMG_111486520001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f717a6f-2734-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633586509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586509, "uuid": "9b606097-d31a-4b1a-92d1-d38683953d79", "comment": "Malware payload (Loki)", "value": "167f0de58dc43a9cc78003115caedeb4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586509, "uuid": "eca82553-b536-4333-9a43-72bc75da18e1", "comment": "Malware payload (Loki)", "value": "2be5b47ed309bc7976f3b1d6c3f647acc478ff80f9828746bc004c2275124c41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586509, "uuid": "503f9456-cc45-4b77-bc88-49f382622867", "comment": "Malware payload (Loki)", "value": "54d0cd4a1cc6f47d5dc30f373289e232faf58ff7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586509, "uuid": "ae9a6c57-a574-4de0-a00a-ce0e6bed484c", "comment": "Malware payload (Loki)", "value": "967dd763a136ccc5e1d229a15d9de80d727be4521bb54f64223479ef47813fd27208c5491c8cf404534b4997fc34d5b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586509, "uuid": "fd19ef1f-dcb9-4f1d-83f9-c0ea39d88f61", "value": "T16474DF7E32A3CD04DE604376ECDED19017A9BC16316ACB396A9E72AC64127F54DC06CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586509, "uuid": "1c7ae3a9-5a84-40d2-a37d-7fff3bd54c40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586509, "uuid": "95303b76-318e-4647-b73f-f4c523febd00", "value": "6144:k4axKp6JrlzOmQ+3HwOHUjG1QbfhtltrorYmoNIdLBsUiS24/wswKg/:UUpczOfoH1ATtrOYdNudsUx/wswKg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633586509, "uuid": "368d1a44-a003-451a-b331-641f004783d4", "value": 345600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633586509, "uuid": "a837afb4-5e78-412e-9ba1-37b78c045e2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586509, "uuid": "5a438454-0ba5-4d04-a7e3-e6702b0b27ef", "value": "JINSUNG TRADING.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93754958-2740-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633591884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591884, "uuid": "0d0b7a7c-726b-4518-865e-58495b35e252", "comment": "Malware payload (Formbook)", "value": "7098e348ff955b6109ef878f4ebf15b1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591884, "uuid": "f5ae9b59-1c7a-47e5-9148-2403e98238b9", "comment": "Malware payload (Formbook)", "value": "2c4a23d5598d7ed40b574a4bf0b835c6185c57f15677fbf37ec9192affe26d2f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591884, "uuid": "0266ce43-2f66-4bf5-945c-dae25e868900", "comment": "Malware payload (Formbook)", "value": "d9a50c00391cdec6295cda82563360d2e819fbbf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591884, "uuid": "4b0e23d5-beb0-4291-b4b1-24570c0f534f", "comment": "Malware payload (Formbook)", "value": "5b1c9a54c02cac6808c72ba90a8352d52e95a2b84ba5244581941bcdce50efce8f33f3b84861d38e62478501fbbb12ed", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591884, "uuid": "48f456d8-9e8c-4c6c-b80d-bf3dce932bd7", "value": "T1C3A3E0902A6EC9ADDBF396B73B3C065203A3BC42B8136CDE945E736B1E344174B52275", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591884, "uuid": "1d0a732a-31d8-45df-b59b-8953d0dbc516", "value": "1536:31MMfYA4J4F4XpeZbVXduQBz3E/T5VQNh5HDz1h67a/NXl5Tfze:32ML4CmXpeZbVXDzE/T0h5HVYmf5f6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591884, "uuid": "47b4155b-c062-4db6-8ccd-c0a457c9b8c5", "value": 100864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591884, "uuid": "688ed733-5cce-49f9-b77f-922655ba871a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591884, "uuid": "e9cf20f4-cc02-4e0d-aeef-efc1b4637451", "value": "SHIPMENT DOCUMENTS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc38adaf-2783-11ec-843c-42010a9c0014", "comment": "Malware payload (a310Logger)", "timestamp": 1633620783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620783, "uuid": "32cdc69a-0ef4-41e2-b72a-f918ec2903c8", "comment": "Malware payload (a310Logger)", "value": "f01eee07bd966e63395bd3938b8885cc", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620783, "uuid": "9c20efb4-d23c-49a7-939a-d2a50688a001", "comment": "Malware payload (a310Logger)", "value": "2cd5cdfec4fc21b65480586353bcaa3f84aa6c336e7dbb6e5d787dddf98d4e34", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620783, "uuid": "de46d0b1-bbcf-4068-8526-bbb0728a261e", "comment": "Malware payload (a310Logger)", "value": "2f81564e56bb7c95d0b9ee5b76c096bd2cb1dabb", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620783, "uuid": "645a4fa5-a0c6-4b13-88de-6f42c42cdf45", "comment": "Malware payload (a310Logger)", "value": "6d0cd91442e5dade1bb6b2b9ba82878854e3f6168a662edfb3647c64b7c916ab8992f5a07b703c4be0ce9f44949e356d", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620783, "uuid": "4bc5f0e6-31f2-408e-a541-b42d28085c6a", "value": "T114B20C11E284C921D4B77A3A5C5582B80526FE6BFC639B1B24CC7F0F7EF270543A2A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620783, "uuid": "429a8170-54c3-4cb5-b3b4-354157dc07ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620783, "uuid": "411864c3-69a2-478e-a3b1-1af145c79887", "value": "96:3X+Z8fWGD7iqDaGthNdB+14jT8C0KHIrqZvQNjl7MOw0S0pXgUkTDLotU5GYVzNt:3vvD7iQJth1X3VJI+ZIDM5UjQIAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633620783, "uuid": "2436a8de-f1f2-44d0-9d01-1df9fd06d542", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633620783, "uuid": "14f57720-d4e8-49fe-874c-a5978cf5c2e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620783, "uuid": "9b720b9b-9157-41d6-8833-a0d183d4a2d1", "value": "IMG_854127101037.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ad7e95-27a6-11ec-843c-42010a9c0014", "comment": "Malware payload (Pony)", "timestamp": 1633635747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635747, "uuid": "b105596b-0dc8-451d-b750-7f27402553d8", "comment": "Malware payload (Pony)", "value": "ad72f25aec117b60b5d23494f56435b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635747, "uuid": "b606cc8f-eb7a-4152-b757-e791f5473f98", "comment": "Malware payload (Pony)", "value": "2ce7ad2edfed9bf00a5df059bc2e83d4e5570765d1ce3b512926a32ba458b1b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635747, "uuid": "7021b740-2fdc-4ccd-a786-03231f63a5ff", "comment": "Malware payload (Pony)", "value": "698af8f489fde90f1c6a81b1779df3e2ebb36e6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635747, "uuid": "d634c163-7aa1-4a59-9c96-3814e26767f8", "comment": "Malware payload (Pony)", "value": "fff65b7cfc11d33851839e7e88ba319d6fea37d6c5cd49cba28b106916fc9989cab003d0ee07f04dffa3f44934c309f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635747, "uuid": "4ec35fe8-1477-4f28-8b61-d36c16cff482", "value": "T17A44F113E36DEE7BD65516B64D82866943A33F6826408F073286371FEC32F44AF16B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635747, "uuid": "d696b403-dcb9-4517-9071-9bcd87a1517c", "value": "802db10f3827e0a9055660761a6dae55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635747, "uuid": "9a6a987c-278e-4f2d-8fea-1c72cd2edbcc", "value": "3072:vUEBmY4qOCOp1zigKqWbyPpWI6/0/MrHmk0LrdFFCprMv6H7UyJ:8EQCaibN2pWIhcHn0cpruiIy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633635747, "uuid": "8441b165-fe9c-4d20-b91f-01ddc737ac0f", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633635747, "uuid": "b7584747-efaf-42cb-9c96-dd9e96a81856", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635747, "uuid": "a0e66f98-3cb0-445b-8ae8-edaab93193d5", "value": "2CE7AD2EDFED9BF00A5DF059BC2E83D4E5570765D1CE3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc346247-270a-11ec-843c-42010a9c0014", "comment": "Malware payload (Pony)", "timestamp": 1633568760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633568760, "uuid": "cd4ef0e6-d6fc-44bc-8000-ba87f540acf7", "comment": "Malware payload (Pony)", "value": "7dee8b70d41c2a16f4cff9f45eb6df8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633568760, "uuid": "8fc2c3a4-d1ae-44d3-bfd8-65dc8f93b4a7", "comment": "Malware payload (Pony)", "value": "2d22d5cde8099f54d3bc1835b5573e1aa995f6e219b0aa219c2071c6727a2b97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633568760, "uuid": "e3f4d08b-c66f-4cff-be87-f1dbf2c6fffe", "comment": "Malware payload (Pony)", "value": "a25c05f6c0c834854cb093118ecaadab0f212d9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633568760, "uuid": "d0e003ec-dd4f-439f-80f6-78b24ace8990", "comment": "Malware payload (Pony)", "value": "978878b98dc9db754746ba8891f88244300c1f454ac67b3bd160f10a8f0d537c0cfa3e9e2b9e7aad5feece391b433289", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633568760, "uuid": "bfa5223a-db2e-4868-9388-d7a3a70dd3ca", "value": "T1CD54F16EEF4DA5AEDA9250F03DDC82F131941C612EBAFD07998871DB383021766B4B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633568760, "uuid": "686e663c-0ef5-4ddd-a573-b22a3ad96011", "value": "a77f7f11da015b465f7cbead3e839019", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633568760, "uuid": "6b01148b-89ca-4336-9d89-f2f631d99d98", "value": "6144:Oz2DX2vT6j5iboaKycM6mnHeBB6LzgSRZvOcrQOAR:3j2KlaWy+BwLfrQO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633568760, "uuid": "2678595c-8864-4c21-90b0-8dcbe5dee4aa", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633568760, "uuid": "ce8f80d7-f946-4b32-8a8f-cc2e247c4d79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633568760, "uuid": "dae4bccb-0f86-44ba-b825-b03b17376abd", "value": "2D22D5CDE8099F54D3BC1835B5573E1AA995F6E219B0A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06ebd6ed-2767-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633608399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608399, "uuid": "747b59fc-ea86-47fb-b260-2238d2538192", "comment": "Malware payload (Mirai)", "value": "28f6b805575dd59692c319a39066595f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608399, "uuid": "3d9b2113-93e9-4d30-90af-c9f15e79b35b", "comment": "Malware payload (Mirai)", "value": "2d3f2df6e9b830da9278004628c9903fdf61eb06b3a804fcc493874498a64ff6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608399, "uuid": "6a650454-3bd2-4bd3-a5db-7b58b39e30ae", "comment": "Malware payload (Mirai)", "value": "692752bcb1ae213facc1efcb10ecd306c8c58c1d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608399, "uuid": "ee2a6ad2-b8b4-4de4-aeb6-f1e259db5f92", "comment": "Malware payload (Mirai)", "value": "d3ab1d3360dcdbdd560f3712914e65bab11a723d3aa669d09f7b92f6ab3533c47da2e561fb2d71e05ebe8e1040862273", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608399, "uuid": "a3355fe8-42b6-4ff0-a828-5ee9f2391ad4", "value": "T141C3B60E6E31AF7DFBAD823487B78B21A658339526E1C584D15CFA011EB034E741FBA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608399, "uuid": "4732fec8-4685-4b4e-895c-477ccf7b9cd5", "value": "3072:ywFpYf3ycMgqT6aHdBBsIGnLZ3YFjZ0DhFpullC/:yEyLMZT6AsIGnLZ3iCEllC/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633608399, "uuid": "ab206cbf-4172-4e93-8c79-93c80fd1075f", "value": 129168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633608399, "uuid": "235f4567-7ae3-4468-823a-cdb254dd101d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608399, "uuid": "8f75595c-222d-4b39-b5ad-88a239f27064", "value": "mips-20211007-1206", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22e283b2-2774-11ec-843c-42010a9c0014", "comment": "Malware payload (Lu0Bot)", "timestamp": 1633614029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614029, "uuid": "12327455-6241-4ced-84a0-812ef4702bca", "comment": "Malware payload (Lu0Bot)", "value": "090ca6d0cf757ef15a469652e75c05d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614029, "uuid": "51e514cf-8eb5-4f7f-bc93-187d02914f35", "comment": "Malware payload (Lu0Bot)", "value": "2d721df670fdb63c643b3de2dcdd46311b8d94d2753b47ad0035392644dee77a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614029, "uuid": "4a29ac55-f6bc-4486-9390-bc81e45fa7a2", "comment": "Malware payload (Lu0Bot)", "value": "5da276eab60258a394cbb4bc2c3ff3570e202f5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614029, "uuid": "e652c068-dcb7-4102-818e-106c27902015", "comment": "Malware payload (Lu0Bot)", "value": "70c61cf29741462d81c32bc5a3b5f208c19f5eb1ddc5198d67bd4e637f5f74ee557bc7a6631879ad4f728fe9f0033a22", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614029, "uuid": "024ac3f2-ab38-4f22-b90a-856d92c84946", "value": "T16D51DB3BA7B34FF2E229B377022BDB0536B5D430137750360B276179666ED6B4468B01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614029, "uuid": "ad62664a-f22e-4738-92e9-7029856eb6b0", "value": "2e5a1176fc39ed148165dbe2da2bad74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614029, "uuid": "dd03ecec-50c0-402d-9f3c-43a21dbdd37a", "value": "48:6jY/IjbcYCF+IBuVRdjMdxyC3tQ7lRvRvSlBS:b/1vuBAyCSf5vSlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633614029, "uuid": "3598a769-a327-4ee1-88d3-7d51186e77d9", "value": 2560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633614029, "uuid": "cf572f14-95b9-43ce-9294-a04768b0b721", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614029, "uuid": "8ae1ee37-c42e-43b7-98c0-5923741760c1", "value": "usfive_20211007-143832", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6503a9d0-278c-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633624448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624448, "uuid": "328cefe9-226f-4d69-897b-7964e6b16aa9", "comment": "Malware payload (Metamorfo)", "value": "c4014e5100cc2d2f126c135d5bc4b0c1", "object_relation": "md5", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624448, "uuid": "02ba2606-603b-4e8b-90c0-2a534a519cd7", "comment": "Malware payload (Metamorfo)", "value": "2d98f7646e2b5d8ed1ab74c42ba6a5fa1187752c24abff099f4d271cad85829f", "object_relation": "sha256", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624448, "uuid": "4bfe1cf1-af19-4194-834d-148150ccf8cc", "comment": "Malware payload (Metamorfo)", "value": "c6513e9e49cd1cd587d7a833937f5d56fbe4ced9", "object_relation": "sha1", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624448, "uuid": "c3f0dfe0-a742-44df-b152-d9f8a6e8f8a2", "comment": "Malware payload (Metamorfo)", "value": "de76edfe9efa2f8eb9a07d4826327b675e3cfc57735b0cb1b9ef1dccde1938ff891b0864fd73413ab184654046294f18", "object_relation": "sha3-384", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624448, "uuid": "aa2b1382-eae7-437b-8a9e-26fe24f73975", "value": "T1A1447E06B3D5437AE4DB07721B8B93628A72EC788673412B1249790E3EF1554B7B73E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624448, "uuid": "505cee85-4c92-4f5c-87dc-acb024746d58", "value": "3072:wmi4Ay903DaYlAnwgz88ereWn/7w05g00McB3RUN46ILJ9+ZB5yOanvY:wmu3DaYlAW8er1nzT1roY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633624448, "uuid": "9adab3da-3bb9-4dc2-9eb1-249b24f4501f", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633624448, "uuid": "d6a5428b-26c9-44ad-a23f-56f8db26cfad", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624448, "uuid": "e4f0335b-4b96-4e34-af16-c659eaf6e5d2", "value": "c4014e5100cc2d2f126c135d5bc4b0c1.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bdc8985-2777-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1633615306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633615306, "uuid": "e2ffcc7a-e9c3-4172-a0c0-623a9881487f", "comment": "Malware payload (Gozi)", "value": "92a0f1023e064a46fbf2e6bb697edf55", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633615306, "uuid": "b0ece14c-fd66-450e-bef6-3b8557b710c4", "comment": "Malware payload (Gozi)", "value": "2e012edb93bb99de397b629cdc44d7516f9e6f47cd7106c93d2d6fd66a37af87", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633615306, "uuid": "cc57baca-da07-44bc-bcfc-d0edb23c8b17", "comment": "Malware payload (Gozi)", "value": "d2d28a35de82e8161266355a351a1e5822d49303", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633615306, "uuid": "3a491b1e-6054-43a7-b8d3-a15422a5b008", "comment": "Malware payload (Gozi)", "value": "c158acd8911e61f928655bb09ac859ae4ee1f8c3837c6d652f309323fea347883977b40ae5e5c5f0bd3da26a621d558f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633615306, "uuid": "d17b99f8-e6ac-4ad5-ab01-778213045844", "value": "T1C273E572BBC03481C0B3CE763B68BDA54A6272B7D6A07156BCA56B44C4F3E5C21A1733", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633615306, "uuid": "39e17b25-d83c-4d02-a3c3-24f52fb65dca", "value": "ff4d958d1b207f788303c2824dcf7c89", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633615306, "uuid": "8c346715-bed4-47be-bc24-2c97547ed41f", "value": "1536:S6+YO9+zA3PG713sAOFU+okNIXnioQ+Zw:SQO9+zAe71JykkNIXnjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633615306, "uuid": "ccc7aa1f-8531-4a49-865c-bddc10e872c3", "value": 79704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633615306, "uuid": "91195f29-f13d-4bb7-94e9-c2a87ae122f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633615306, "uuid": "18377d28-9dc2-46a0-b64e-52735d200675", "value": "2e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cd9c6af-273a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633589162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589162, "uuid": "edbbc773-43e6-4286-9e4b-bb2c9785889e", "comment": "Malware payload", "value": "a8846a296e07be5b5d2e9f7b14dd6e78", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589162, "uuid": "70247f45-f8f7-4b4f-a172-09bfc3c7b014", "comment": "Malware payload", "value": "30a4539d1a49783943ad6917b42a30788ba09ddf9eb73c504134393c2ca63da5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589162, "uuid": "9e91d8c4-1e21-4cd3-8496-91b5819a3eb0", "comment": "Malware payload", "value": "0b8c2d3cb4ae9b4c203432302439f32bb70cd072", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589162, "uuid": "76defd4d-46fe-4b55-91c8-b6caa3ed9245", "comment": "Malware payload", "value": "2affd19cb2fa07f5f047807a43974fec1c48d31ff9364abea9c9d2804f513fe35a8fb08257c608d58918b3cbcc0f162e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589162, "uuid": "afc79fd8-a653-4ea5-9a9c-ded6f068550d", "value": "T1FD562311B6C6C63BC4AD06B06B2F875F51227D244B32C0FBA2EC1D1E5DB24C156B6FA6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589162, "uuid": "4b7cea90-882a-4d19-a750-4b536904219b", "value": "196608:rlo8mJqYNB1DlGTiVJboF6UlYmH+B45UxXbpNhlSmRQoE:rlfaqmDlcFIZ5bp1SmeoE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633589162, "uuid": "3a954e4c-923b-4341-a5d4-d49600b5542b", "value": 6313984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633589162, "uuid": "0f09245b-fc8c-4239-8ca3-99a3615460cf", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589162, "uuid": "6f1340bb-f801-4612-bb96-49684f6c5b96", "value": "Boleto-negociacao.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08f7486e-2754-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633600242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600242, "uuid": "7d041075-eb02-4e6e-960b-678b2d559970", "comment": "Malware payload (AgentTesla)", "value": "efa87b60051cd3dcac5d791bce173f67", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600242, "uuid": "b5b3ce47-2f61-4559-a08c-024e73f2c877", "comment": "Malware payload (AgentTesla)", "value": "311c4ba127168d811f31c87eb57305df2d67e615e60d81a3b22d945170c4bffb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600242, "uuid": "1dfd2c33-94e4-475c-b13a-24441d3b307d", "comment": "Malware payload (AgentTesla)", "value": "0f398893eefbe108397f118fd6723f5e00dfcc29", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600242, "uuid": "98a1d3ea-eb46-4504-baa7-1cb9cacbc9dd", "comment": "Malware payload (AgentTesla)", "value": "ceb07e44cb3acf10eba7ce76e977e28239aa7ba03d67a8342d9fdd4820eaca6cab698eddacea763eb6e8a7867d4e9064", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600242, "uuid": "8e1a6f7a-c3f8-4634-a3a8-affd0b9f357d", "value": "T159A402A8133B9608CD7C43F53524ABA16774A119255ED3781AE4F0BD3EB3BB94AE0097", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600242, "uuid": "c3570404-06c2-450b-921a-2ab2e8f2ade6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600242, "uuid": "ebac5c81-6a18-4d3a-bb61-140c790e0fa4", "value": "12288:wbkoD11P5mW/EYKnNfQ9jFKBd0lpIKXKjMdU:okQP5L8rntmFKL0l9NU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633600242, "uuid": "39252c4e-2eae-40b8-a750-47b282df79ad", "value": 449024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633600242, "uuid": "18cacd8f-8f3c-4e67-9750-dea1c73bf38e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600242, "uuid": "7cc92d3b-bd8f-44a0-a0d3-d8cee7d91d6d", "value": "#RFQ Kramp10062021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56f8999e-2735-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633587058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633587058, "uuid": "68575bf9-2bc8-47d7-a371-a160245cbbdd", "comment": "Malware payload (SnakeKeylogger)", "value": "b3e2a4d3f0d85ab4442b731bc65eac8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633587058, "uuid": "fc55413b-523c-425a-b947-3eb007b7e30b", "comment": "Malware payload (SnakeKeylogger)", "value": "311e6b79bf6aa94aea754fe0a53c0d3d544cafbffd35148b1a876db33202065f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633587058, "uuid": "e446dde0-4b56-4ada-83de-d618897edd82", "comment": "Malware payload (SnakeKeylogger)", "value": "abb3d0162ec0499f4b608344431ec0a301a05adf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633587058, "uuid": "1b2b6206-fb23-46e7-b2f9-724680009bfe", "comment": "Malware payload (SnakeKeylogger)", "value": "4dab748e62e669f18aa2c528a684295a0c1207b51b4048072438e3139e9dae1bbd2ea0254b467c795f2dc9acb89c7808", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633587058, "uuid": "099932d3-ec8e-40f7-949d-2800be7cd8f7", "value": "T1A07423891BC271F7DA858972E4FAFD3DF3B9206D61400B4743C26FD52B8364A9913B92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633587058, "uuid": "1061af79-c4e0-419d-8d2d-0ac15562f607", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633587058, "uuid": "f52ca4c6-313a-4f1e-9a38-f355f3e09735", "value": "6144:b8LxBBXs1cge2k6hQwtHncNCMHEUOhw3lJ9Et50GFuEK7luV7YczAMLQTu2:ys1ct6u4nACMHHSX5lvkuWcj0i2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633587058, "uuid": "fb6642a5-cc8b-4ad9-93e9-4548c9b59188", "value": 359059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633587058, "uuid": "c4d8e7c2-4ec3-424e-a008-b3da5e7cf762", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633587058, "uuid": "3e1cc85f-7ff4-48ed-9051-6e3e194e27b7", "value": "Scan3094-02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba463658-2740-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633591949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591949, "uuid": "ace7d28c-878e-4e45-bd43-578c9f2df0f2", "comment": "Malware payload (Formbook)", "value": "9909fd93b5d00b1815d72fe95e8264b6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591949, "uuid": "e21820fe-a9e9-4a75-b504-22654bd1546d", "comment": "Malware payload (Formbook)", "value": "3134b0ee6ba255524e8e5401b08e3e8a1be8743870424654a015f6160139bb5a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591949, "uuid": "e630f077-0cb4-4dc4-a955-c7adca8bd3a9", "comment": "Malware payload (Formbook)", "value": "0148ab2df69885828ddad2bda20f113f3283e1e3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591949, "uuid": "34cb1e71-792c-43b3-afa4-c292e8b45800", "comment": "Malware payload (Formbook)", "value": "c4730f577c8d3846435c43153dd9b1b5ff48a301f84bb628f8bc26925979158a5d9ecb4bbb40632cbba16480163ec9af", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591949, "uuid": "6a9b554a-3062-4ff9-b73c-aeb7568a54e5", "value": "T13774122133E75A8FED319331622E6E673719CDF286452496181072826BB9FB1D374EEC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591949, "uuid": "b46219e3-0f74-4ba8-af2a-ad8ec65645c1", "value": "6144:d7nCeFrTlF8s737yprq1gl9qBxVl4VOlE/EMVAthYhoWh1mR11kBzY4xsso:QelTliM3XVfBlE8MV86h1mR1y/0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591949, "uuid": "7f904a5c-02f9-4c9a-a2b9-55e71eeafeba", "value": 339456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591949, "uuid": "f0e2d165-b65a-49c5-8ab9-48eba486790a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591949, "uuid": "cf89e822-f36e-444c-b000-3cbba9ed8e35", "value": "INV-276.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "728b1c6c-278d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633624900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624900, "uuid": "52cb89bf-93c9-4ddc-920d-105e1bc94a37", "comment": "Malware payload (RedLineStealer)", "value": "4680e7db9de399c2925e2024d0d46954", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624900, "uuid": "57592201-0b34-47f7-8fca-8faa85ccaa7f", "comment": "Malware payload (RedLineStealer)", "value": "319d10acfc388b91ab59503ab0d16ca888abaf05fa8e6ba4b1f7a34a61228b5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624900, "uuid": "3cbb50e4-fa76-43da-8352-f015025f351d", "comment": "Malware payload (RedLineStealer)", "value": "eeef3e3e34e7a37fc2f4bf152bd1e32783e43642", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624900, "uuid": "32e819ea-7e5f-44a3-acf6-33e4a9ea80a8", "comment": "Malware payload (RedLineStealer)", "value": "0a59688fb957c29ebcc621cb87fc5bd767810af4d2ab1a9c53959d02f90186817d1bfb12440d4260475e2711ab272eea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624900, "uuid": "5e50bf27-6c31-4c3c-a560-379beb93a7f1", "value": "T15F64CF10BBF0C035F5B313B65A7A93B4A53D79B1AB3480CB62D526EA5A346E4EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624900, "uuid": "724954b2-240e-422f-ad9f-3a1707887cca", "value": "104d9977f4378bb867ddadb6d1eb3d6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624900, "uuid": "60af4bfc-6b9e-4e87-a389-2bd998b26d09", "value": "6144:3mBy1UeVnvkobLH36utsh1gT/KfQm3Uv/e1eNuNplV6ioe5:3mBy1rVnLv36uE5fR3OGrl8iX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633624900, "uuid": "8b3fbef8-bf38-4d4d-856c-970b02c01357", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633624900, "uuid": "0bdfd49f-af19-49dc-913b-f905c35003a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624900, "uuid": "42c49ac6-36e8-4f53-9fc1-bf8a3c2d423e", "value": "4680e7db9de399c2925e2024d0d46954.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76d9231b-277f-11ec-843c-42010a9c0014", "comment": "Malware payload (OskiStealer)", "timestamp": 1633618894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618894, "uuid": "f958768d-22b3-48e7-b828-daee7927f20c", "comment": "Malware payload (OskiStealer)", "value": "e8a4177eb1ca6ffcb252e7cd2e8b1814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618894, "uuid": "90142c90-b5f3-4725-b29c-7c4ad3df0a76", "comment": "Malware payload (OskiStealer)", "value": "31b0f01effcb3ceb506694ab49e3f3f9702090a449c2182ab2cfcd969b378f18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618894, "uuid": "9cfd4f8f-f0ff-4c53-8f60-caf163242136", "comment": "Malware payload (OskiStealer)", "value": "d47680275cf1bf0a884361d7683eadff5d1020dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618894, "uuid": "06d7564f-b77c-45b1-b6d9-184dcb3ea835", "comment": "Malware payload (OskiStealer)", "value": "1b6c1deccb74bb71bdfeb4252f5b95c1fa7313fbeb5d8f59cfced5f895c4b7ecc7f6bd4d4fd4d68f51d8ccbf204c9df9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618894, "uuid": "fb3e47ea-6f60-441f-bbe4-045b1df2b381", "value": "T11025F6102695CA11D1B637F4D860CAF093656C15DA29C28B2DF1BEEF79B1B03CE11A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618894, "uuid": "e6450a0c-04b7-465d-b2b5-9df945d9308e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618894, "uuid": "20525660-2fcb-4f39-a2e7-df76a7191887", "value": "12288:OeA04DyL9pD3n+0SN19iMfTO3qKE65aIF8TfEIF3c7u:9O+L7D3+1HTa15DYfEI1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633618894, "uuid": "01f12fd8-6cfe-4817-9232-db6fa133b677", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633618894, "uuid": "f4c95f20-eefb-45a2-a65c-e3f639551ea1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618894, "uuid": "6c0cc1ed-8128-4c63-b931-cb014eefd285", "value": "e8a4177eb1ca6ffcb252e7cd2e8b1814.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5486485b-274d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633597362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597362, "uuid": "375f9658-cd27-44e2-8ba8-358d222278a9", "comment": "Malware payload", "value": "593eb4ea0f96218502f285c9962f51e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597362, "uuid": "a5f09450-c21e-4802-b7ee-bf649fcf8767", "comment": "Malware payload", "value": "3211cdd389ea46e30e47e4525016973894ce217767011e646531b90911135a7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597362, "uuid": "295a4aad-a17f-45e6-9de1-47155f196466", "comment": "Malware payload", "value": "44094da1471c7d928cfc76b2a238b0e37f6b0fd0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597362, "uuid": "82cbfa8a-7583-4b79-9a47-666f856348c8", "comment": "Malware payload", "value": "46855496b9a92349d7eb5a142e39fb3bca92a1f9f366e391a87c52517d5cb73498563c44b3e775562c754fb993019e53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597362, "uuid": "b4a0b37c-6487-49c7-a10d-64bfd150648a", "value": "T1DE51F8A7FF83DD91C11542B24502D8C27C5F663D42F450467C184F3EAE98946A6C7A7A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597362, "uuid": "5030e3e6-de09-43c6-9b82-ac17b711c7dd", "value": "48:a9zLy0RWwg8XDxAbp90Ku/XWyUwyf9lqMij4o7z1GflK:MzOaZXDxNKuuht3BazoNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597362, "uuid": "f65aaad3-a7ee-4b5f-9d46-8e21db568828", "value": 2655, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597362, "uuid": "16a15181-b63d-4e5d-88bd-dbf3c0ba6210", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597362, "uuid": "6254462f-311f-4bc1-915d-79348372a329", "value": "593eb4ea0f96218502f285c9962f51e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66b7499e-274f-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633598252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598252, "uuid": "6baf284f-f497-4081-aed0-2ea9ab7c8657", "comment": "Malware payload (NanoCore)", "value": "d15230c95d50ec4bd48eb7117ef34fdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598252, "uuid": "5b98476b-44b6-467e-a8c9-3e2c8b004c98", "comment": "Malware payload (NanoCore)", "value": "323394ebb62e854e81bec65fc7123a4f3cc2b9477e32269a073fe3c5068c1dba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598252, "uuid": "a7329962-6db1-426f-a84f-f99d2cd90612", "comment": "Malware payload (NanoCore)", "value": "2993199e898b21c05f2a113c041edde67241b8d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598252, "uuid": "44f2de06-d2bb-4134-a36c-9eec66cdb7ab", "comment": "Malware payload (NanoCore)", "value": "0bfcbe26374b9bbfaf3caba8f17b777ae7fc3f486afd186655d758c71be04773c3e54304fc9a00c4dc2725aac119f736", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598252, "uuid": "125bf04b-7023-463a-b53d-4b34937e221a", "value": "T12EA4E07E32A3C905DE3592B6EC9EC1511B7CFC063566CB3A7A9D62AC68223F40DC15C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598252, "uuid": "4df50de6-ae82-4c83-82fe-85a0154c2e91", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598252, "uuid": "2084926e-c23e-4373-bca6-81d24dac1d7f", "value": "12288:vhmvYoto7QdG/WI2Ucjf3zij5W0rfLHdYi:kvYgoMkxcjve00rzd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598252, "uuid": "57b9e91f-0292-48a2-9001-5a379470677b", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598252, "uuid": "5c37c7de-b515-414d-bf5c-e26e0fd2c947", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598252, "uuid": "43d7d7a4-00fd-4aef-a64a-74f9ff7f452b", "value": "d15230c95d50ec4bd48eb7117ef34fdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0104556-2725-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633580443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580443, "uuid": "beab679e-db9c-4aa4-b57b-c312b41d2021", "comment": "Malware payload (Gafgyt)", "value": "398a11f9652f31e03252d7d4b34abc54", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580443, "uuid": "d8f97252-655c-4af6-8821-9426073caa4d", "comment": "Malware payload (Gafgyt)", "value": "323aec7f7221ffffd3d8d38ff91be75b4e70d88582039a607470e537c91b54b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580443, "uuid": "029eaaf9-6f9d-4a79-9d42-790d3f1c0dfa", "comment": "Malware payload (Gafgyt)", "value": "a0df24bfd8eb9f8e35a3caaf956b6efd0fa63587", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580443, "uuid": "ee52718a-6f62-4819-ba2a-6dabf0b8f40d", "comment": "Malware payload (Gafgyt)", "value": "2536157022dabba4cf10706f10338781651b7db6f60e0e67f651d639ad38d09e12127f529e5d5ebffd01a45e979b966d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580443, "uuid": "b2ebf8e9-cd7d-4de2-b534-ddbe88b6520c", "value": "T1CF8349829641DAB3D5431AF512AB8B150132FA3E5E1BDEA3F31C3CF49F129847261BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580443, "uuid": "a01fece9-b2bb-4005-bd3a-de4a7ef53e4e", "value": "1536:IYPRYsI/cU3wVP0eFIudDy30CqOVq9gvj5hiTk7she0QzUzJYQ2Wk:lPH1U3u0Hude3pqOY25hiI7Ue0QzUFYV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633580443, "uuid": "58519a96-9523-496d-a0a3-f32866363c80", "value": 87924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633580443, "uuid": "033754f1-35cc-4a5a-b7af-a9dfa29e4cd4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580443, "uuid": "f8cc9937-951e-42b5-b428-db4cd62c0563", "value": "398a11f9652f31e03252d7d4b34abc54", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4bca7ca-2727-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1633581310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633581310, "uuid": "5f21aa27-2098-48b2-8b79-228a9c953f7e", "comment": "Malware payload (AveMariaRAT)", "value": "6d883d583924bab2b456690401265966", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633581310, "uuid": "46a8611f-c91e-470b-89bd-6d6fdf3f7d70", "comment": "Malware payload (AveMariaRAT)", "value": "32a3a8f36c4cab6e28a646f7db8659f132a98f2b7169155e543ec1e024dfc211", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633581310, "uuid": "b15abc81-391a-4ac0-9989-879957b0fed9", "comment": "Malware payload (AveMariaRAT)", "value": "b329b0209511e4f7a22a4de4b9f34b022202c3a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633581310, "uuid": "5b845503-a3b7-4174-a134-498d3e4fb4fc", "comment": "Malware payload (AveMariaRAT)", "value": "8a652aeb82f5cd1928bf909a0b6c7c2739fc3a3bf969591cbbf7aac20481350b8772836bd5c8e357566ccf0bedfdc27f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633581310, "uuid": "eb830996-2071-45db-bdf2-766a602b4b61", "value": "T1D8950A10B3A15124F9F767BA76B54694883E3C801F2DA2CF5A850ADAC62D2F47C347E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633581310, "uuid": "ed091dc2-7ad1-4330-ba41-406d8af5f567", "value": "59db2621db4bfcbe475ffe9303a1d051", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633581310, "uuid": "bc189a1f-3bb6-4e68-8aa9-784ffd659d2e", "value": "12288:2GxLdGXOKiiEuuOa3A4nRPCWCimrlsQR49D4pa7+oX1Z4e:fRGXgTRPCW5ElPC4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633581310, "uuid": "72758331-3193-42b0-a7b7-1062e68567d1", "value": 1949696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633581310, "uuid": "812160e0-69f2-494f-85ac-4a19b9203c36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633581310, "uuid": "77502461-dc0a-493a-8fe9-bfa0a808618a", "value": "6d883d583924bab2b456690401265966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1df28ba-2724-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633579909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579909, "uuid": "781652c0-0ae4-4d80-b509-7a982fdd5a74", "comment": "Malware payload (Gafgyt)", "value": "84936e010dd9f2f9bbd23f2ee947ec99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579909, "uuid": "c4394aea-3fb3-472a-81ff-18a98acb553a", "comment": "Malware payload (Gafgyt)", "value": "33748ca7d6bfe081a5175f2a7bffc7f518605b3eb4305c19f07fe330d4bf8796", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579909, "uuid": "1f10f3cf-e394-474c-83dd-1ed5d3b37616", "comment": "Malware payload (Gafgyt)", "value": "cec3c4bf15bd0778021f786ca468c5a1d6c6e6a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579909, "uuid": "5c2ad733-22a5-43ab-a308-50c52776d275", "comment": "Malware payload (Gafgyt)", "value": "1715c5a37a6ac32d160b30225dafcae50fe0c9b15fe4de2e79e44cd8dd126011a70944737d1cba5512c15c908a281d69", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633579909, "uuid": "969d3f7a-de86-4d69-9a8e-09c5a9579a83", "value": "T1C4B3F901FC404B27C7D267BBF79A428E7B3666586BD7330166296EF02BC579C2E39160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633579909, "uuid": "058b269e-f3ba-4b9b-88ad-6fb8180cc7c1", "value": "3072:69DMjalFQEnohuNZsx90a6sEx5hs3bMo4JO7HoDQHDVpZAlvm:tx9J6dx5hs3b97HoDQHDVpZAlvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633579909, "uuid": "2d142878-dd1f-40ca-9aeb-cbf8acf41328", "value": 109494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633579909, "uuid": "129a43c5-9a25-46dd-8619-fa5142fa2e00", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633579909, "uuid": "332a8fba-b669-4371-afd9-68f7e7c4e3ed", "value": "84936e010dd9f2f9bbd23f2ee947ec99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a26c84-2750-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633598657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598657, "uuid": "0c17ad16-0d49-47ab-b896-e5bf5bf5fb94", "comment": "Malware payload (DanaBot)", "value": "82a5b94d5e381e6c1acc9ea9b11d4cfb", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598657, "uuid": "c3fed25b-c0ee-48b7-9042-2b7629c189ac", "comment": "Malware payload (DanaBot)", "value": "352fbd110c3d2313476efa21b9abf831cc99369781c9789514f13e3d1dbd319f", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598657, "uuid": "f7e21d9d-f94b-4755-aa76-06fa0d70d3aa", "comment": "Malware payload (DanaBot)", "value": "b082039ea926dd1488de65c19fadfaf9178eb448", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598657, "uuid": "21f7a3d3-796c-4033-b5b6-47a9f09ee63c", "comment": "Malware payload (DanaBot)", "value": "810d2b1457c9b3de367cb91b4481f35b95f3892f30d67fc687928df6ed51ac8ccf4fd0fbe0b773f055f64222ebf2a4a9", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598657, "uuid": "a3e652a6-8544-413b-a4dc-561cf2b9d3be", "value": "T1DF351240BBF0C031E1B727B94B6993B8B9397AB05B6481C791C527EA5E787E4AC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598657, "uuid": "34ec056f-9958-444b-8648-985bd7db3dbd", "value": "dfddb4935ecfeccd8e67f98d0f98b8e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598657, "uuid": "8ccdd245-2dd6-4995-9bcd-021c5e9ff253", "value": "24576:bFB8Lcx0w2SQNkjO87ZWacsGMvzENi574+ica727eF:Vx01SEkjDwacsb7BlM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598657, "uuid": "2a5bbc43-39d0-4069-be4d-e842e895c235", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598657, "uuid": "10b9273d-a3fa-495c-bb3d-63a0d7d1d5f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598657, "uuid": "b19e77cb-4fe5-4589-a803-2e44f48f0928", "value": "82a5b94d5e381e6c1acc9ea9b11d4cfb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d155ed6d-2775-11ec-843c-42010a9c0014", "comment": "Malware payload (a310Logger)", "timestamp": 1633614751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614751, "uuid": "9d9f0866-b650-469e-ac46-8e7205e5b9a6", "comment": "Malware payload (a310Logger)", "value": "f058ec68a9f1649827914157c3e3b45a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614751, "uuid": "664afef8-9f87-4178-add3-7dfedbf794bc", "comment": "Malware payload (a310Logger)", "value": "3554f11996cf0ec2e3541b07c9460a5da109d65117795f7e1a12727184b9446b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614751, "uuid": "38cd9211-ff89-4881-9dd8-be5900b15e99", "comment": "Malware payload (a310Logger)", "value": "e3be4d91bc095f5cda391574f5b7d6a67f6bad7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614751, "uuid": "589a1abf-cea1-445d-a430-44a5fd3c7c99", "comment": "Malware payload (a310Logger)", "value": "4157e239d0806dd0116733fa87b5d141095b9f6ac269a8823c50de268296e0310bfb99487fdee28a73101a94da1f5f68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614751, "uuid": "cb01b95d-2193-4034-b7ed-1ff18f7edf48", "value": "T1BAB2D855E686CA22D4677A3A8C5582F80979FD1BFC93972FA9CC3F1E3DF22040751A60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614751, "uuid": "51a72083-80e5-4df8-98ee-a2fe73d76233", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614751, "uuid": "8c42820e-6f83-4e39-a7f4-4800ef9d6cc8", "value": "192:rqXEJFEdU+bcyhzmxJfNjcQuhmRzUVQIsS:eUQvcyR6JFwFhrQ9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633614751, "uuid": "97ccb3b3-344f-4178-91ff-735bc37685c9", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633614751, "uuid": "0d7aca65-86cd-4060-8897-bbb38c8d7842", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614751, "uuid": "65826b84-280e-4f98-8239-9a54dce6d69a", "value": "f058ec68a9f1649827914157c3e3b45a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19efd75c-276d-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633611008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633611008, "uuid": "bcd1245b-9607-4164-bc0c-f397f4199bab", "comment": "Malware payload (Loki)", "value": "b21fc6ad7e9aabcf73702889dc017f67", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633611008, "uuid": "52d9fbd3-9c6a-4c63-89e4-30defba9c99c", "comment": "Malware payload (Loki)", "value": "35a1292dcbbe0e8db0893318e876fefbceb3559abe32144604c5ff66ba4dbf18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633611008, "uuid": "50ce4dc9-2907-41f0-b331-a8b8ee9abe3c", "comment": "Malware payload (Loki)", "value": "34f23b3fa13d16774196388ebb15142b736d2c2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633611008, "uuid": "75a3ed4a-0971-41bf-8fb3-d1a5c193f482", "comment": "Malware payload (Loki)", "value": "05d2fb43e4b1a0273fc66620c2abbe8ca4c321801d23cc43f23a5d557c97ea2e4491f740fb79209aa1dbb8227ce32692", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633611008, "uuid": "93d88a47-30a8-47fd-bd15-5cec942922e8", "value": "T16C349E10ABF0C035F0B752B94A7593B8A92DBDB16B34C0CB66D427EA5A347E4AC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633611008, "uuid": "f9747a15-2ab8-4593-b1ef-c62d4470b4aa", "value": "104d9977f4378bb867ddadb6d1eb3d6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633611008, "uuid": "69d486bb-9acd-4282-aed9-c7bf21e084b7", "value": "3072:oBpHobDHKIKKkbd3myVIVSE5vF2n+0VXr7ysdkpiFNcfnmb3DpaxO6c56u0cj:oBpISIKKkbd3LI35v2spMySb556Rcj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633611008, "uuid": "9b8146d3-ac53-4b3b-9ae3-557cec0e0fc8", "value": 238592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633611008, "uuid": "4c7acb0b-66a9-4285-933e-486916c6fcb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633611008, "uuid": "db5c1251-0304-49d3-a25d-b38f41cccf74", "value": "b21fc6ad7e9aabcf73702889dc017f67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3599a38-273d-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633590649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590649, "uuid": "b4111b9a-6dd3-4fbf-952c-d2c2709aeba8", "comment": "Malware payload (RaccoonStealer)", "value": "8b8ca3968a5cf7323d012d4c5492cbab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590649, "uuid": "c90b3bc5-6362-4f12-98a1-eab6298fc83d", "comment": "Malware payload (RaccoonStealer)", "value": "35cd41eed1dcc9629dbf360fbea09f8406ec25061fa73643d0c7f6d82bf3ffc3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590649, "uuid": "edb3a1d3-d417-456e-953d-3c7557772157", "comment": "Malware payload (RaccoonStealer)", "value": "bfe039d279453f442a9598f0c1de57c145c82c6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590649, "uuid": "d130f967-b8a3-4f1b-95c5-9114f6d00730", "comment": "Malware payload (RaccoonStealer)", "value": "03182e576bf5be476397db2e96cb47b124dda8b29431fdd570974341129923db44fd50218079fedf22d68c7309ad06a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590649, "uuid": "bc762b87-dee4-474f-afe0-7181959dff05", "value": "T196A4E100ABF1C034F8B727FA4A7A53B4A92D79705B3990CB52C527F65A346E8AD30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590649, "uuid": "d75588d6-6dd5-4bbd-97f9-631c5f03ebaf", "value": "dfddb4935ecfeccd8e67f98d0f98b8e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590649, "uuid": "3aecbc5e-efc2-41d1-99a8-a0d3e01d8bdb", "value": "12288:AFO8UiQRtVLy0RGPfE4HUUOTX6N3zJ4aRy1XQQulu:AFoVLk/nO23zuNpQQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633590649, "uuid": "eb35c7ec-79e5-4f73-92b0-ee2d46e5bee1", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633590649, "uuid": "d0374499-9422-4ed0-80b3-a03b123761fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590649, "uuid": "4638fbd4-9d50-4bf7-b036-56dd7755bc54", "value": "8b8ca3968a5cf7323d012d4c5492cbab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1956e83e-274b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633596404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596404, "uuid": "eb9c6de6-8f66-4a43-b7a1-a0d0183f51a7", "comment": "Malware payload", "value": "0ad4754000e88bc051d6605d63b58026", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596404, "uuid": "c4514e97-b0ea-4bb0-a5bd-3462bd5ad7d0", "comment": "Malware payload", "value": "368800079ca773a707d437855a41fa422f7337f3a9f36aff4f974301dd801089", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596404, "uuid": "f9d9f21f-c28d-4daa-b7cc-d191d5632a4f", "comment": "Malware payload", "value": "39bb47b438ed1013d9c87b912fef82d871e4859f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596404, "uuid": "5343f788-3140-48ce-955d-42e7b2bac469", "comment": "Malware payload", "value": "44ec8d965a90286db9dd9eef5c003abffc9c70b9ac08ae5a192630894b5b94e8a58b2bc872c6b3d95d481d4bfc26007a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596404, "uuid": "f7014ed9-48e2-4918-a4bf-7dc8e4275386", "value": "T141636D462709DFA6D67FE73994B2444017F8E617E722EA1EBEC400DE0A97F018750EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596404, "uuid": "df65fc28-481c-4cad-9152-b80dc54020a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596404, "uuid": "23618bfe-e77c-4942-bebf-62d96229590e", "value": "1536:NkqXwFNppdN3Omrg8nD4pBNaNItxcuvb69YR9IT1n/lqDNLah07+l2pKXgTKU:NkqLn8ItOuvF/W/4DNC07+l2pKXgTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633596404, "uuid": "f9cc2345-830f-407b-b815-3bf4c64b3428", "value": 72120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633596404, "uuid": "071679db-bf33-4d4e-afaf-79239510826a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596404, "uuid": "0c81ee32-58fc-4c3f-86b6-5825325ff110", "value": "0ad4754000e88bc051d6605d63b58026", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb14ba59-273b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633589803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589803, "uuid": "9c20be29-587d-4d2f-8adc-63946f544515", "comment": "Malware payload (AgentTesla)", "value": "b4eab6adcac586a4f8c457f121b6e06e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589803, "uuid": "3db02855-4e45-4285-8796-9f301fcb13d9", "comment": "Malware payload (AgentTesla)", "value": "36c5bec6f3cd7142ee07d8f330856d32a633a1d971bb12f6b26ee188a201f39a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589803, "uuid": "97637e91-2e87-415c-8b9b-d54095435a9a", "comment": "Malware payload (AgentTesla)", "value": "4323ee02cf017fa9aaeddd6d0cc872faad45f9c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589803, "uuid": "3a4d3312-e0d7-4691-8a4e-c53232965d2f", "comment": "Malware payload (AgentTesla)", "value": "8c3cf140be01281db047c334dc08f19bb5cef681e754517602f85f9bebdc3a85db9b58bd186c9facce3e8122516881cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589803, "uuid": "c6c546e3-7e24-4270-a68e-2200de59ed9f", "value": "T186B4795573B04B54C8356E30E0144E1E6E667F2C2DBE703EA6ACFA55E37B68304A9DC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589803, "uuid": "a2926023-4fae-4946-9cca-f006247d4249", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589803, "uuid": "412cda52-2a43-4d4b-a247-c1130e0c5c48", "value": "6144:O8LxB1nzGk0O2X2/PogslSFCQShTOBoOm9+HXD9fAaYSItbQj9xq74au6Un+Gjmv:7nZ0PXCPAkpSYoOu6XJRYnEj9xc6j4Pr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633589803, "uuid": "24473dbd-a72f-4475-a656-c2aa244c1c84", "value": 538629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633589803, "uuid": "ddea2acd-918d-47f1-8b6b-1eca3904ccaa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589803, "uuid": "1451e7ed-bea4-4b53-9af8-31e35e1fa216", "value": "PO_SA00100721,xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37867141-274a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633596025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596025, "uuid": "464892bb-a7f9-427a-8132-645bb5e2c227", "comment": "Malware payload", "value": "6815ef9aa3f9af72ae77a2a1ac577352", "object_relation": "md5", "Tag": [ { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596025, "uuid": "f22f5ee3-7066-48c7-86e3-7c908e6b9702", "comment": "Malware payload", "value": "376b8a3db2b1daaf60724f4f5c151ab743ba7011682acbbb386fd23413a85a9f", "object_relation": "sha256", "Tag": [ { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596025, "uuid": "5e21bdeb-a0cc-4be2-a215-84e2cc2ad21c", "comment": "Malware payload", "value": "60d0745b384f3bbea01dc2bec66adcb52b47f2f9", "object_relation": "sha1", "Tag": [ { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596025, "uuid": "8590b1ec-8817-43fe-8ed9-c6c5fecdf888", "comment": "Malware payload", "value": "70d3342c98fb52d9799462af3f8c2e19d4f9043d1602a591aeccbab4be01c24de06fc88131dff316f8fdb6efc711a5a9", "object_relation": "sha3-384", "Tag": [ { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596025, "uuid": "357b6906-0c7c-4a85-8e7a-8b41fef8363c", "value": "T15134E04AF575C84DFE5AC73A4CCB0F9B5276DC128BAF0246B685B1515EF0DB82A0214B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596025, "uuid": "af308e83-42a5-4c7f-92a0-e58ff0a74976", "value": "6144:6Kpb8rGYrMPe3q7Q0XV5xtuEsi8/dgl9DW/cZZRBDq1JOb7AvOsPDMlovS3OPI7+:J9D1TDmUb7AvDDy3fLvfv1O+1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633596025, "uuid": "48aa171e-d6d5-4ca2-a173-7b7c37531065", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633596025, "uuid": "b9f04f51-99ae-4c75-846c-5fa4fd97dcb3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596025, "uuid": "3b65644e-90db-4070-93ec-3e311aff15f7", "value": "waffi.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16b65cb9-274e-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633597688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597688, "uuid": "04f902cb-fc96-45fe-a3ef-9f971f11d01f", "comment": "Malware payload (TrickBot)", "value": "3b28b0e3ae926630873ea45b02e53594", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597688, "uuid": "32caa7c6-e0b8-4c34-9cc5-6efe32b6f80e", "comment": "Malware payload (TrickBot)", "value": "37c129eb8bb575d7ac12fdd14b5d05edee15c1230d7b712e5b9d2533f78dc5b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597688, "uuid": "55739fdb-5403-45a4-bdca-99e106908dc9", "comment": "Malware payload (TrickBot)", "value": "b63bd641392f3a75c0f576ffe9196bfa1d6f5589", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597688, "uuid": "78ee396f-50f5-4fb5-990c-6ce3c2fff024", "comment": "Malware payload (TrickBot)", "value": "b900c26ec75b9fa8fd108ce1d9c62a57168cb26a14b4f1d44bd6c92c7247681de824912cc3e10e4b97b84acd01cb18e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597688, "uuid": "b70e9ed9-7408-417e-91ec-d3c49db50570", "value": "T1DAB4DF02B3C18836D67B223A49ABD71933B9FC204F65C38726C47E5F6E326D55E26352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597688, "uuid": "f63153d5-1e09-43f8-bb0e-89bc2738f2b4", "value": "fd98f67a63ecc847a2028c66b8388afb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597688, "uuid": "663cad26-66b2-414b-a2e3-38fb2643f3eb", "value": "6144:b3oOkxQXFDzaLtFD2aD36AKit6lltqFpaI28VwPHK6+TDrAo0dThI9eq0NIaP:b3ExQ1DzM1Q7qFp12iwPqvDr2VI9bZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597688, "uuid": "63388010-d795-4bb6-9a56-45a08c665782", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597688, "uuid": "fbe6faf8-99c0-4550-9333-927e0e8e0f37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597688, "uuid": "363c52e1-4c76-4ad2-8b92-6a6258dfcd9b", "value": "3b28b0e3ae926630873ea45b02e53594", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa779417-273c-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633590339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590339, "uuid": "96f705ee-3e30-47ba-ac8a-34466b21e55f", "comment": "Malware payload (RaccoonStealer)", "value": "05ace188ee15a1c7870cb89c891b3d3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590339, "uuid": "760eb2ec-dd6c-4afb-8db0-7847d542622a", "comment": "Malware payload (RaccoonStealer)", "value": "382b19e805a36ef8ce20212a24f57f05559ec675bf6d2d0262580b4b7f331fef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590339, "uuid": "ca7ce103-de2d-4753-8d86-48aa45c0ea8c", "comment": "Malware payload (RaccoonStealer)", "value": "6a4aae5cf253855e42f8ad5998217bbf22bb3364", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590339, "uuid": "aaa41002-efb4-41ae-8112-97d1c3e576d4", "comment": "Malware payload (RaccoonStealer)", "value": "97f6aa551207c62f6dbf39a1456bbcdd369cde122bdc741cf002fae7d3b63e3662258b792193c06e883297dfce2b99e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590339, "uuid": "85bf702d-210e-4ab8-bac2-a959bb7475d8", "value": "T148448D30A6E0C035F0F726F859BA93B8A92D7D716B3490CF52C51AEA56346E4EC31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590339, "uuid": "8643eded-95c0-4b81-be8e-2295b2e47373", "value": "654aff1ee1bc89531bd3b96ebe76ae67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590339, "uuid": "fd9bfd3d-89e8-4f74-86c4-75956f27e8d9", "value": "6144:AwPQI8xHw4hX3veur40LXKVIcAwm+EiZgr4V6wnGS:AwPQ5x/hX3v5rbjKVewnq4VHnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633590339, "uuid": "303c77bc-d995-42d0-8496-ba6e516295a0", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633590339, "uuid": "c4322dad-d72e-46d8-88fe-9967e9298e0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590339, "uuid": "e2ee8513-705c-4c3c-b7b2-d9e817d583ef", "value": "05ace188ee15a1c7870cb89c891b3d3c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b385e80-273a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633589132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589132, "uuid": "62661087-c5f0-4203-a7a8-8b8a6c5afd2b", "comment": "Malware payload (SnakeKeylogger)", "value": "4f95aa292f894da510a3dbb5c072e110", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589132, "uuid": "723f0334-d42b-49ee-be73-c3dd71bb39a7", "comment": "Malware payload (SnakeKeylogger)", "value": "387d1014dd5dc2246d0f7f0ed5e30008dd8512e7d7852319f16fc83c7d5f41e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589132, "uuid": "3212dce7-45ca-4535-ba6e-976559210e5e", "comment": "Malware payload (SnakeKeylogger)", "value": "f5c14ae6d840019ce2bbf46dc96a073992b01c31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589132, "uuid": "073ddda1-3cb6-4004-8f8f-f01469d7baa1", "comment": "Malware payload (SnakeKeylogger)", "value": "1a20b966703a079fb0e783d2d77bc40fc6da29fae841f51e0f63776614ee4078637caec64f683b021e91fea6e6f4f2f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589132, "uuid": "52c203ca-bacf-4ccd-874f-69d1e6f2d5a5", "value": "T1CB74F15DA3238245CC3787F02854DB925B756C2610AAE3381F99B0FE2F637B85ED0697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589132, "uuid": "b414ed6e-addd-41c5-a6ad-c1f9156343a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589132, "uuid": "e28d7df8-711f-430f-816e-5dbfee38ba40", "value": "6144:rKVn+Q+3HwOGDJBPEe+1wDGO9KoGPrFrb1h/OgBelLGsyNy0yH:+nHoGDXE299KoGhNhWCeu+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633589132, "uuid": "566361e8-6785-40ae-a289-31dd3c58d3b5", "value": 357376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633589132, "uuid": "76acfe16-c393-485a-8a8f-d9798d73f22d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589132, "uuid": "d18bd517-d30f-4e2f-8272-0863600b61f5", "value": "4f95aa292f894da510a3dbb5c072e110.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0271d798-2767-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633608391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608391, "uuid": "82b039d0-0ba2-4083-9547-e6a1592f416a", "comment": "Malware payload (Mirai)", "value": "346e0f0357778468ff249584ebe03c79", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608391, "uuid": "04a6aac5-edbd-4993-a3de-fad02e6352a6", "comment": "Malware payload (Mirai)", "value": "395d3bd4cb3b304c44515c86cd3b3f1e315878367a794721388117cf8fb74793", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608391, "uuid": "f2849d74-a29b-4c92-b848-32e1cea0c247", "comment": "Malware payload (Mirai)", "value": "792674e76834e9fef5af9a2e2d7be257567b2535", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608391, "uuid": "126c0195-c44a-4f96-8883-dd6c2ad7de4e", "comment": "Malware payload (Mirai)", "value": "45eaa60802f1124fa4754488c079ef6e1e73a1e5fad950cc0684574c93925a53ed245d9916fb3f9676bb572a3b625679", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608391, "uuid": "b613450d-1da1-4367-a2f5-f3d7c8602371", "value": "T18C732956BCD18A2AC2D0237AB66E509E3321B3E8D2CF3227CD144F5476C992E1DB7791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608391, "uuid": "a5cb3899-0f95-46d2-b8c9-68f6d7e52998", "value": "1536:VX00q44TZolaEOMl5Pc7H0eziVJgqpA83VamGFfxbaDzll0M:t0lTClxgi/ZAmmVaPll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633608391, "uuid": "f4c8bcc1-f64d-46f8-8c30-381c2cb22399", "value": 79076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633608391, "uuid": "550d7c65-2b04-4a8e-a7ea-9515815a79a2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608391, "uuid": "cc941a6f-04be-45bf-bf19-785a52374d6c", "value": "arm5-20211007-1206", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cce44d6c-2713-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633572653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633572653, "uuid": "e01b9396-9dc9-4449-8226-81a08c37fbbd", "comment": "Malware payload (RedLineStealer)", "value": "ad49cc601d5b21f74688750ccf0b76dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633572653, "uuid": "a5b3996b-d4a4-4a99-bb0b-9985d9025dca", "comment": "Malware payload (RedLineStealer)", "value": "3a82687b1b73032f1a3477008b681f5ef3cacac2d7cf53370af2927ddeb98047", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633572653, "uuid": "189ec1fb-f3ee-452f-975d-60bdf311cd7d", "comment": "Malware payload (RedLineStealer)", "value": "dcb7170842fd0266bf58d3cbbce7efdd2779e3b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633572653, "uuid": "a1a97271-f270-4f97-9259-d8a57eb91b8b", "comment": "Malware payload (RedLineStealer)", "value": "98d96dc857f09d509b932b742764766d5f6a362e6041f2e63bf9d23ddfd2f1f2cc90a58874407f9ecf2ba9530ac5fd9f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633572653, "uuid": "b17bb63a-32a9-497c-a2e3-c2e6fd14119f", "value": "T1B9E59C052BEE8710FDFB1F78A93A85A507777C80AC7CE16F61A5325E0A30B42D971726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633572653, "uuid": "cb69b7df-8646-4073-853b-13d8c1a5c06a", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633572653, "uuid": "e1c9be9e-4036-4fd9-a168-72ca7b298d83", "value": "24576:u+smmgTlpGZiZdJ/Y7w3tgN7KjJ1g8CVkjC7A9gtxYaUhB5m+65JZgwCc:uYPJiUe7KQmjQA8sK+og", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633572653, "uuid": "11534b16-ac1c-4b7b-b0ce-85c61df32be6", "value": 3020288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633572653, "uuid": "4fe6b038-05b2-477c-8907-ac7739f43da5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633572653, "uuid": "8809d987-6941-4de0-8fe5-6c0d3912e9c5", "value": "ad49cc601d5b21f74688750ccf0b76dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a523b067-271d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633576881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576881, "uuid": "ea1443cf-faf6-4e0a-b637-50cfbf06b66f", "comment": "Malware payload (Mirai)", "value": "8bc410ac6cf37815a8e3f7b25dc76c9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576881, "uuid": "89a8ad83-6396-48e3-9d66-1ccbedc733fb", "comment": "Malware payload (Mirai)", "value": "3b031a533d7951316bfef67ff50f1d55386f36a4c3b8e56a9e77c7607f47d3a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576881, "uuid": "bbf2b85c-16a4-4de7-979e-5de090dc14d8", "comment": "Malware payload (Mirai)", "value": "afdea4f8057fd723434af469749ae8f7b65cc5c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576881, "uuid": "0980d6de-c18a-45dc-948b-279970cf89f4", "comment": "Malware payload (Mirai)", "value": "9424c99dea194ea3fbfefed9ca60b72c0082f847db54a5d475fa22f6607c23504836231c40a4a68e213c7d06e0f71934", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576881, "uuid": "419e282a-20de-4ce2-81c1-b1be4b04ae15", "value": "T1CC93F54BAB190B43C4975AF03D373BF0871DBEB112EA41C4601AFEC543B69B56116FAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576881, "uuid": "ad073295-92ba-47c9-be47-9f19b846e134", "value": "1536:r+ItpSYxenV2jCDXIoUmK5U7sZ1whTu6YTDU2:yuJxMso7sZ1wgW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633576881, "uuid": "3b1b3d7b-96f9-4c1e-98e0-a734cbb2dde8", "value": 90720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633576881, "uuid": "90c9adc6-dab5-4e7a-a426-bd196bdc69aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576881, "uuid": "43f2e9ca-ab46-41d7-9c66-9d7f8db869c3", "value": "8bc410ac6cf37815a8e3f7b25dc76c9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eecc7daf-277e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633618666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618666, "uuid": "4529b22a-6006-4bdd-a2c0-4b9b0c3987ba", "comment": "Malware payload (AgentTesla)", "value": "d47820f46931c57b1aa4a3142ca09ede", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618666, "uuid": "aec95b76-7f88-4b8a-bc0e-0942f874d7aa", "comment": "Malware payload (AgentTesla)", "value": "3ba268fa5df045587c1408f743a621252c56513c602c67d3a8df2f3d2a11e8ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618666, "uuid": "2039e222-ae7b-41ab-ad53-0d5d41935944", "comment": "Malware payload (AgentTesla)", "value": "2413682f60c0e5a0d6e9cef38b70ca8cacb34aa5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618666, "uuid": "c145eca7-a24d-475b-b2ad-d222f52ed007", "comment": "Malware payload (AgentTesla)", "value": "154a337e49166d3074b22ca166a0b189589c82ae051fd3ec23e2287de0812b2487c46aa329b7da5abe121cec8006cf25", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618666, "uuid": "9f39f8e2-eba6-4f57-95bf-52443d13cfed", "value": "T1C394ACC3328C9C51F8538A32CEDBC46F5666F9C0BFBDE0C66B51EA6E28331464566907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618666, "uuid": "3634d2e4-f5b4-47d7-a2b7-dace42282a87", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618666, "uuid": "85a7ed0e-5c7f-4f4e-b209-2eef03212549", "value": "6144:08LxBUwrt0Br/TiLNCNVQK4MBNdRotYdzxt//0iE73jXSbVscFJ8uzX8g7S:I+0Br/uLNCNVHBNdRX50iE73bYRvzXk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633618666, "uuid": "5290f099-3b29-4f27-90e2-f8f2df8c9afa", "value": 413762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633618666, "uuid": "4cdafdcc-ba7e-43bd-b024-2ad2271fb507", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618666, "uuid": "f1d13ddd-bf52-4844-989f-15a6cfdd06a2", "value": "Sipari\u015f0071021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f6ef6e-2722-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633578868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633578868, "uuid": "e89e6dd2-4f6a-4f68-9331-27b98721a5b5", "comment": "Malware payload", "value": "b7d117142fd68261b22c961a2e8ce4e5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633578868, "uuid": "b97dcdda-086c-4ce5-b13a-119ac517ce44", "comment": "Malware payload", "value": "3bb61eb3906fb62e1170ec1a2678514af9371e75ec54a6aff5d9e00b143cea06", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633578868, "uuid": "9894f45e-e04d-468c-adbb-cca35ec1f2cd", "comment": "Malware payload", "value": "81780eb91ec72a21422a01bdf21b4bf048111266", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633578868, "uuid": "89aa9d0a-7d78-44fd-8471-167670f6995d", "comment": "Malware payload", "value": "ba79d840219bd6aa25f0fa5d3abc76f34a789eaed61d9db25ee740835e1ae34927741fbc53be5bbd67ce8708b7dd7c6e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633578868, "uuid": "5d9131fa-80e0-480f-9ee2-aa40449609ce", "value": "T1FD934A52B5E080B0E5FF063948B98A111B7E7D32EB708D8B7B94160E9D747C1AE35B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633578868, "uuid": "bcc9ad8f-62d2-484a-97fc-160b443d770b", "value": "790d34e04a25ddcd53bc36d3768a83ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633578868, "uuid": "55b3f59e-4f98-4a2e-b308-28c50e175bd6", "value": "1536:7RLT1uCxHvR4OnI3Q9GcVSNzLWvsMbZFlgcLit2sWjcd8+stni9tC:7RLBjRBwcoFwZVit58+ssr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633578868, "uuid": "e8ada1de-90d9-42c0-a995-39377299b665", "value": 93184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633578868, "uuid": "adb507ce-8f6d-4514-9deb-32ff1a8360c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633578868, "uuid": "94dbd6b2-c75e-4e6a-a56d-2d05dda78eb3", "value": "SecuriteInfo.com.Variant.Fragtor.29063.6085.4021", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dda5a28-2735-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633586989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586989, "uuid": "094f1a17-109e-4692-8486-466fac568af2", "comment": "Malware payload (GuLoader)", "value": "eb8e74ef3db65db87fbda52887a95d97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586989, "uuid": "a682fe3b-ecc4-429e-b9cd-e5f48541888a", "comment": "Malware payload (GuLoader)", "value": "3bc5a6054d58159aefb34895c5e4f76447d0d2dc471645d30e109011b787e108", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586989, "uuid": "a41efde6-0a4b-4500-8616-bcbfeaf7e942", "comment": "Malware payload (GuLoader)", "value": "5d8abd16405ccf74142326fdaf5f4f81849f6ba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586989, "uuid": "07f7f921-c679-4da9-ab7d-73292c71d9e9", "comment": "Malware payload (GuLoader)", "value": "0474591daf5e7caf5a1a6589791bbadaa19bd16fe50b461de9b46447e3591fb361976e22d53903c253247dd768138ad2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586989, "uuid": "808ba78e-a7f0-40da-bb51-c6009fc19e4c", "value": "T145A3B231F594DBE6E824DBFDB775F0B605F9AD22C8914A0731897F4A75F60C638A020A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586989, "uuid": "6ae5713b-75d5-4f92-bd8c-9bc93d5f3c7c", "value": "64e4aee665feef1b106b6eccf2b2e39f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586989, "uuid": "209a0e3f-9ff2-427a-9e2d-88bd5d133331", "value": "1536:tc1L9U7ZrRqTMeckK5H5k6kGkMeSyiOqDh:tc1a0MvuhMeSybq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633586989, "uuid": "a0c58cb8-0f95-49e9-9434-62d85048d23d", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633586989, "uuid": "14f7352f-4cb2-48cd-b044-42b754c1cda7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586989, "uuid": "c139c4af-daac-4bc6-b069-1240444ca921", "value": "184285013-044310-sanlccjavap0003-7069_pdf (5).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbeb7c65-27a7-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633636217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636217, "uuid": "faab556c-4722-4339-9184-d24db46849f0", "comment": "Malware payload (RedLineStealer)", "value": "779900f54f479e6ee9ab31657dc253cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636217, "uuid": "e44ee98c-80cf-43ec-ba92-eeb9976732dc", "comment": "Malware payload (RedLineStealer)", "value": "3c5072f106c32fcabec7964aeefb5133a89e4d973efcc67d88603e53a6dfad48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636217, "uuid": "b7172d50-b2b8-449d-b670-bc1f7a7a36f0", "comment": "Malware payload (RedLineStealer)", "value": "7c3ac479f3c55b0a5de36f0b2eccb0fec69e5fa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636217, "uuid": "55d574ef-bed9-4e5a-957a-c414a95a7d7f", "comment": "Malware payload (RedLineStealer)", "value": "b9fdfddde163bb3a28e3575cd04492bd5640466c15bffe5df727e53a1937592a67c5affefb36c9663ba9d6b6c83fa047", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636217, "uuid": "e1cbc926-6d46-4292-9544-88633ce389bd", "value": "T1BA84BF00BBA0D035F1B656F44D7D9378B93E79A26B3494CF22D02AEA96756E0ED30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636217, "uuid": "702ff7d2-f08b-48c6-8a53-6b08cdb1e2e3", "value": "0d61443d5aeb8f94dcb0465acbd1f25d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636217, "uuid": "c80eb95f-d15b-4952-b1bb-a2ac8528e7ef", "value": "6144:OgaVvs77fJH41xD5YAyUeSdQygvx+2Q0ilGxpu:ukvfJYbF7Qygvx+2Qcxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633636217, "uuid": "c675dddd-f834-49fa-9be4-6575a94711c2", "value": 380928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633636217, "uuid": "2b85617b-1cde-4910-91c7-f548284a6498", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636217, "uuid": "7350d782-aeae-496e-a25d-7efe40776187", "value": "779900f54f479e6ee9ab31657dc253cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d95b1b52-2783-11ec-843c-42010a9c0014", "comment": "Malware payload (a310Logger)", "timestamp": 1633620778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620778, "uuid": "76090673-22d9-49a0-aa21-e11fb733e538", "comment": "Malware payload (a310Logger)", "value": "f1cfde26cbecc283993e768c0787c93e", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620778, "uuid": "a46b37a6-47b8-4357-be41-e9d6e8825030", "comment": "Malware payload (a310Logger)", "value": "3e706e2c9059cbc8f478fbc8abed5238e2adae4d8e50cf2eff1ed3123bd4cdfd", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620778, "uuid": "120c4b33-67ac-4ad7-807a-01a76b4cbdda", "comment": "Malware payload (a310Logger)", "value": "4dc3cb651b1e0990b17aa27fe4379d026ef7e460", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620778, "uuid": "ba59ae49-6c03-49f4-93e6-54dc92cdfc96", "comment": "Malware payload (a310Logger)", "value": "468b856e5fa92eacde90745c5dea6d26d62874bbb846b206942d375d740f45b6a2c018f1748ca6dbf493966cb2e2544a", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620778, "uuid": "be707052-e8fd-48f8-815a-6f5af90b250e", "value": "T188B21D11E284C921D4B77A395C9692B80625FE6BF823DB1B28CC3F1F7DF27450392A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620778, "uuid": "c1d9e78e-3c3c-46f2-b516-df920579cb87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620778, "uuid": "3816e416-e05e-46dd-9928-934494c19e21", "value": "96:PYRz50AlGcfathNd8i+14jT7CfKHIrqZrQcA7MOo0S0pXAUkTDLotUb1vGA1zNt:Om4OthoiX3uwI+Z0VMZUDQICXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633620778, "uuid": "884655a3-f00d-4965-ad4f-0ae6bc1679a9", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633620778, "uuid": "38ab7167-e8c4-4629-a925-6acc4b0e0da5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620778, "uuid": "514164a4-39fa-4eb2-90e4-626c1cbc8d8e", "value": "IMG-37960205632220.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c54799-2767-11ec-843c-42010a9c0014", "comment": "Malware payload (XpertRAT)", "timestamp": 1633608404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608404, "uuid": "745e87f0-c05b-4f13-8f34-31a2ce34df46", "comment": "Malware payload (XpertRAT)", "value": "4ef7b35bd9151fc5538c06ae79a0e2fc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608404, "uuid": "471bdd1d-bacb-4288-813c-e079fffb069a", "comment": "Malware payload (XpertRAT)", "value": "3e77ec2e0bbc394a1841bfb8f9b004f93fcbc35b401580abd01c92c41b6635aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608404, "uuid": "cca1ea49-486e-4b4a-8c60-f1480b17c915", "comment": "Malware payload (XpertRAT)", "value": "c45198609f71e795ccc9e5a2ec1ad3162141da76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608404, "uuid": "6a043585-90a7-4030-b79e-cd2062ca6e9e", "comment": "Malware payload (XpertRAT)", "value": "5dbec81e0a30c5d816158749f34962320cc04f8191bf7d4f8e3e1295867eda3b666aa288dc40d909306990d2196ac9f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608404, "uuid": "15917092-0eca-4f08-8dd2-ce12c73067f2", "value": "T1EE6502FC9513BA7ECBB70DB485E36C9C0C42187B125199E5A88A37C630A3513AF5F46B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608404, "uuid": "c5a37875-0ef3-4b90-a63f-07d821551b10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608404, "uuid": "7eac4302-de54-4f22-b421-b0ef342ccaf9", "value": "24576:NccWR6EKhvbg2wgVVCW1wq6u6y+gorlj0emV7JKYzj0zX81F03FT:BHw8RrLjlU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633608404, "uuid": "2a16cb31-5290-4c16-8976-10981cf0438a", "value": 1476608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633608404, "uuid": "c4b460ca-36b3-40f2-acd6-db0ae4de45e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608404, "uuid": "964562dd-5ef2-4392-b6dc-b3906edc4ee5", "value": "4ef7b35bd9151fc5538c06ae79a0e2fc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "391f120a-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633597316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597316, "uuid": "a652db69-04a8-4148-bb14-7bf8041eb618", "comment": "Malware payload (ArkeiStealer)", "value": "8e1c560fdec1a1918c062d33118980d2", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597316, "uuid": "febd9a3b-6a25-4497-84c4-cb60c4bf8599", "comment": "Malware payload (ArkeiStealer)", "value": "3ea7115ddbd68cc7cde39bcd0cd850bfe47b82d313ae1df56c9b2e29dc149933", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597316, "uuid": "79a57d58-5432-4ee8-a45d-8c9d5cd92f61", "comment": "Malware payload (ArkeiStealer)", "value": "5c432aeea9fa2529a5fe519160e0d9351c8e158c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597316, "uuid": "b128d962-abdc-4456-989e-8fe9cf64d3ba", "comment": "Malware payload (ArkeiStealer)", "value": "f32b260215bb890402c29726c8745b865f913f617276b7b7902b98e50fe66df781dc4a02b6d7fcc4b55dffb33e2752da", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597316, "uuid": "1624d242-e5d6-410c-8c87-f90829dcb7f8", "value": "T11BE402717AD0C033E7B31A704971CAB1967BB8720A31928F2BD4167E9F762D1CA6531E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597316, "uuid": "3e2dd841-4e92-4a74-b2e0-1e7185effc21", "value": "51f224c09b57224d474ba4b21025bdd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597316, "uuid": "c619c652-498f-40a2-957c-aee36158d4d5", "value": "12288:4D+mGTC6hLOmtzXDqIRnX+QW1l1dxlmPZRGw6Sop:4Dz6OmtKIX+b1lVlo6w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597316, "uuid": "97ce9617-e019-413e-8da6-c571a155bc8c", "value": 676352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597316, "uuid": "a33fee98-c01c-4a43-8354-0dd9333ba611", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597316, "uuid": "a66d4413-02a2-4090-9319-627450628563", "value": "8e1c560fdec1a1918c062d33118980d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7650884-274c-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633597179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597179, "uuid": "34ad1bd7-08be-4789-9906-7c7ba7a98766", "comment": "Malware payload (Smoke Loader)", "value": "ee5f8db9161918398b834d81bb32317c", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597179, "uuid": "d18ef37e-61f0-4595-8382-0af4abf722ae", "comment": "Malware payload (Smoke Loader)", "value": "3f10aa6bda0b1a4385d29e8847e6ed30fca41d8245daa09274cad3b28811449b", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597179, "uuid": "a2abb3e7-dcb0-4d0c-a689-3755f9baa394", "comment": "Malware payload (Smoke Loader)", "value": "0186b2ba333c35db9077bb163fcb4eba0bd75a8a", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597179, "uuid": "85111a88-3536-4196-b172-7d2d8bfa1c49", "comment": "Malware payload (Smoke Loader)", "value": "2b86f7af1e7ec3a8740596355b15615622b01278699e03094e003e76c8984e09e956b0650359f5de9455f9bb52282a51", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597179, "uuid": "2ec8f98f-a30a-4a9d-bba3-822d4802a11a", "value": "T17D14AE1036D5C876E3A7693089B1CBB54727BCF28D31998B2F90563EDE752E0CA16353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597179, "uuid": "b4e53f1f-f744-4768-94b0-993fbbf7225e", "value": "01c64e8a0bf942eae9e15adaebb52144", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597179, "uuid": "5fcdf2d5-87c5-4137-8c1b-fa795aca9d7c", "value": "3072:B6FlRK6BWmr2hdNWFpFNqERsNW2vAogFV8135WCjAqpn7wZ43h:0FZ5rydNWTqEaU2iVW5WC+4x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597179, "uuid": "a77bfa02-2173-4ccd-b2d6-cf66c7d57b83", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597179, "uuid": "4eaa2c90-1684-42b6-82b0-8777ff3c7da9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597179, "uuid": "2be8ca90-f133-4fbe-ab89-f2a44808256e", "value": "ee5f8db9161918398b834d81bb32317c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "851f2248-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633597444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597444, "uuid": "1ab9c94c-02a2-4859-8041-096cf41e4fc4", "comment": "Malware payload (Formbook)", "value": "96bd7548ea9c202bf6add33886f45ddb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597444, "uuid": "88b7f671-b0a3-4daf-ad04-649e70e01514", "comment": "Malware payload (Formbook)", "value": "3f127801208a3596f363b8c7eaf33edd21e1f74ac2fca102d927dc784811c8f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597444, "uuid": "2bcac4fa-9f33-4fe4-a13a-3005056e9640", "comment": "Malware payload (Formbook)", "value": "a4bb35017e1ab69c385dff6aef7f484d61905850", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597444, "uuid": "adef3c0b-f02c-42fd-be88-a7800ce5d32c", "comment": "Malware payload (Formbook)", "value": "62218a3376f7dfcbb75a50d3a4c22475c32a7390b6ed3deea9528d6d1ec8b1b1c79467b9eea169c9a95764c0973c17be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597444, "uuid": "2b748a27-b97d-4497-a9cd-c5e36e5d2efd", "value": "T15B157DA7B9E10D32D63F3938BC9B91ACA61F6D312D5CA9813FB82D4C79398107639153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597444, "uuid": "7c0064f5-6ca1-443a-b62e-35090147e230", "value": "a75c37244e3bdfe1f2052f7c93d03b4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597444, "uuid": "94908d6a-fc53-47fe-9bce-eca8d230b6cf", "value": "24576:nWv+QwSKgQ0qgQDKqOTLDE4b+JlzNgojDGBav:WmWKgNxLQ4ERNRG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597444, "uuid": "fb05ea2b-9b38-4639-b3a3-e1b492ed369b", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597444, "uuid": "8bfd1846-9a30-4809-b43e-d30b6abb1a5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597444, "uuid": "15930323-eee9-4840-95b5-33b874d95299", "value": "96bd7548ea9c202bf6add33886f45ddb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf83a760-2765-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633607876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607876, "uuid": "0bee94ca-00fe-4142-ae16-3de2ff89ffa2", "comment": "Malware payload (GuLoader)", "value": "03b4b9525dc7033a1cff349546f8711f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607876, "uuid": "28ac8d87-0916-4c0e-a33b-e72322f6eaae", "comment": "Malware payload (GuLoader)", "value": "3f89ae4512be17ec57f4bf2f909a2257d1621ce7ae8e222ddb023675e89f1b25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607876, "uuid": "05309238-89ff-4659-9e18-c588a7db026f", "comment": "Malware payload (GuLoader)", "value": "b19a138e1db0ae7ef021ec263ab22343abdc559b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607876, "uuid": "cd00e9c9-be58-46da-a2c9-de04ed19ccaa", "comment": "Malware payload (GuLoader)", "value": "bfd9f485ac7803ed2f33b9955bc63972ed3732fad662a5aec7a14a26e1460dc944469839842920cfc36e5c9ed8330061", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607876, "uuid": "ee6a6eb1-21b2-4fed-a155-c99b4d6a0ac7", "value": "T1CDE36C57B469C6E2D5C4953B0CCB4C64E9A8BD21EFAB5A73B6C03D2B5C32EA5C44021F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607876, "uuid": "23e7e1b8-3ca1-415a-ac5b-6820dfd1379c", "value": "7d08175a5c50907c8948c11ac22e7484", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607876, "uuid": "89e52c14-67d3-430a-b8e1-990f94d93830", "value": "1536:cNI5rCLkXOIZNyq8bhk9wzmP38HnVkX3Rdb0PXahxJe0PKz46EO4qsvxSnQl31XN:cNur42PUywK38HeXhxOPQP31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633607876, "uuid": "1e7b6aad-2161-4360-a9f7-63eaf7b191d7", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633607876, "uuid": "50166e5d-a6c0-4915-bea4-3e98a9f07731", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607876, "uuid": "2ed90a64-5b6a-4b13-b439-f7c0e55dd071", "value": "\u017dIADA\u0164 O PONUKU 07-10-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e174553-2750-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633598667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598667, "uuid": "4abf8987-bc53-4da9-982c-2dbe518b703e", "comment": "Malware payload (ArkeiStealer)", "value": "f30582d55eb33608607f4e306ecacc5b", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598667, "uuid": "c46562d5-6ee5-4707-904e-12c53540e124", "comment": "Malware payload (ArkeiStealer)", "value": "3f9632d938647c95eeb79ad82576667f2f3e0110daf368b28159d23e30b20f5d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598667, "uuid": "6aa6d343-a363-4b33-aeb4-672258dd8fef", "comment": "Malware payload (ArkeiStealer)", "value": "ffe49550b3516b8b4e1cef4805b93c9e0531b50f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598667, "uuid": "7f47de80-4708-45a2-bb2a-5acad208a6cf", "comment": "Malware payload (ArkeiStealer)", "value": "cbb387a3081453bd80327b7588b1adb526b112b265d270b3da1bad5f84abc3069428b3ced0773f2a9003aa97665396fe", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598667, "uuid": "52e26b67-9942-41aa-a8c7-f25873aed3aa", "value": "T1AEE4021066E0C031F5B717B949B9D7A5A83EBDB01B2891CF61D419ED9A74AF8EC30393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598667, "uuid": "178bb9bf-072f-4c1e-9178-54978228088c", "value": "654aff1ee1bc89531bd3b96ebe76ae67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598667, "uuid": "1bd3d7eb-5662-487a-a5a0-92bc10c6709c", "value": "12288:tQggxRU3G2sIPz4z/2Nc30Bxp610XPC1t9mKQPwkK18EP6QnsapKCRVL:tQu3+g4z/2NM1Lt9mKQYkCHLcmV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598667, "uuid": "8c13387f-e1c1-4c8b-823d-234c4d3cf87d", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598667, "uuid": "a86fc147-df57-41c9-91ce-2fefb0ed9305", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598667, "uuid": "5c9a7f0c-21d6-404e-8b2e-012db3c53be9", "value": "f30582d55eb33608607f4e306ecacc5b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2855635d-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633597288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597288, "uuid": "ba3038e0-6e97-4f40-aec6-07d2f6f63940", "comment": "Malware payload (NanoCore)", "value": "6f98d59c9c4c2e16eddd63c9a3be7278", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597288, "uuid": "e6a68be0-cddf-49fb-a4ee-29f04f98faf6", "comment": "Malware payload (NanoCore)", "value": "402d284ed3476c3c957335210393044b3549bbf2250b87c35b5b65ed35dd0143", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597288, "uuid": "e76e15b1-8bf7-488e-bd53-583257546b08", "comment": "Malware payload (NanoCore)", "value": "286e85576fdf4f0de0edbe491f8e2b3f1bf367d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597288, "uuid": "a721694f-6228-42a3-a35a-85d89249304f", "comment": "Malware payload (NanoCore)", "value": "515709bfbd5c938033776780e6ea0e86406899f54bea27fefa321fc0fc433990dfb8c94dc9bf692b880d2e51c2379e33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597288, "uuid": "d599d84c-244c-444c-bfbd-d7abe955b42d", "value": "T108B4F092B2570659EC3D0BF12874AB611736AD1F9098D32D61DCB0BC2DF33B416E2A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597288, "uuid": "332d9742-d5d8-4d0e-8e8c-64a094f12987", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597288, "uuid": "fecdaff8-32c4-4bbe-98ec-078ce99cd537", "value": "12288:sgtonpWNFU8YCmK/YAiaXqP41hc0DeNvr5FbnVe:sgtapn8YNKNiaXqP4w0DeNj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597288, "uuid": "93522efa-3229-4cc6-9df3-170a87114555", "value": 541184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597288, "uuid": "bd907641-a634-4784-a7bd-0d5302cc70ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597288, "uuid": "4e950540-e7d7-4683-8082-6c8cf077b4b9", "value": "Proof of payment.jpg.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e271e6-2790-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633626167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626167, "uuid": "8ae17329-67db-481b-869c-9519a2e79fe9", "comment": "Malware payload (Gafgyt)", "value": "c3ff5a501254030c6643b18ae5c63682", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626167, "uuid": "f79c088a-d0e8-4f99-8627-70a0a3ad7b57", "comment": "Malware payload (Gafgyt)", "value": "40e8508dc9ac0a3a3721ffe63b049d7405a86ac3290c27638113d72322485889", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626167, "uuid": "63bb51cd-9b56-4dfe-a953-597a406d4aaf", "comment": "Malware payload (Gafgyt)", "value": "c1318d78977a52046774ce7e23bac0038a0b7df5", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626167, "uuid": "26b25c26-c2ae-452c-a757-60765bf5a0a9", "comment": "Malware payload (Gafgyt)", "value": "4f6f0b2567eea0e27ea42edec1d92e9c8c40b262473fdd7ea5d00f336eb826925dd8896700e5843314debbf6361e087b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626167, "uuid": "2d6d1701-92b2-4065-ae1b-cfd8c55a4bae", "value": "T1FE836B23A651C6BBC0875BF91BDBD6615023B8B90B33720A73D8BDA92B36DC45D5D302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626167, "uuid": "0e7f11fb-ce66-4808-9205-11462de976a5", "value": "1536:UB7crF7FePF5tZuEqdPUq0aJb9sqx3CjrM3XguWIr8UmoIYuOVje+ZNne:URQFet5O7dPr0oSwyjr4XguDnmrYuOVA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633626167, "uuid": "81f3494f-0b24-4615-ad2c-1cd1b45c6f54", "value": 85803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633626167, "uuid": "00fc376f-0a72-45a0-85e8-ce3ddf24f6fd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626167, "uuid": "46c94fe3-3537-4d03-80a7-3f98a51f1e48", "value": "c3ff5a501254030c6643b18ae5c63682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bd7bbb-275e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633604578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633604578, "uuid": "6a24993d-fac3-417e-bd65-656d80d27970", "comment": "Malware payload", "value": "6422332249a3e867bb8ac8f3c6fb654f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633604578, "uuid": "711255f8-05cf-4c05-854e-259449329a95", "comment": "Malware payload", "value": "4163887c5f8cf7d062f2c04c159adb65e60c71727bf3132bd81827e1d3e27823", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633604578, "uuid": "ecd24eb6-60ae-430e-a956-a7ace5187c9f", "comment": "Malware payload", "value": "13445bb30b84bcdb3e3b9d61f0b0df5df9e888d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633604578, "uuid": "3d770a34-be32-4c0d-bb29-4f62597443bd", "comment": "Malware payload", "value": "ffe16e57f3096872a62e9f5d89fb35825e82525d54d268c0bf29f675219a0f83bc5b6ba2c53077c7916c1bf0ecceede1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633604578, "uuid": "5ace4aed-d27d-432c-9369-855a910c6173", "value": "T1E014B7D7726BF5E8D433DEB13DCC79AEC9DE1791130B683284484B1B8911680CEBB5A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633604578, "uuid": "5d7ee7d2-3069-4555-b39c-ceb0e0836fcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633604578, "uuid": "37232558-9c41-44f7-aab8-65e3f6ab53aa", "value": "3072:C5+zSqccPhsKNOxcLOslReltaOrrxTNt:6TcJsuOaLOslklUOHxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633604578, "uuid": "0f8f3920-9d81-402e-9ee8-6c71051b2920", "value": 202752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633604578, "uuid": "9a034c5a-e9a7-4f9f-9ffe-a45ada596059", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633604578, "uuid": "c81ba57f-2c73-4feb-9682-cdc784673fd1", "value": "6422332249a3e867bb8ac8f3c6fb654f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a668814-2788-11ec-843c-42010a9c0014", "comment": "Malware payload (Lu0Bot)", "timestamp": 1633622793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622793, "uuid": "1a09c722-feed-4cd0-87d6-cf517472ccb6", "comment": "Malware payload (Lu0Bot)", "value": "7ea5c4883229a2621b24a907dd531c83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622793, "uuid": "156b189d-c192-481f-99b2-56a376e6c996", "comment": "Malware payload (Lu0Bot)", "value": "418a860f2f7f5d415ffa2c7b2662c6fde7c35e2bdafd45e378bdf7c95579fde8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622793, "uuid": "59b242cd-5f11-46e4-9083-49f47765d0e0", "comment": "Malware payload (Lu0Bot)", "value": "f5ab95d82b2dbfb25afccfb53373daf4c8ef050e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622793, "uuid": "9894c4ba-6366-4e8b-9668-a3f6d7ce7187", "comment": "Malware payload (Lu0Bot)", "value": "57a18a7c41fb60c9b8ce7aeee9dc3599046445834d2f841f3d108bd799bcf8a6ea06d725cf2a944c9a921c4f7576cad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622793, "uuid": "9e45cc1b-59a4-4f06-9005-f09db21cff6f", "value": "T120415773F59E9CB3C056023203C74A62F977637042B691182A2F05FE5945FDE29B968C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622793, "uuid": "2ae4ea40-dc0b-48e2-b14c-ef7d97eb896c", "value": "75bde4744d451fbe6711fcc516a639bc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622793, "uuid": "8f5c4352-711e-4f06-a2a7-e6483d79e90e", "value": "24:etGSBN8EoUr7oGl6azZuvfwEUXQkpMN+wgZeZTaGTMWRiRNrBSw:6LfoUAGl6F/UgbMwZaGdyNrBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633622793, "uuid": "161d4c83-05f7-48fb-a25b-0713b276df64", "value": 2048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633622793, "uuid": "c3f1a8c6-f973-4564-8db6-e1162c6f6045", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622793, "uuid": "0c409446-240b-48a8-a267-000d0f8d3b0b", "value": "7ea5c4883229a2621b24a907dd531c83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf134c95-2705-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633566644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633566644, "uuid": "daeb60c9-3528-4699-b804-a6cfffbae28a", "comment": "Malware payload (RaccoonStealer)", "value": "c06ab25bd9b7066f9cd4b49e91b1de7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633566644, "uuid": "92fbf820-508c-4ebf-bdbb-5fc420210a01", "comment": "Malware payload (RaccoonStealer)", "value": "41cc83dda885ce228f6db9a730d818f9eac92e15cae8c94cc2c0bbbddf9d178b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633566644, "uuid": "643464d0-b070-4e58-bbf8-de1eac8aea8c", "comment": "Malware payload (RaccoonStealer)", "value": "2ea84be9a6e10b03caf8292ec5185f88709e2531", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633566644, "uuid": "e4ec19a0-3d2f-4233-869d-70d639ec8756", "comment": "Malware payload (RaccoonStealer)", "value": "706ea37085956a9a35f7d132b15b82b32c6c71991388b0d21e4874b52e68cc172c09713b139e7cb1b9ef8534eb6cd951", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633566644, "uuid": "94eb42cc-6ff9-4c25-90da-ed487cb3b4ef", "value": "T180348D10A7E0C034F1B716F54979E3B8A93E7DB15B6890CF22D52AEA5A346E4EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633566644, "uuid": "0d7a9154-cf14-48ff-a77f-6d9fe1bb63ff", "value": "654aff1ee1bc89531bd3b96ebe76ae67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633566644, "uuid": "0115a3d6-e81f-4a4e-9519-53faa432222d", "value": "3072:+QLcxOp8NQNETVHKQdo4dMvoFzw0/sOUyEQY18JlPw6U8abXaD4cFz3hvjQwLi5:+QLc4ETln69voBU18JtU8aW00z3h8w0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633566644, "uuid": "9741a2af-9012-45ff-9f7c-279db164198a", "value": 239104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633566644, "uuid": "e3a44f6b-5f7a-4601-88b9-493ea78e46eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633566644, "uuid": "5356ca95-a57d-408b-afa8-5aa6621e0d30", "value": "c06ab25bd9b7066f9cd4b49e91b1de7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43f25a6d-2759-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633602488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602488, "uuid": "e2ed4aff-39f7-4ccd-a576-f0223896fee6", "comment": "Malware payload (Formbook)", "value": "9541217b4276268f9cf0e6e2f01a08e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602488, "uuid": "90b16508-2db6-4406-b9eb-b731203ec0da", "comment": "Malware payload (Formbook)", "value": "4217bf1cf710804c6b4a7b6a7d03974aaa655e512e3bf854c193feb7b2a8d422", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602488, "uuid": "ca285af6-cec4-47d4-a932-76d1f305ce53", "comment": "Malware payload (Formbook)", "value": "13a47201f67eff232b200ba062f8df9a2af6616c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602488, "uuid": "839eecd8-a320-4c2c-a89e-f3fedb8efb44", "comment": "Malware payload (Formbook)", "value": "dfab43c05daa7f1dc2aeaa37750907fbff3f371b5c833643b29595486189182e4e92d1060fb4f5133f3ff854307f6f12", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602488, "uuid": "35e82ff8-ddca-410e-af2e-46174ec1fa6d", "value": "T19954120421C18CBBD9F3A6790EF79BB4F23F8515121566838B981F7A2F521C349FA1DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602488, "uuid": "08085023-70bf-42ce-a905-ecdd2f799bba", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602488, "uuid": "221ce085-e9bf-4ebd-92de-9d5d67e44a90", "value": "6144:F8LxBsiXNeJJrLYAmKl3LqeK47ZQQg5PnHoFWkcpWnVSnr1k+ZGk:/idWh68LqeKYm8ZSni+ZGk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633602488, "uuid": "9cba2b93-5b29-49f1-8433-16eed3b71332", "value": 300056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633602488, "uuid": "d0ba989d-9109-457e-80ab-ee62de6228c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602488, "uuid": "963bd16f-e0b3-4156-8130-32a2e0c69ec5", "value": "9541217b4276268f9cf0e6e2f01a08e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc78e363-272c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633583363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633583363, "uuid": "223ea895-97ad-4f12-9d83-d1d7286fb00c", "comment": "Malware payload (AgentTesla)", "value": "696c15433135d4da87cf0763f327bc77", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633583363, "uuid": "d6a4e4b5-191e-4e27-9f2a-41c858562a54", "comment": "Malware payload (AgentTesla)", "value": "423f9bf9dd367bc3e1d143c112f1fcb4fcd61f81615659451932cd37b4db556b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633583363, "uuid": "1331a856-ce70-43a7-bf96-3201d993dad7", "comment": "Malware payload (AgentTesla)", "value": "67a19dc1c1a79036197a05991c372cac997186d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633583363, "uuid": "c554cf93-f1a9-44ff-991d-664b8579422e", "comment": "Malware payload (AgentTesla)", "value": "9a9aabca577687607a242cfd9697297eaddd9a392bd3c0487ee851f605a6166b09361e160b2fb1bc8b9f0c3ab42ed7d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633583363, "uuid": "dc3dee97-ba87-4f2a-be37-21909179bf5d", "value": "T13B151F5363AC8EC4C06792B4DFC0C4B96C19D9EE421A53B4AB12AB64F75FC035E6A473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633583363, "uuid": "e0c9b5e7-eae9-44d5-ae48-178d09b5e3ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633583363, "uuid": "1f4afb2e-597e-425f-a40f-d437155b24f8", "value": "6144:SY8I6UqA6KERXKkPFO3L9o4zP7Oy9sXGbBb4LqwfTwADlRcbv8aHgiuTJ:S9U0rPFO7pnBH6jxWvDAiu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633583363, "uuid": "3c6a2cf7-8d3e-44c5-b451-db459c830164", "value": 881152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633583363, "uuid": "d7af1fd9-9f94-4e68-a44f-721a07f45600", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633583363, "uuid": "c5cdc3f0-cfc9-4fd2-ba0c-de613adca403", "value": "DHL STATEMENT OF ACCOUNT - 6102021.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60ecb74f-2765-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633607691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607691, "uuid": "2069ef4d-d1bf-410a-8ecb-850bde3f17b2", "comment": "Malware payload (Loki)", "value": "eeb345b76db94937e88c354003a03f21", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607691, "uuid": "5ace0614-bcd4-4446-942a-b466cafbf653", "comment": "Malware payload (Loki)", "value": "428271a1a18c7ba9aa57a25cd67b74c0d405a79ea037cb92cf5c773694a6153d", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607691, "uuid": "8688f604-8f09-41c6-8acd-dbb0191d800b", "comment": "Malware payload (Loki)", "value": "4265c91e4f347f8c5c770fa9b16c199afb363ac4", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607691, "uuid": "1fc583b3-ac9e-421e-b318-1f87a6c0df80", "comment": "Malware payload (Loki)", "value": "73196861af1bfe5b41d48232b6e1c993595a2d7817bf699f4b89445073aa3c8f2ca995c4b32f7936252311c00892eb74", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607691, "uuid": "b2e9ca6f-09c3-4262-bb1a-fb8f08accba1", "value": "T17BE301BA3CBB687ADEC0D37818C1ED6836BBCD80251512E1BB94771DD6B8110AF21A13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607691, "uuid": "5856baa5-ebc6-4523-b86c-afe7ef62811c", "value": "3072:H7/xnaGvlunKmvggIqoSbMV35aTBxVFo9aO33WU+ojUnCg:HDo44KVgDoUMVIT3VFLOWU+ojBg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633607691, "uuid": "3c6a3cf7-2380-4ad5-a233-324abf878e39", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633607691, "uuid": "5ca90cc7-4fe5-46cc-9605-23b04a88d874", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607691, "uuid": "4bbeb9c0-8cec-45f6-829b-fc5dfa4774ba", "value": "CERERE DE OFERTA EUI894RO746367.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cd30cba-278d-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633624837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624837, "uuid": "431fe5cd-522e-49d5-93c2-c43e87d36ddd", "comment": "Malware payload (DanaBot)", "value": "b4c8d7faaec043f8fd767a9c8c648533", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624837, "uuid": "e9ea501a-8fa7-4ba9-897a-ca29db168d32", "comment": "Malware payload (DanaBot)", "value": "42e22bf3a9630d312d795db190f16cb7f0d3b51b9903695ed678dfc190240345", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624837, "uuid": "bd1b6aaf-0d06-468c-9367-788c7787fcb1", "comment": "Malware payload (DanaBot)", "value": "5d0e0a0f09eb6cd5a4b0a3b78a444b6db47d284a", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624837, "uuid": "285dcbcc-bcec-4a39-b014-f81d7c3737ae", "comment": "Malware payload (DanaBot)", "value": "8e13cd1cb88d6ddf74ec55048049c118e3a863235ad796b2de892b996d608f577e45d05dc6d02e0794f333935ee8db05", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624837, "uuid": "9f8f9e93-03b3-49a1-a89b-3230eaf5f8a5", "value": "T1D1451201B7E4D038F2FB42B80975D37CA52E7E629BB494CB62D516EA96302D1ED7130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624837, "uuid": "3b1979b4-6e33-443e-9030-ce89791ae515", "value": "c1d211268d6c769cc59ffca0e56e63c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624837, "uuid": "bbc05781-e158-462b-9be4-b6808143b94d", "value": "24576:Z2uFKkQe89MO8HZz2Win6dcMgys5X9dvsloXm1BawBLHyeF:Z7AMrz2Wi2cusF99sv15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633624837, "uuid": "bbfa0aa7-a4d1-4521-af48-0703db4903bb", "value": 1195008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633624837, "uuid": "62683da8-403b-47d0-9bc8-7ad3b88b8a5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624837, "uuid": "49274aa6-ff10-4094-a49b-a5009bc5ccb2", "value": "b4c8d7faaec043f8fd767a9c8c648533.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf3b37f-2767-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633608461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608461, "uuid": "c766b050-476c-4eaa-9bfe-c7f332b9ecb0", "comment": "Malware payload (Loki)", "value": "8c7ed5bf68dd9a6f76be57eb9ab80ae7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608461, "uuid": "66fcd577-a843-4808-9da8-0c5456f8fc87", "comment": "Malware payload (Loki)", "value": "437252ce5e183e89ff25e5634c411583de24829219901bf884f762351c8b6ec2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608461, "uuid": "69ca682e-9367-4b3b-b6b7-9ed02f89f58d", "comment": "Malware payload (Loki)", "value": "8df269fec5c9c0fd05bb468b6ee2fd077e570639", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608461, "uuid": "7e3481e1-3bf9-4eb4-ad9c-fddf717e20fc", "comment": "Malware payload (Loki)", "value": "92c5941b127bed59fc8a2a6728c6f493d951f666dd3a370d4d19cbd82925c68062fc23341ceafe44d401513e12b3801c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608461, "uuid": "589a1f03-d803-41a4-a509-c81680263d24", "value": "T16764E09813778708CD7947F43825A7611374E02A642EC3781BD8B0BC7FA7BB94AE45A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608461, "uuid": "30274111-0ab7-4282-8a16-01b68fb9b698", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608461, "uuid": "ab6b8826-67a2-45fd-8caf-cf9fc4cbc4d4", "value": "6144:K69L7Z0DQ+3HwOEz2J9bv1ABmYhKUxHvbBM/3Q8+YcA5fu1Hh7PucMfW6n:AkoU2JddABzK6zqA8lcAMlp69", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633608461, "uuid": "3ea89001-9356-40b8-a629-23a9fedd4ff8", "value": 329216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633608461, "uuid": "4b1c31c0-8461-445e-8b30-2a06a147eb4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608461, "uuid": "c80fa73f-ad9c-487e-9a3f-b308267c15bf", "value": "8c7ed5bf68dd9a6f76be57eb9ab80ae7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93f2019-2758-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633602229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602229, "uuid": "7c3f3c66-b1ce-483f-b84f-22c2bd8c3b1a", "comment": "Malware payload", "value": "d5df5b266fc8c9af26f6593f8ea771a8", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602229, "uuid": "b3f576ed-555e-4f90-beae-52a1fa504ea4", "comment": "Malware payload", "value": "45593a7071903724aae4974d478a17784cfca63af4d3404312fb4b5ecb9e0f1c", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602229, "uuid": "d56d6059-7c9d-4bfc-b211-703d4b46d91c", "comment": "Malware payload", "value": "b786a7c78b746cda42f49211fc2e437af17d1ce4", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602229, "uuid": "e00fca33-1e51-4b47-997a-6253633ee958", "comment": "Malware payload", "value": "fd4fe3155e252f67194e657c76ecf4415921791f7017c07f41ffa575d7e8f9936a504a1fb8b20798e74bb40bfbb93930", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602229, "uuid": "1954be46-d06d-4f32-9be7-5cca46c333ca", "value": "T1D2B1AC15CEC84311F8663F34DFA9A2C6A4D2FE61957895048432AA8C6452223DFF5F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602229, "uuid": "985b2be2-2b8e-472a-92dd-2114d8bbc713", "value": "96:8yGcgoiDlGKUTk3KJzQcQlmtnwC1FVu/FtXN8i3wXtVaTRdSLqDyXtsHJr6uTist:8yGEoKTVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633602229, "uuid": "daad7270-fa2d-421c-8682-ef85bdae2d1f", "value": 5214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633602229, "uuid": "80604992-76f8-477d-98a9-656dc4adb663", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602229, "uuid": "b922f8e6-debb-41b2-bf22-2678f44218ba", "value": "45593a7071903724aae4974d478a17784cfca63af4d3404312fb4b5ecb9e0f1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5c22f56-2743-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633593257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593257, "uuid": "c25ed5ff-801b-4fd1-89bd-15374ba861fa", "comment": "Malware payload (AgentTesla)", "value": "9b8de825a2d9f0d6d9bcf18129eaa671", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593257, "uuid": "1c13c197-ceff-4deb-b5b7-139e73b84dc0", "comment": "Malware payload (AgentTesla)", "value": "457b7d24c006ef2c11ac92c77c5cef44eb667c022d311990d6bbff037f24fcf2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593257, "uuid": "8334cb00-000d-4e61-adbc-375b6daa1404", "comment": "Malware payload (AgentTesla)", "value": "91d634b11c3e83f664ebdd66a374c38c4dbb8b2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593257, "uuid": "5acdc6e2-b14e-49b6-ac1f-f74c068ee65b", "comment": "Malware payload (AgentTesla)", "value": "919c0eaafe7896878b165c0bab5f8bec074b229586af1376704d0988466d5d7711ca5665ef95d6bc049d7f5135ec8a08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593257, "uuid": "c7ea46bf-f6da-4f7a-b480-cd62cdb77b60", "value": "T1D145F168036B4619DD758BF43C74A2A157B8A427601AC7787FDCB0BD3F23BB489D0A42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593257, "uuid": "c812e70f-5173-4f93-9ecd-6a70f1b0a82d", "value": "12288:SCNIMkoI2/LVOtFx/IL8k8ECxLAtnXegp:YMkn2AtX/zk8E5Ogp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593257, "uuid": "19e420b9-5673-4cc1-a8e9-68fee1283784", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593257, "uuid": "b8048fda-f702-4968-ad8f-aef019a95d73", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593257, "uuid": "803493c1-fffb-450a-8a28-23a86b970a8b", "value": "new order.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23f8ccf-2708-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633567884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633567884, "uuid": "c02fa823-7b25-4403-b3c2-221daa102f70", "comment": "Malware payload", "value": "21b539ac14acf902d6a6bf7522b55aca", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633567884, "uuid": "e5c06648-982b-4ced-af94-9275a4f879de", "comment": "Malware payload", "value": "45cc5c6bb3ca5cd25fdd735c23a17a98c3f9b4d38ad70cbea3c1c2919ad7243b", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633567884, "uuid": "acab9841-feb2-4811-9323-344d0c1d859e", "comment": "Malware payload", "value": "9f2c8bb5907ad2c1386ea2cf33059173969c408f", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633567884, "uuid": "51c44268-fc58-45b8-a58b-ec0021fd20f5", "comment": "Malware payload", "value": "8eea4c4155abd3103afcf247c61c8f2d38a3e783d9fab3c32e63d74e342be4e504ac6de40a56817aa3fb6a54570cc3c5", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633567884, "uuid": "553429ae-56a4-4297-83ea-bf9537987976", "value": "T10F33D03EFA26B468D04B88BDC10C50E251080554C3C6B563B459FEFE1A9977F239F9E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633567884, "uuid": "de6335fb-7e48-43f3-8728-611ec7b9a0ef", "value": "1536:hVBmg4M3S9OIzXFF6YWSRdhAAhXzoTwJuEWDckqI2:hVaM3uO6nWYAGXzoTwJbWDre", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633567884, "uuid": "4f7ead94-3c9f-4f4e-860a-86da5e992dc2", "value": 54912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633567884, "uuid": "4f653681-ddff-4052-8b35-c36d9cc4c38f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633567884, "uuid": "f9bcadba-b753-45d3-a343-4f919a5f66ca", "value": "SecuriteInfo.com.Trojan.GenericKD.47088183.13775.26912", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db55f98-272e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633584036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633584036, "uuid": "cd451ec1-795c-440b-bcc8-53e9698e0350", "comment": "Malware payload (AgentTesla)", "value": "44517f9c6c24bebd2a8b27db5a139b31", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633584036, "uuid": "962ac124-0c85-4d4c-ba97-4b61e4df942a", "comment": "Malware payload (AgentTesla)", "value": "45e4961d7b984c4ec98a0cea3cf264d9e14d4105e56f8b1016e789e6d14879c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633584036, "uuid": "50ee3e6d-e3e6-4b70-b079-dde992933f30", "comment": "Malware payload (AgentTesla)", "value": "3ebad979353a8a153a79acad2e160e95ca1ae115", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633584036, "uuid": "fa276850-2ad4-4ac4-b6ac-8dc4eb26977c", "comment": "Malware payload (AgentTesla)", "value": "cc38be199b2048521393e2051d228e1478c1100ea9de594b9b1ff7a5b18b6e4e1212fb21bb7bb6daba576b100ca02bed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633584036, "uuid": "381e0bde-1b4e-4996-8773-799afe96cae5", "value": "T11FA4E17D32A7DC04DE7146B6EDAEC05107B8B856315ADB39798E727C28627F04CD0ACA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633584036, "uuid": "4fcbe421-531a-49ef-a17b-f72007741c69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633584036, "uuid": "07a37a83-edf9-44b1-8d2c-7521da177dff", "value": "12288:m5ldoOAutj69QPzjryAGjf+g8yhNTSaZSZkj:mvd7ApszGjf8yTTS2Sa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633584036, "uuid": "02af1e19-e8a6-432b-9779-82351af74b21", "value": 459776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633584036, "uuid": "9d01dca9-ec7e-4cb2-8d66-e4ed52c5530e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633584036, "uuid": "a2266756-5783-44cb-8da6-7f3bc69484ea", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908cf0b4-2729-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633582001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633582001, "uuid": "309adf51-f012-4b67-83d1-d2cd1d2a49a3", "comment": "Malware payload (AgentTesla)", "value": "936f049ea2aae5b708cb3a16af48534d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633582001, "uuid": "b2825fa4-8800-4711-b68f-d7c8d896e670", "comment": "Malware payload (AgentTesla)", "value": "4623187dae9f6b28c258faa52bcf20c9e57734b8fd385deccf8af55e5b5cd047", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633582001, "uuid": "337e65f0-870d-4824-9524-a1ae704feade", "comment": "Malware payload (AgentTesla)", "value": "c5d4445144bb0dff63da792efe9cb4931c13a2c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633582001, "uuid": "ad717d83-39fa-47cb-a125-4003dea4d705", "comment": "Malware payload (AgentTesla)", "value": "835fa0516cd51c237aa5d4f770689a9b7cad0a2e4ae4ddc732c979584f272a5facc772309f367a755fc7d1bdc8f99651", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633582001, "uuid": "3e30257f-17c4-4e08-9e68-227cedf1b90c", "value": "T16BC4E0353263C949DE3406F6AE4EC15403687C46215FEB3ABADE726E68327B40DE12C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633582001, "uuid": "cb043b4a-08c6-4980-86e3-f1ca08552f87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633582001, "uuid": "d2a38915-9ce6-49a5-969d-d7fe972629f7", "value": "12288:w/dDXoDVvb8i/oC9BkYnDeEuaZDZNaVkSVbiH3K:2Xgbzb9NHFNqVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633582001, "uuid": "e4a8b101-4fa1-4c30-9882-e70ef6cdbfaa", "value": 560640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633582001, "uuid": "f247e76b-1c7d-4a2b-8285-fe38cf78e793", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633582001, "uuid": "60ce6448-f293-4ca0-9478-b00758122753", "value": "deposit slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea304179-273e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633591171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591171, "uuid": "8ec2db1e-c1b8-43b5-8a2b-30df6d786734", "comment": "Malware payload (AgentTesla)", "value": "3bdb77c69007aa1a0112c06af3588f78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591171, "uuid": "94ff6a2b-60b8-4540-acf3-39dc14f3f122", "comment": "Malware payload (AgentTesla)", "value": "4655c71eddbe909b522c0bdb0b3481eb233e00a4bb52cfe0b8e38bde057f5c10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591171, "uuid": "d688bba0-65ef-4bb6-bdc2-d231f21bfe9d", "comment": "Malware payload (AgentTesla)", "value": "6dd25d2ac6df8cb4295d88c68b9e962b6b2d680c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591171, "uuid": "a49afcd3-98b8-4c25-89f2-8be5ae95dcfa", "comment": "Malware payload (AgentTesla)", "value": "67e97db926328702de615f6f9e71b5d04d734b316ae072f3ecac8dc7ff2c35fec6b328d87a9e55f4919ef84530546d6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591171, "uuid": "637141bd-e058-4fba-9a7c-192a4e29d72a", "value": "T12BA4236DB70FB3B1BC2FE02C12CCB58944D35690C9A686DE499B42F41D42FE1676E6E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591171, "uuid": "3955ff40-1be4-46bf-8657-4659b964d7df", "value": "12288:l1ulS48tmgp2tigALTCPih2JzVB07hzbfIH57S:l15np2kliPdJzXcxbfIHFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591171, "uuid": "92ae60ae-54e0-4ab2-8817-2197e9b59683", "value": 474044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591171, "uuid": "92ed7887-1a7f-4e49-aa10-a5e2e32525fd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591171, "uuid": "85504bcf-344f-45ba-92f5-ab6cace7b68d", "value": "BL-INVOICE SHIPPING DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d104fa31-274c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633597141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597141, "uuid": "2c0932e3-2ec2-4da1-a24f-a968c97d77b9", "comment": "Malware payload (AgentTesla)", "value": "969bb61b272ff56221740d352cdabb20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597141, "uuid": "d2911cad-ebdb-41eb-9d01-4ad72d97af64", "comment": "Malware payload (AgentTesla)", "value": "472c7b2777174e1cd967e4d38e6ab3bf9b4f9a43227140d415057b1e4c2d462a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597141, "uuid": "6a9c22d4-8140-4a08-9d6c-4d83daa5e7c5", "comment": "Malware payload (AgentTesla)", "value": "a19237175d774d918abaec07c1a1aedc284688ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597141, "uuid": "79e227e1-4420-4350-b447-10c160857f45", "comment": "Malware payload (AgentTesla)", "value": "e7ae7bc48bfc0e371ca508efe57b6ab15e5e06bc73e775c8cc61db064154ef3e6c60d6afeeda081b50ebf66fc436ccff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597141, "uuid": "7ac7126f-3623-4f5e-b0d8-83ad9a484b62", "value": "T1F2A45D2C3A4D5AB2FDDD9D30890A2A18BB660F0323E0A9D657DB15CB874F0F56D05F88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597141, "uuid": "c2a8399c-f6f3-48e7-91ca-d93f61fb3312", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597141, "uuid": "1e5981e5-cb6a-4776-a224-6c79d83ea919", "value": "6144:lpKaLnXb6iH7mZwJuK5hurRuEFNDdJLT2ywV8839W+a5iUXz:lcaLnXb6gpJuQurNTwV3gG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597141, "uuid": "5b3cb961-b58f-4a09-8ef8-27ac5b76d7b4", "value": 489472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597141, "uuid": "bedcd4bd-1445-4d43-ab28-a9e7abdecf36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597141, "uuid": "7588677f-b28b-4431-8d0c-d6ac3138835e", "value": "969bb61b272ff56221740d352cdabb20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4b321a-27a7-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633635974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635974, "uuid": "74f90d27-69e3-47f4-a35d-ef1b1fc1156a", "comment": "Malware payload (AgentTesla)", "value": "ba54efcc64ef06523754b4844f2fdecb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635974, "uuid": "5913eb6a-8480-4221-938a-4e9176208f2b", "comment": "Malware payload (AgentTesla)", "value": "47cbb37b3867bbc96bcfcc6b08ee356da920648d523d00baca72a10afc1031e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635974, "uuid": "dadde350-8a09-4cfc-8546-1a420879432d", "comment": "Malware payload (AgentTesla)", "value": "39fba729c193a42d76e9c293a63f17d4076d43c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635974, "uuid": "f0564498-5b66-460a-abbf-a85ae1c3df9b", "comment": "Malware payload (AgentTesla)", "value": "42fda75cd394a03234f306c21b21841666b274615bcee21bed442d4ec525c0ce424467c6032e5a1963d472f13ae3eb26", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635974, "uuid": "dcfc5644-0299-40cb-bdb0-d90f23093e1f", "value": "T1D73507002295C711D1B637F4D860CAF097656C55EA29C28B2DF1BEEB79B1B03CE11A9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635974, "uuid": "44e8af8c-1010-47c3-98a3-0da5bd617add", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635974, "uuid": "546c774e-1099-48bf-8d46-dbd6202e4e07", "value": "12288:v/80NDyL9pD3n+0SYxfbwWoE91YrVoXMg/RD+brk3+aC3ao6R5eg:nj+L7D3+1o86YBTgx+cCKtw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633635974, "uuid": "d7f13a46-8568-46f8-8d25-d037122695d7", "value": 1073152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633635974, "uuid": "b455114b-4e4e-4ecc-9465-24575fa5c45b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635974, "uuid": "bc0d9f25-643c-41e8-9ba7-9c9916296e5f", "value": "G\u00fcncel fiyat teklifi ve teslimat plan\u0131 talebi 1- - LOI -PROJECT.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f1984ac-2785-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633621351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621351, "uuid": "13287909-c049-4ff8-bdfa-d56fcfe3bd4a", "comment": "Malware payload (Quakbot)", "value": "840c5f1989180fd8a2f621bf3142b59a", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621351, "uuid": "c7e31626-6d37-4802-b7af-2b658ce52c8f", "comment": "Malware payload (Quakbot)", "value": "47f9dcebf7f47b85f5d573d0700800de08a6ac3e476194664b6eb1cf16d1cfea", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621351, "uuid": "c1cba870-a439-4c42-ac01-06dbec262aa4", "comment": "Malware payload (Quakbot)", "value": "230a78dac0611e07719274ab8736bd39d3492d09", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621351, "uuid": "68870bfc-8e88-41cc-89de-c57dbcb79221", "comment": "Malware payload (Quakbot)", "value": "6bad212699fae0ec0b2088770abc25de41fdf369945dfd8a4a0b0cb3440f44e70af43207e1d4af46b48b44ba4e1b63de", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621351, "uuid": "ffec00ed-6363-478d-9af0-fea861736346", "value": "T1C3D39C463797CA5BE58803398ED3C79B3B72FC21DE72470336463B0E5E7A6A18C16652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621351, "uuid": "c66059d3-5e66-4887-b227-236dd19a12ca", "value": "3072:jk3hOdsylKlgxopeiBNhZFGzE+cL2kdAFc6YehWfG0tUHKGDbpmsiiD42ti+RLCY:jk3hOdsylKlgxopeiBNhZF+E+W2kdAFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633621351, "uuid": "19d8cb9a-78c8-4bb1-879b-f24a9f509027", "value": 137216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633621351, "uuid": "f3ba2c10-b8bb-445b-abb7-42effcdc75a0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621351, "uuid": "7e0e03bb-0906-4340-91e4-f205c6553088", "value": "AMLRPT_1766238980.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42f3b24-2749-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633595912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633595912, "uuid": "fbe5ecf5-7b45-4e40-af30-294974b57f85", "comment": "Malware payload (Formbook)", "value": "553dbe499387cacae8ec4be3fa5dc22a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633595912, "uuid": "32268833-f482-4700-b1ee-1be8e2588611", "comment": "Malware payload (Formbook)", "value": "48c2dca85b8198eb46cc23467836af27b36f3f42e0dce4a8a3c541860ec708c9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633595912, "uuid": "71d7f8f7-a3d6-429c-94dc-c345e2c10864", "comment": "Malware payload (Formbook)", "value": "e71a076653947227c1488da7e06e8d68d0ca31c0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633595912, "uuid": "1756b0dd-21d8-4cd1-9fad-1ee8507fbcf3", "comment": "Malware payload (Formbook)", "value": "987651e150ed3433cc05e558a5adc6ce16bb9e6163f07fc5784238ec8079c99e238bc88f39941f60ee11ac1c22051acc", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633595912, "uuid": "f1a2f28c-9d20-48b2-8d05-a0254545e129", "value": "T1CA9533425E8D48161BE4F6258982CD77A135B8EEC90F9678D9303B9C0DA8E60F32D17F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633595912, "uuid": "aa713560-3050-4a41-9a59-95a6e0513bca", "value": "49152:Z5uA9N9ZmxMj/rXq38ILrH6nebtEjaPqPORSqeB:Dmx8TxIvue8B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633595912, "uuid": "93b34d60-287b-47d0-8489-9b7ee583574e", "value": 1876755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633595912, "uuid": "499c72ca-d7cf-48b0-be7c-fb3e62f6d5c6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633595912, "uuid": "b2ec691b-882d-4f38-96be-f246ffd9312a", "value": "RFQ- 7110464.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451b95eb-274b-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633596477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596477, "uuid": "6ab27a8b-7e72-458e-87fa-962b7f3fe405", "comment": "Malware payload (TrickBot)", "value": "01be67e885259d6a5a38778a2480ae92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596477, "uuid": "2a644516-17a2-4822-a8db-cb805a3ba894", "comment": "Malware payload (TrickBot)", "value": "49baa1d4fd5e4069db16e5fe8e99bd1f7f2758b3e429b7603e018a59d0e0d7a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596477, "uuid": "ca7edb28-d79e-4d4a-ba5b-b3ee3971f96c", "comment": "Malware payload (TrickBot)", "value": "9d927792ce07d75f232daf970e9c5b376e6ba572", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596477, "uuid": "8ac0dce6-359c-4ed9-b56b-cc50ecf3b12a", "comment": "Malware payload (TrickBot)", "value": "5014ec586455abd3cfeca7a6ff7b6979f6313b2613b9f0dbd5cbb037aeaf97dc9c4819335742b6ca6717a9d7784e4456", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596477, "uuid": "ba089ecd-863e-4724-8248-6a849d01db62", "value": "T1F5D4C012BBD08876C99322324AE3A735A7FDEC015B22C7CB57D46E1EAC726C54D36316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596477, "uuid": "38b697f1-60d1-4e62-a626-0b7627e1ed18", "value": "96459f3ac5474c1f5d7b0f19d0d0d7ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596477, "uuid": "9f903655-bf85-4e03-a882-522a3efb9324", "value": "12288:f+t405GC8+pDumVo7RBBun3vDNopBzZ3a:eB5GC8+pDSbBMvB4BFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633596477, "uuid": "8f2da1b7-b689-4247-97f7-7cd0cf121486", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633596477, "uuid": "48a407a6-4221-4b4d-9f82-3446089c8aa1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596477, "uuid": "2d90ad08-b6db-4c92-b0ea-99974f3c34c9", "value": "01be67e885259d6a5a38778a2480ae92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6adb1021-270a-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633568623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633568623, "uuid": "24b23ec3-10d3-4d45-acc7-3d87b2c7658c", "comment": "Malware payload (RemcosRAT)", "value": "d8667b25ba6dda415c8aae718dd4acbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633568623, "uuid": "19458bfc-b467-499f-9e8c-54d515db1e0a", "comment": "Malware payload (RemcosRAT)", "value": "49cb5b15b21ecd89b7462da8008c6c49d32310858912344f11fa04dab67f1f3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633568623, "uuid": "fecfe058-298c-4c62-9cac-f48f0d34f532", "comment": "Malware payload (RemcosRAT)", "value": "d20834f1fef28da6c6abf00e1d25e8f488c016f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633568623, "uuid": "625e271c-79a1-44a3-807a-0909c5470207", "comment": "Malware payload (RemcosRAT)", "value": "2002c491f6a6839053f37e152e101a2dbe4745bd657ba80f60fd0b82a89fc5b56f9ed0a1ee8db62d4cc9ec7893952762", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633568623, "uuid": "aba49431-3bd8-4372-8780-1b914a39c74f", "value": "T11C159C93B1C48E33E15F363E4D4B67997C5AAD21AC1CA5C536F42E2C7B35100B6392AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633568623, "uuid": "bc2ceb64-b09c-4e45-b145-f851bbc7f1f9", "value": "a75c37244e3bdfe1f2052f7c93d03b4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633568623, "uuid": "dab9fbe2-bdde-49c2-b9e1-85258221a0f0", "value": "24576:nWv+QwSKgQ0qgQDKqOTLDE4bpJlzNgojDGBav:WmWKgNxLQ4DRNRG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633568623, "uuid": "868c9cba-92c5-4684-a4b1-27a91d0dbe4c", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633568623, "uuid": "20e99b85-34a9-413d-aec1-eb1b6bd9444b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633568623, "uuid": "e384ffac-4e13-4fef-a694-e5f42ad765e9", "value": "remit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97975b24-27c4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633648585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633648585, "uuid": "5cd3551e-eba7-456a-a9c9-c97dece715ca", "comment": "Malware payload", "value": "056da4eebed724300a6185a307b7548f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633648585, "uuid": "f1b50827-cf0a-4ffc-b999-72cbd61afb82", "comment": "Malware payload", "value": "4aa2cde2e72d591091967790e676beca8c91d01be47dec4bacca7c38bfbc91c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633648585, "uuid": "46124587-0890-4331-89d8-0849614796f8", "comment": "Malware payload", "value": "bb60b66b02b71d5b8691155cb0d9a75543d540c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633648585, "uuid": "ec942b7c-c223-43fb-8d95-d18c3e211f04", "comment": "Malware payload", "value": "969d8f6b08528a9ed6093a3c24c5d5660f838aecedc2aa1c997bf9734c58cb40771529e4830ed8b45293964dd3d141c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633648585, "uuid": "4bb5b899-6fa4-4d83-87b9-2026c3be6fc3", "value": "T161D4021122E1803AF27F56714976B7E45A37BCA388B1688F16F25BFE1F746918F11322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633648585, "uuid": "5c14cac6-833f-460c-b0f8-16c2cf196021", "value": "be06676f0b26f3557b735abbe8be48ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633648585, "uuid": "3c51eaa9-76ff-4bb1-9bc6-41c64447e478", "value": "12288:/1t8JZ8zhs9LLOFqxM0tWBQyopC46wO5XSjvkgFVeZTScSW:/1ty8zFqx5izopR6FrpTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633648585, "uuid": "e8179a1d-16c6-4c1e-82c0-e920849848e4", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633648585, "uuid": "6515952f-d53b-43f7-9e76-41a2d8fd459b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633648585, "uuid": "66e83001-14a3-4e35-9f5a-4da13072c443", "value": "056da4eebed724300a6185a307b7548f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d03b193-27bf-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633646285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633646285, "uuid": "e7d6cae7-5116-4d04-9c91-cb700287aae8", "comment": "Malware payload", "value": "ab4ad2e9e771c6b25a452fb94b1cb033", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633646285, "uuid": "d20f30db-71ee-4a4b-a5c2-6f9a101d7c06", "comment": "Malware payload", "value": "4acff00f1935efe2a12c8537de8b10c33bd714a07a8cdaafb56459f368acc669", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633646285, "uuid": "47a5b74c-5f4e-485f-a784-0d09887c8679", "comment": "Malware payload", "value": "1a7c604c424ec26c413eac9788c57668370dd3a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633646285, "uuid": "54262606-e40d-4af0-82b2-47043bb4be28", "comment": "Malware payload", "value": "40dbf93e87449d4fba3f84bc64a3c9c195912cb49aa445836ad08a041702f0dcafe5b40b16a11304162487ccb45d9a54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633646285, "uuid": "3bdabb14-ec3e-4cef-bee1-bbf14775437f", "value": "T1793507002695CB11D1B637F4D860CAF093656C55DA29C28B2DF1BEEB79B1B03CE11A9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633646285, "uuid": "fce19ed5-f3b1-4952-95e4-de1ea4cbe5f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633646285, "uuid": "ca45fcc6-5aeb-4124-8000-e7d462a82833", "value": "12288:58b07GDyL9pD3n+0SDzqu8qbPhtTAdCKYYOd4mqTh4M:eGG+L7D3+1P8qbZadCDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633646285, "uuid": "93caa998-272c-4040-96fe-58d9e1f4088d", "value": 1058816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633646285, "uuid": "4401081b-ca77-46f5-a4f0-b9cfe58d0958", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633646285, "uuid": "34d8014e-168c-40e9-a035-d35d6d2b1957", "value": "ab4ad2e9e771c6b25a452fb94b1cb033", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26fa915-274c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633597198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597198, "uuid": "57f157e1-d779-47c8-b9a0-3222d7e22a4c", "comment": "Malware payload", "value": "5b14687d32bf5a51e0cbce6bd09e24d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597198, "uuid": "11f7bef5-2e8e-4103-af35-fbaf8525ccc6", "comment": "Malware payload", "value": "4b802bb693b261c0ef6a3de7292a1406cea537ea867d9effde06f7d443a5b8fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597198, "uuid": "3dd9a2d1-c641-42f4-bee6-290afa29d306", "comment": "Malware payload", "value": "45f697a75aadaefbb3776873bdc14304d7308dc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597198, "uuid": "807a98d4-d366-4fcf-9eb6-d44aefa10adf", "comment": "Malware payload", "value": "f9559da2aa14cf28009b9ba5ba6f63a5e43fc4f549bb0c29055f6b5f6847c802c62ac90f3d0d6bbf387bd9c9b90a377e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597198, "uuid": "3f9ddb1e-948a-48e3-a39f-6510fd88fd97", "value": "T1D9939E31A4C68033D74335748AA6D3B14F6D68664652BADF4FE66D369F306E2D33830A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597198, "uuid": "8aaf4635-4e0a-4ab9-830f-e5bd8f8a8730", "value": "1536:bycSkHVQFx1Su3oYkgbYrACd/6sMFxV+F+aPY+nuqPRCrGgn9uz:maHVY1Su3oibnCBrDAmMf9uz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597198, "uuid": "7d0094a6-221d-4602-8253-c8c23e383b86", "value": 93310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597198, "uuid": "3bc3d0ed-0cd0-4992-9c71-1d903033a0da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597198, "uuid": "27f7076e-27d0-4f1a-9f1a-fa107d4bff86", "value": "5b14687d32bf5a51e0cbce6bd09e24d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f8eb8f-2740-11ec-843c-42010a9c0014", "comment": "Malware payload (a310Logger)", "timestamp": 1633591987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591987, "uuid": "4f7ec0ae-7980-4925-a234-52c17df6cce4", "comment": "Malware payload (a310Logger)", "value": "3d561b5654301d0b5f8a19a87ac1c42e", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591987, "uuid": "9ea8fd7a-4b2c-4ac3-b335-ea30b156e41d", "comment": "Malware payload (a310Logger)", "value": "4b9291840ea77ff147796f142094ea6cfa6368e1141d092a886048f40c5a24c0", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591987, "uuid": "d40f1022-2443-4de4-a897-32e75a997c1c", "comment": "Malware payload (a310Logger)", "value": "ed34dc599d793bfbeec56489f0345099f69d1d5e", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591987, "uuid": "ef9bb01e-1553-4fc8-afc9-982ccb1487d1", "comment": "Malware payload (a310Logger)", "value": "e6b8c3f922e882bcd1f35f42e436ba8ce249f0f418af895d7caf8b553c9f736f1cd3cd1f22af340624f8dc25a46e2ce5", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591987, "uuid": "0d34294d-de02-462b-a103-3993955e2e55", "value": "T15E64220D3C83FA03F93BF530BA7888965B87ED254AAD591820A9371D1075C86EEC66D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591987, "uuid": "aa03ea67-ec2d-46c7-8bce-e0556050f72e", "value": "6144:R7ODNLLKmOUz+XzsbMdNilyRDVlbnlhuItYpPNN1pILZoqsmat4moej+43GTX:RKLLrOU8YMdbBrzukYpNt6/jzIB3MX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591987, "uuid": "02e21451-ef85-4c01-9c21-b078ce08abf2", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591987, "uuid": "2d34ecc4-407e-4690-88f8-29f26fd0c608", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591987, "uuid": "642b5702-eeb6-4e31-9b64-e06ddddf1da6", "value": "Transfer_wise.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd33c5ca-27bf-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633646554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633646554, "uuid": "5b85b84e-731e-418b-8a2a-6aa32dd683a3", "comment": "Malware payload", "value": "5358e3c10a13dacc3c34d118abf7fac9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633646554, "uuid": "159314cd-11a6-4b7d-929d-39bffdb6491b", "comment": "Malware payload", "value": "4bc7273fd8a64f28cf0d3fd6bde139e7d53a754fe798478ae48d96840402cce4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633646554, "uuid": "aa474b91-bf09-4491-a9e1-3bdde088cbd9", "comment": "Malware payload", "value": "760392c8093b27ac9da1628500d2b266518469c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633646554, "uuid": "c9280086-6e7f-4803-ba22-a9ac0105d3ef", "comment": "Malware payload", "value": "9c5552acf40294666a6d64dbd11302f536a1508cb77ea94cac494e6ce11debc0bee9851b46806ffb985e77e2b40c1e5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633646554, "uuid": "1a2eec40-dfbd-4bf6-a294-21b946608a3a", "value": "T13ED6335ECE49A72E997F7CF1DCF85614CC54B2B45AE62EB458943488602DE3FA0A007F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633646554, "uuid": "77826fa7-4a83-473b-9687-a3a16ef0ad4b", "value": "140094f13383e9ae168c4b35b6af3356", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633646554, "uuid": "d0c9d739-b07e-4e08-a38c-2faea2a9acce", "value": "196608:gQeiliL0t03LyR0Qk9MA2S1bbD0fZhYG7i:iILtGLyHZVWbbD03u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633646554, "uuid": "4899f240-0d58-45a5-bb03-af3dc9f97f9f", "value": 12673536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633646554, "uuid": "ba2e2e3b-2d3f-46a1-8332-d1f8a64ade2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633646554, "uuid": "f281a69a-db31-46f7-aa91-fed92c9c11e2", "value": "5358e3c10a13dacc3c34d118abf7fac9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d53575c-274f-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633598343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598343, "uuid": "e61ee2cb-b652-431a-bfa4-779b46c45f74", "comment": "Malware payload (TrickBot)", "value": "d56843d37adfaaa63fee52165ccd8416", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fat1", "colour": "#B54109", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598343, "uuid": "735d09cb-f30e-476f-aed4-138f0ef3756c", "comment": "Malware payload (TrickBot)", "value": "4cb721ef0fd70063bb71ae083ba40871e6fb2095467d43cc15629c14bd794919", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fat1", "colour": "#B54109", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598343, "uuid": "ef100839-4b21-415f-b67e-6131f570728c", "comment": "Malware payload (TrickBot)", "value": "b976cb59c658c891073526aae2be9290756a4172", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fat1", "colour": "#B54109", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598343, "uuid": "354b7824-b3c0-4f52-ad36-1dae6be9afd0", "comment": "Malware payload (TrickBot)", "value": "64a00f1affeb84e1b3954526b2c7ded825e411b8f630dfd71af5f1d4c2733bb1dc6538bd11312cea901c6c0b42c9f1ce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "fat1", "colour": "#B54109", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598343, "uuid": "ab15a977-76ce-451f-98b4-9e841f210cc5", "value": "T1DBB4DF02B3C08836D67B227A49ABD71933B9FC204F65C38726C47E5F6E326D55E26352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598343, "uuid": "3dc337d0-7202-4d02-a7d4-5fbc30041fc0", "value": "fd98f67a63ecc847a2028c66b8388afb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598343, "uuid": "14475a37-b2b5-4759-8655-059e4f208eaa", "value": "6144:b3oOkxQXFDzaLtFD2aD3+AKit6lltqFpaI28VwPHK6+TDrAo0dThI9eq0NIaP:b3ExQ1DzM187qFp12iwPqvDr2VI9bZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598343, "uuid": "d7c3173d-1332-45f4-98b2-4c352ccf8b94", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598343, "uuid": "e9708361-a9cf-4c90-b08e-17e178abdb81", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598343, "uuid": "8589b34d-dbd9-4030-b442-bc6599e5fcac", "value": "d56843d37adfaaa63fee52165ccd8416.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b32e6f-2743-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633593307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593307, "uuid": "f50e444f-429e-480d-9cf5-0dd1d81027c5", "comment": "Malware payload", "value": "6f8c4dcf7dde545b54befc7ede452608", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593307, "uuid": "db6d70f6-775f-4bd4-8ff8-876eb7082a28", "comment": "Malware payload", "value": "4db04970cc07c7ddbb8544b639c5cd0be316f13818c263baeaa169169e137c32", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593307, "uuid": "728b30f5-c61f-43c5-bbd8-fd6f39646b54", "comment": "Malware payload", "value": "49ff551a20a1258283b45c1ea30dbd0807ab50e9", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593307, "uuid": "a72832f6-4875-4ddc-a957-dda4ec063cdf", "comment": "Malware payload", "value": "54f80e77f9bb83a0c89e2e5b9cce8fe587f0511eeba0b77a94dde62f41d57fdca37e93fb3b79e16991cc063b6eed3924", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593307, "uuid": "65464663-4116-4e64-b97a-b0398ed223e8", "value": "T12DF0A241D4ADFEB655C3B2B65CDFD890F135128717B4975A2120E014D03A3F8D5EE583", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593307, "uuid": "1ec089a8-6c93-4ec6-b696-906dc1f4f97f", "value": "12:ic8JHmqWDFp1EaFgd3pm9iV5R9Gg2IIxmZ9y5HeV6/Io4io6R9GgGqUikn:ihN4P6o2EUMg2IIxmZcb/ZoeMgGNik", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593307, "uuid": "16e87ad6-2575-4e31-9024-53f84085bd64", "value": 637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593307, "uuid": "380b40e8-4d88-4894-aa4a-f3ff6ceb94ac", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593307, "uuid": "4494e037-233d-4528-9ae0-8e3bba4deaa1", "value": "ASOHD-349.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c82b23ec-278e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633625473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633625473, "uuid": "af970eeb-40a4-48f7-bd00-79708e5c19d4", "comment": "Malware payload (Formbook)", "value": "7728a2ffa228bb64178f05aac148f0f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633625473, "uuid": "13d86617-466c-405a-b562-2bb27d738a80", "comment": "Malware payload (Formbook)", "value": "4e7de7114cb5947cee9d0f5fa60f4ad2be8db68364a4f8f4b1a6ca4f5fe1a4ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633625473, "uuid": "5fc13729-6b8d-4913-8830-8eb0eee90f0c", "comment": "Malware payload (Formbook)", "value": "76e1d21baa9cf2fa10118ad562b04ae1574acd0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633625473, "uuid": "dd6e77b0-9aee-4751-8195-cc2aed04256a", "comment": "Malware payload (Formbook)", "value": "77296cbddb0d90b08c15fb3af9006cd411f1d96cd43cc29a694891659f838eeae40f5b0fa1a82a059dc706c0d45d3ee2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633625473, "uuid": "47152669-4246-481c-8a63-a21b2eb2d307", "value": "T17625E5002295C612D1B637F4D864CAF097656C15DA29C28B2DF1BEEF79B1B03CE11A9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633625473, "uuid": "2d45a19a-8106-4bc4-bfb0-617b2d5ab25e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633625473, "uuid": "6b7d4b93-869e-4ef0-baf8-c0b69d5613f8", "value": "12288:6zwA0ywDyL9pD3n+0SMmNpJ5ivmgGpoXAWboJJa:Hj+L7D3+1JrzVgqozoJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633625473, "uuid": "0423d713-3195-4f12-ac91-0de7ccdbbf5c", "value": 1034240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633625473, "uuid": "82f32d2a-0d20-431a-b33a-ee566d2eba74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633625473, "uuid": "ad160d01-e92d-41ab-8480-b8fad1723c35", "value": "PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "364e86b2-273a-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633589151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589151, "uuid": "c272ef92-0a46-4d3e-8afb-a4f1928e6780", "comment": "Malware payload (AsyncRAT)", "value": "81e224bf7c429777f84461481bd52c48", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589151, "uuid": "e13a8e72-62af-4658-ae5d-7654e44e6081", "comment": "Malware payload (AsyncRAT)", "value": "4e8ce92e94e6ced4686d49be73242ed24dd21e5ed74abd16112a92fd34e5ad73", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589151, "uuid": "f132d316-7501-45a3-bcdc-e09a8adb3db3", "comment": "Malware payload (AsyncRAT)", "value": "3935f84074c90b4a06800908c0d8c971098b0178", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589151, "uuid": "3dea33b9-8e3c-427f-8a0c-cd1bec615824", "comment": "Malware payload (AsyncRAT)", "value": "e9c904cfe813752d7099632e95523d303989be118b3f5eb071c509218e000162cc29aa7121823cd14495ac1dd033751d", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589151, "uuid": "90b740ef-cad6-47f7-ac89-8f4998b2435a", "value": "T17EC1E8A0D88DD4C73961B07A43D84AA900B8F3F8D4EC90E07249B8DF6CBD2B058BD341", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589151, "uuid": "0d86f77a-2009-4c7f-9d15-dfd979b88352", "value": "48:3TTTTTTTTTjwklMKMoaYNTTTTTTTTTjwklMKMoaYO:nwwMZoJwwMZoi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633589151, "uuid": "ab747328-544f-4fbc-ad83-336c791a2d87", "value": 5983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633589151, "uuid": "dddb79bf-62cf-411a-9861-cab641738286", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589151, "uuid": "9c08ca14-cda8-427b-950e-9ef4e85c4191", "value": "(10.06.2021)QKFP.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6edffe6-274a-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633596319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596319, "uuid": "9ffcb216-d6ea-4471-a1de-624321aa39e6", "comment": "Malware payload (DanaBot)", "value": "78391595051713f6523738076f126c57", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596319, "uuid": "baada73c-fbba-4d14-9665-96981812628d", "comment": "Malware payload (DanaBot)", "value": "4f4432ad4cc8c5d43dd2fe135717bdd65f417f91ada36cee4ae8f9af0269f8cb", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596319, "uuid": "c55c64f6-22f6-4b24-a6eb-67dac6003cc4", "comment": "Malware payload (DanaBot)", "value": "1d363bddbb05391fdbfe12b76acbb67484046121", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596319, "uuid": "c820a390-6c63-4d05-aade-8a1e78b31aa1", "comment": "Malware payload (DanaBot)", "value": "f8a40b7f3c27560394eac75e04b21fed1e77eabf340b50aabdb1b227b7e6b6d312bca8fb2a8b194e58cf794d63a08012", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596319, "uuid": "0c9d91af-dabe-4cb7-a005-8402b8f41bb9", "value": "T10935223123D6C472F7A7257484B9CFB1962ABC253331949E2BB1663F4F609F29629307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596319, "uuid": "e8b5d9a6-1c35-43da-a8df-7225af9aa5a4", "value": "51f224c09b57224d474ba4b21025bdd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596319, "uuid": "c82a3c8b-711c-46b2-a752-67234f09111f", "value": "24576:Rmqx0dgzbrzKNJM+TeN6F57KmKHvfWzqGtYGou1zypS:RmO02HrzKNOUeN6F5Om5tTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633596319, "uuid": "8fe3b9fd-6190-4fcb-ba89-0065760d8f6a", "value": 1147392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633596319, "uuid": "64329204-6260-4e09-a41f-a32b571ad1fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596319, "uuid": "f731e2f1-955e-4c9e-9f30-6e7409d401d4", "value": "78391595051713f6523738076f126c57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71517de6-274c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633596981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596981, "uuid": "54026d95-dcc1-4288-bfb6-34e037052eef", "comment": "Malware payload", "value": "e3508a5f458f1219f87bdc394f96d4a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596981, "uuid": "bbf040ec-5afb-46ca-8296-19bf75b1f87f", "comment": "Malware payload", "value": "50ccb883b39751571bff554a298fc635f917ed6357097ce43fc239129325e974", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596981, "uuid": "3b1c4d94-ea8b-46d9-a402-bd918f9e4883", "comment": "Malware payload", "value": "14abd368e0c32ffa5444a472131062db92599b73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596981, "uuid": "409416fd-014b-4444-8e1a-0be7bcac68bb", "comment": "Malware payload", "value": "28ec8004c8b30064baf0fc139767608a3b13e0996899887bdd64ca9ae7d8060f8f53539a833d4c0ca6913936c62ee261", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596981, "uuid": "e1878c5d-8bfb-4a20-a408-4336824d0c3c", "value": "T117F2F9A032AD7F82E93C93FC0111608557F4643B56B2EB974ED2B1E72D66F900B15E8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596981, "uuid": "cc64f93a-e0b6-4618-bd78-baad1590dbf2", "value": "768:2JQOKAhHV5v3b8uJJkJKVb9ewyQn27r5Gdu5+WeiCwzHQN1mI:2QOhh1d3bZJs7r56u5+vN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633596981, "uuid": "f03c69c2-8116-4f65-9c5b-c61c35a97c60", "value": 35870, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633596981, "uuid": "004a0c8d-63d6-4451-8698-1aaf5915efa5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596981, "uuid": "dc6a4b78-6904-46df-9d0a-cfa0ab4f3e12", "value": "e3508a5f458f1219f87bdc394f96d4a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd215f5d-2740-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633592061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592061, "uuid": "9f5250ad-a7e8-4301-8495-a64f95d62e06", "comment": "Malware payload", "value": "a74425bd7d5f30841f8cf5f937702012", "object_relation": "md5", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592061, "uuid": "924bdc19-df41-4dd2-9c76-fb01ba6bf8fc", "comment": "Malware payload", "value": "51165bb63cab72dfb0abf8932136dc587b3d358ee9614e45adf2695df5fb5510", "object_relation": "sha256", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592061, "uuid": "0badd559-fa36-48fd-80d6-6e8fd86827a9", "comment": "Malware payload", "value": "cdf3fc550d552e66863a329c58e64e899852b9cf", "object_relation": "sha1", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592061, "uuid": "784e1218-4d20-45c0-88af-4df6cffd3c26", "comment": "Malware payload", "value": "67d582b5d9a982dc76078fbdde5a2cf998433d559bfdb53910455f9cc18ee511b91aa29bd96055592647f734ba61f462", "object_relation": "sha3-384", "Tag": [ { "name": "Maersk", "colour": "#38D08C", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592061, "uuid": "91e74702-1f0e-4f79-9481-8d8c806ea481", "value": "T1B7B3F12A3BA28DA7F7D144BF07A3D5E512AFDE061A18BD1F9C213719D430122ABEC517", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592061, "uuid": "81cba7f8-cb79-4b46-8d05-6716e8037062", "value": "1536:/F86/AT2YmiUXEf97nAEUA3UHRfAN7Z4/rfjKfbLc8p9j07Wv6Q4kd2pDRYfkBSx:/FoT2pMftZUHRoR7DLh34kd2pls2/kj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633592061, "uuid": "2ee2cdd1-6885-4046-987b-3132d35d1584", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633592061, "uuid": "11913e60-4d67-46c4-90e1-37c8f1e5ed56", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592061, "uuid": "b69c0a2b-c1ac-4476-bac1-e53360eabda4", "value": "MAERSK-INV.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d648d6-2742-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633592886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592886, "uuid": "3cfa1184-7584-4457-b0ab-a722fc2a7fe1", "comment": "Malware payload (RemcosRAT)", "value": "b1ad507bbeb4907e22b06b9ac816fd0e", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592886, "uuid": "dc673f9f-8241-4fb6-a39e-2f5ac53e2cf2", "comment": "Malware payload (RemcosRAT)", "value": "530ab3dafbfdcbd3592979a64bc4cc57bfefa82b9fe961024372ae6d7a53341c", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592886, "uuid": "de3fb016-321a-4b28-95c9-40436b4ac952", "comment": "Malware payload (RemcosRAT)", "value": "f27bccc3d9ca45bc8de5643aa7ca94175863abaa", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592886, "uuid": "602afc15-cb60-4367-b8c5-f8b65b6845a3", "comment": "Malware payload (RemcosRAT)", "value": "3d4cfd8e428ad761264005ca9c63ce00a408ce3f0825dd3b3484908f306850963185b08975d7cbc8c5072868159eeb9a", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592886, "uuid": "9b9a6d86-9b11-4d8a-9769-d6c18d8de906", "value": "T17B157E67B2D44B36C26F35307D4FA148A42BBE626E1895C33BF51F4A7A38306721D52B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592886, "uuid": "9a9acb9d-b7df-40aa-8e8b-bd79fcbd20a7", "value": "a75c37244e3bdfe1f2052f7c93d03b4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592886, "uuid": "1b49ad24-dfef-431f-9fc8-379759b75b64", "value": "24576:nWv+QwSKgQ0qgQDKqOTLDE4btJlzNgojDGBav:WmWKgNxLQ4HRNRG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633592886, "uuid": "89f152b6-e239-4d84-8eb1-58a8c7d91cf0", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633592886, "uuid": "7e510706-bf02-44a9-ae99-5ad0c832c0cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592886, "uuid": "961369fb-db7c-431e-ac33-d697e3fe3324", "value": "confirmaci\u00f3n bancaria,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3e8083-278c-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1633624510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624510, "uuid": "8042c559-fe71-49ad-aec9-31531c303067", "comment": "Malware payload (Vjw0rm)", "value": "fd18077eddfff5bb1d86e8f0de281d6d", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624510, "uuid": "70905395-08f9-4b82-bff1-ae666653c304", "comment": "Malware payload (Vjw0rm)", "value": "53838e5cc5aed0da2d6f91ab858a442e3e1760aef0cc333ba69e9610993e9ce3", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624510, "uuid": "8d9ed6f7-afbd-4041-8909-00d435524209", "comment": "Malware payload (Vjw0rm)", "value": "1a415d1c8263b8de8eb9352f4855dead687ce7fa", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624510, "uuid": "91c9c5f1-d572-44ba-bc04-87e82c8f6ff4", "comment": "Malware payload (Vjw0rm)", "value": "f33f4bed2da60607832bc0bc62dc7a70cb8c46ed5210300406fd7004df8b62e7184a5a0a51e5955eec93caab6974cca1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624510, "uuid": "1d91d3f7-49fd-470b-b59b-f7c30cadcff4", "value": "T1898380039E401D47B5B5D693C0980724CD14A2F4CF6AAB5ADCB149CC9EEF2476787EE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624510, "uuid": "8434ec67-b710-4315-ac26-e1923c953e44", "value": "384:wvnPo1AYT7BAZZG/dAurJd+b3/g/W/2/Q//6/N3p/wykGawUAn:/BdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633624510, "uuid": "8be7922a-0242-4b87-851c-518eb35bbe5c", "value": 83710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633624510, "uuid": "8d1a9729-4d6e-4d34-92e5-7a0b50454c0a", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624510, "uuid": "f7d06297-4d15-477e-9e1b-126d06091afc", "value": "I1B26A8C6D5Z.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d385f42f-2744-11ec-843c-42010a9c0014", "comment": "Malware payload (OskiStealer)", "timestamp": 1633593710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593710, "uuid": "898be3c6-6de4-4fa6-a5cf-970069945331", "comment": "Malware payload (OskiStealer)", "value": "c50f443bc0d2a89945437142027f69d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593710, "uuid": "d126950e-47e1-4c67-9c9d-6bf2d60ff3b7", "comment": "Malware payload (OskiStealer)", "value": "5490a5cc380603d9f186201100008c79c6c32cd898cb963feffc5290521a9f3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593710, "uuid": "12a22fde-70d2-4bf5-a0b7-2e7f4206e913", "comment": "Malware payload (OskiStealer)", "value": "b65379da8936230bf8fd5eee477673364c749216", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593710, "uuid": "17d4fcfd-7650-40e4-8816-7194d1fc4f7b", "comment": "Malware payload (OskiStealer)", "value": "21902759836608b9ba5cc125972ba5b32bdeb79adcbd6835d0b8311ed79426e04967f6a0ae6358ee009a0b564a35f05e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593710, "uuid": "dd66ca89-298a-46aa-9419-244d5573d68d", "value": "T1CC94018523A78708CD7883F52819AB611375E016211ED77C6ED8E1FC7EA77B98AD0287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593710, "uuid": "5e2ccfb0-5056-4d4d-9b4c-21fd92709222", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593710, "uuid": "fd849843-1804-496e-a1b7-0306cbaddb73", "value": "6144:qgELX+ZzDQ+3HwODw2ZNMfsON7RQGFQDSJh128WGfBu9x2Wat95rwSp5Fj6ivVya:qgFkoHMf5N7RQd+28W4hWmrwWx9tx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593710, "uuid": "01abf5c4-d08c-448b-9fa8-3144383d9e4f", "value": 434688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593710, "uuid": "757ca4ab-a5ab-4dc6-aead-5b69b82fede5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593710, "uuid": "7c4174e3-22bb-4522-ad73-46fb00e20375", "value": "c50f443bc0d2a89945437142027f69d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17be9eb3-271c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633576215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576215, "uuid": "c9c0fe6b-ecdc-4aa8-8974-f21fb2920948", "comment": "Malware payload (Mirai)", "value": "0ba096921053920418569ddac295f7ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576215, "uuid": "43691e96-0dff-4521-9ffb-33d035c6150f", "comment": "Malware payload (Mirai)", "value": "54cd4dee5528b2b89178a10f9b467f23b0f53e44bf175ba0a40deba61a904f5f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576215, "uuid": "60245fdc-d1b2-40a4-8537-020e310d6c79", "comment": "Malware payload (Mirai)", "value": "98e3fa3ee3a91c29f3c807497d6c1ac1b4d979f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576215, "uuid": "23522422-e3a8-4edd-83ea-10e07d6695cb", "comment": "Malware payload (Mirai)", "value": "ae930fe26e40f368fb5cecd9a8a632a0782904519a20696c0bee1bdb74d2c80a7c5b0e184ec2837c89ad59ca21f73e61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576215, "uuid": "7599a2d5-275c-4b4d-9d34-7f9fb7d48e6d", "value": "T1B4C3223E7E21AF7EE278823107F66F70C35929D636A18344E16CF6485E7528C189F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576215, "uuid": "8ea3dfde-2e82-4da6-82de-0b9e4414ba9f", "value": "1536:dcjrzNw7l53+fw8rgf9Pq42rKHpOBY2cACMxKOiVg9DAaTDOpULGiVgemfWsb+y1:AAXtA2VgVAaTQULGiV+dSy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633576215, "uuid": "15d62353-266c-4013-8adf-b9b88bff607b", "value": 129688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633576215, "uuid": "abada484-bbc9-458b-a0df-e84818ac85f6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576215, "uuid": "1ea62aa9-bcdd-462c-8469-e78a3328fbfd", "value": "0ba096921053920418569ddac295f7ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f7236a-2743-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633593175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593175, "uuid": "bcb9df07-a7b1-481f-aeb4-407fb0486cc6", "comment": "Malware payload", "value": "0835b76bc943996b6312cbf2d4f135fe", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593175, "uuid": "d95351fc-be2a-4433-b8b8-0d3aaffceb2b", "comment": "Malware payload", "value": "54ee29a4bb928bd01accb7bd225cc328d5ea3ff99ca724f27983f8c0992ea8e8", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593175, "uuid": "cc253ecb-581d-4289-afcd-f9fb9a16b593", "comment": "Malware payload", "value": "54d33de0584afb31765f6262fac0d27d7bb6e665", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593175, "uuid": "b36d4056-5c8a-45ed-a57c-575bb4a214dc", "comment": "Malware payload", "value": "669f9ac48dd818f93c40f3649079c7ec783601f1ebe0872fd979dbabde652749f450ea65aa1e54c47ce2e00d9b4ef5c1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593175, "uuid": "c9de3ee6-e155-4e02-b1ea-3c179d2aa732", "value": "T139B58E23B3C28537D0772A3C8D6BA799A529BE111D3C584B3FE41E4C1F396417E2929B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593175, "uuid": "4c5510fe-f2e1-49e5-b413-cf74b819f927", "value": "49152:+NFqVntn6W0jUzH+aULGxqKOqzi1Koj+kd+TPkwOYLEA:Uqb6W0EH+BXKOqHHOYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593175, "uuid": "eb4f52fd-c0fb-410b-b486-5118d9c2ec22", "value": 2334720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593175, "uuid": "642e34f9-c045-4448-8c5a-0bb3bc023023", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593175, "uuid": "8ab2a432-06b3-4f19-b9b1-9a46b76e4afb", "value": "factura - zpyhgnjyzjmcmxuniehx.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbf5b0d-2743-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633593321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593321, "uuid": "274cfc88-7e0e-4151-8866-b99736589013", "comment": "Malware payload", "value": "a3c505c597f67b45c57351ffb512a4a1", "object_relation": "md5", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593321, "uuid": "8e0f944d-06da-4f1e-a9c0-2595b63acb61", "comment": "Malware payload", "value": "5530a4873f9ad8ff46c03a0b4c7b82df5c5418b65eb4af3ce1fd461577667c42", "object_relation": "sha256", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593321, "uuid": "3c27bdc1-5c5c-4ea9-9e11-b3b927d20e47", "comment": "Malware payload", "value": "1528e4da520d504d37cbd3e4447dc2e0a0166558", "object_relation": "sha1", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593321, "uuid": "118f2e36-05b9-473d-bf49-1a9156db2e64", "comment": "Malware payload", "value": "88e1532f5fbde6a1567ae63c89cffab7cf45223ab79974ac05486394fd100f48824a3ec2614d9b4ce02a1fe929c9f811", "object_relation": "sha3-384", "Tag": [ { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593321, "uuid": "d7ee788a-b718-46ec-9c0a-a752d6aa1afe", "value": "T1F1F0A245D59DEAB64583B1578DEBCC81F53822C70370975A6120D120C47A3FAC49D1C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593321, "uuid": "0a29ce8b-b1a3-4a7c-8d9c-f67d99150eb2", "value": "12:6HJPmM0wXc+KYJRgd3pm9iV5R9Gg2IIxmZ9y5H/PV6/QJoRo6R9GgFIv:6H1pcfYJR2EUMg2IIxmZcu/QJoRoeMge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593321, "uuid": "1cd3bafd-137d-4b6b-85f2-c683f0c221be", "value": 637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593321, "uuid": "f3e873ec-10aa-4784-91bb-db6b3d517c23", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593321, "uuid": "4fdd5062-699f-4bac-bae3-13bbfc396b8d", "value": "ABEYZ-538.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41981690-2763-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633606779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633606779, "uuid": "fcb8c183-2192-4643-a2e3-f7e75325968c", "comment": "Malware payload (AgentTesla)", "value": "00799202d62f4202abc8c76d7725b433", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633606779, "uuid": "f0c5e6dd-1e8a-4d33-9c94-50cef481ad76", "comment": "Malware payload (AgentTesla)", "value": "559e85d6d60217e60eb211ae309c25ad13b23d0160b849a1b8638fcfc9e8bef8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633606779, "uuid": "007fd873-fcd9-4de5-bee1-af9ad7ff6032", "comment": "Malware payload (AgentTesla)", "value": "abc53a54935eb7847fc8d7d431ea1c98f76a07be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633606779, "uuid": "fae07eb3-2a42-43df-bc92-fe4d132b7262", "comment": "Malware payload (AgentTesla)", "value": "7ee232ca990eed5b55570803588f01ec79fb931b135c4e8fc186405ab8d2a4d6ced812ef14091700b23da9567e50f249", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633606779, "uuid": "ad7b3927-4770-4e91-abe2-87f1791a41f9", "value": "T1CB940294237B9708CD754BF43C10ABA12775A026116EC7741BE8F4FD6E63BB88AE0257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633606779, "uuid": "9fcc2d61-36f5-48cd-af12-fc13454b6ced", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633606779, "uuid": "655823ab-1ae6-499b-808c-132d03f4f99e", "value": "12288:xkofG4z1/WA8w0/x8S3AZtVVVja9S+yMv:xkH01pExxqtVV84Mv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633606779, "uuid": "8e9eafc0-2e8b-4646-997a-a45b0cdc9ac6", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633606779, "uuid": "a1d637eb-f118-4a64-8530-71a663b3a320", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633606779, "uuid": "c7ff863d-b199-41ae-9bdc-5468111219a8", "value": "Scan01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf229d0-275e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633604570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633604570, "uuid": "26ad3085-9d98-4b32-bac8-d2c9fdf64c8d", "comment": "Malware payload", "value": "003fe2caa607d38d3434be33898f4001", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633604570, "uuid": "0290c6a6-2461-4c4b-a853-4bc44ae19185", "comment": "Malware payload", "value": "5642429f8f0552d9fde57b846a9cafe2df03422720d92347dd312eb342234b4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633604570, "uuid": "1076116d-24b0-4ffd-8c26-b1036a2660bd", "comment": "Malware payload", "value": "8fee99ef975afe8228d3eeca9b92b2b0877ed372", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633604570, "uuid": "328b7694-d319-44b6-b3d9-fc62be35c07e", "comment": "Malware payload", "value": "885f9bd04d67499d45950cb5cf40915d11e58b1c0c2673fffb063abb705910f0ada641cfd1c7c3dc49c1e3ae06ff6ddb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633604570, "uuid": "1edfb55e-0511-462b-ab5b-5262bfcf4e61", "value": "T1131441D7666AC927E4B3BA7139C8D5AAF9DD1B1177C8FC320048031B853168CCEAF569", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633604570, "uuid": "4eaf2f53-762a-4930-83e9-9a102eeb0154", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633604570, "uuid": "4622ceba-ae5e-4bfa-b34c-556bcfd6fe14", "value": "1536:WLlOHezlbOBgHUMd9e4t8jZ7OJW52X+ggqu1rGMUYwLv5XfHtqK3BRNLfCf8hk+Q:W5ewS20r+uTGMUlLegBbkn2jC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633604570, "uuid": "f2d9cd0c-40cc-4774-9f2b-e0831de612fc", "value": 202240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633604570, "uuid": "88756259-e511-485c-a429-4f35805cfa96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633604570, "uuid": "81e62de4-3054-4da2-88ff-a42dc758a11b", "value": "003fe2caa607d38d3434be33898f4001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d8a282a-2732-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633585781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633585781, "uuid": "2bb6eb8c-3024-4e61-baab-5ebc3fcbc4d1", "comment": "Malware payload (AgentTesla)", "value": "6c20e4b64600d5d4e57289ae5efc8317", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633585781, "uuid": "b170dff9-42d7-474e-ab6e-955481d2c867", "comment": "Malware payload (AgentTesla)", "value": "5726f65c0441a3c7576266fb788303a28282dea65462343fdf48b6fc31c7657e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633585781, "uuid": "c3aeddf0-8790-4e9b-a790-8665f621284f", "comment": "Malware payload (AgentTesla)", "value": "42795aaf2d77d7758053908f288162638b9b5efd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633585781, "uuid": "633374d7-d5eb-49a0-9a05-69732c92b801", "comment": "Malware payload (AgentTesla)", "value": "989cb0680ddd6544c5b9eb3ec3012ff062c9b22869a36bc093b098468c70d33f0eda9990e4df8cc6b8447877b8a63180", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633585781, "uuid": "d1780243-2fca-4662-9614-95e55e4b43a4", "value": "T11B45D85363AC8DC4C0A792B4DFC1C4B96C19D9EE421A53B4AB12AB64F75FC031E6A473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633585781, "uuid": "b48e70f6-3253-42a0-9182-b7213be31a40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633585781, "uuid": "25c1b60a-469c-4a80-96e8-6bac804eb410", "value": "12288:+MUF5CTTJzqQ9xeDx7F2itLVBJuOm1CZJTqWE41Ubw:DU6TTJzdeDxvBMOm1qqNZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633585781, "uuid": "89e9dee1-b98e-4fe1-a742-b73546a26ff2", "value": 1207808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633585781, "uuid": "63c1ea0c-30b2-4a3c-ab69-7132f2b43e99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633585781, "uuid": "039ce0bf-55ca-407e-acd1-fdfbb3f79148", "value": "AUG_Statement of Account.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae95d3c0-2724-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633579904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579904, "uuid": "64ad8c2c-55d4-4966-9008-f0ea16a92618", "comment": "Malware payload (Gafgyt)", "value": "2844ed65b81f8f964c6a58ffe475f94a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579904, "uuid": "e14da766-ed7b-4428-a5b5-e7d1508bdcd6", "comment": "Malware payload (Gafgyt)", "value": "5762b4db861d5276b3924c0a51273b38f6a204a461cbc5b61da313c55d1c0184", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579904, "uuid": "bac558d5-36e5-45c0-b47e-ebe720c3ff85", "comment": "Malware payload (Gafgyt)", "value": "0b90e8dd521f5f7c12f8aeff5538ea05885b31cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579904, "uuid": "c9936a27-b141-46ce-ba36-d80e4a8a2c4a", "comment": "Malware payload (Gafgyt)", "value": "cedd65cd3019654190e1a95cfec2e2802e0529eacbc3916bc9a8c8ad7095d12fa5d6ad2b2ef036a437853112ff1531fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633579904, "uuid": "f1c288e4-1c24-43e8-b1bf-b904d8225aa2", "value": "T113734A43A9A58FB7C0476EB566E74A300B13B8616F1B1B89712CA9F4034B9CDF81F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633579904, "uuid": "a7801d77-6623-436f-bb3d-5f082fb273ba", "value": "1536:DTja1haMKIc+AqLnmxxKH4RCmKezj+mj9VqYLe8f26e:fe1haTILLnARRP2mj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633579904, "uuid": "d95083ee-64d5-4e91-9a8a-aac41e9662af", "value": 76905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633579904, "uuid": "7d22524a-95d1-4dba-ada7-5a8de6071d9b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633579904, "uuid": "77a9283e-e943-4c1a-ab6a-05ccc6e2e86c", "value": "2844ed65b81f8f964c6a58ffe475f94a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee61034-27a5-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633635336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635336, "uuid": "d22e3a98-ba97-4bd0-b93c-7d05ad4fdc0a", "comment": "Malware payload (Loki)", "value": "6e787e77d0c5edb045f0e97945a7af82", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635336, "uuid": "d06582a6-83dd-4260-943b-e1c15e8e0b04", "comment": "Malware payload (Loki)", "value": "5782ad3b09b191b0f06273cf23021c32207986760dd36d2d8c7da83bcd1778a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635336, "uuid": "c68c9baf-1980-44d1-8e74-d7bacd14a3a2", "comment": "Malware payload (Loki)", "value": "553b5ed8e82311e8a6791945dbc98ec735439189", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635336, "uuid": "dbddfa07-4b0c-462f-8c52-81a419458a9f", "comment": "Malware payload (Loki)", "value": "2261fd0dd579c328612b04fb46cae81303d2cbe454bd518ab07474b1416cda86068ae744170ddffad6eaca3d91ca219c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635336, "uuid": "c1b9a160-3eab-46e6-84a9-5def423c0571", "value": "T193E42918E3CCD65BC82D0E3A4A3F5B4B43F1E9DF7274EA9620CC5BD23706A526D8A541", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635336, "uuid": "4f662921-dc77-49fb-bad8-21c1df12c1bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635336, "uuid": "b5e67d0a-4d13-40a6-9cd5-b463c5f80a41", "value": "12288:oqb9CSvBdLF74EZvH2T6ZVCFerceeJVM9y2Do:jBdLFM8H86ZAIXP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633635336, "uuid": "69cf1cd6-157d-422a-b269-8c24e47305f3", "value": 685568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633635336, "uuid": "6e2d399e-9872-4368-8433-14cb670f2328", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635336, "uuid": "a976fc65-acd8-4a3e-9cf9-8eb961992a8f", "value": "SH_07391564.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf2b936-2726-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633580705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580705, "uuid": "862f3a71-7e43-4aba-8c2d-b5522394ff09", "comment": "Malware payload (Gafgyt)", "value": "6c7bb5cc59b6bb411e62cef799146270", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580705, "uuid": "c4c2ca30-8e58-4a39-a814-8940145be62a", "comment": "Malware payload (Gafgyt)", "value": "590015189d40c37a1994b0d6b6481e0b65fc72722197f6985242bb78c060debe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580705, "uuid": "a0437b4d-3859-4fc4-ab18-a426ad57054c", "comment": "Malware payload (Gafgyt)", "value": "bebec51bc31b72f5cf7dcfaed280df5c58a885c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580705, "uuid": "9dafa115-dc7e-495b-85ec-6e744f95e640", "comment": "Malware payload (Gafgyt)", "value": "fda8835b78a41950fab2256685b54b8d009d5a575d145dae8e336c1003c801e7f48060a577f259ae0317d91e93521e78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580705, "uuid": "3520d5cb-5030-4854-bf8c-cd50b2e7954c", "value": "T1E6D3C71B6B608FB3D81FDD3706DA460220CDE55A16E87B6BB6B4C95CE74A84F08E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580705, "uuid": "83391145-c27f-4ddb-aa21-6bd0ba6494d0", "value": "1536:cE4jeT9sePyuFieWhyfZTiqkWbnbvmo7CrYZ15hGHO7iXUnNF3xuhmqY1fqjBmvm:cdeYheZbm+J15hGH0F3xemqY1fuBmvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633580705, "uuid": "e35b070e-805b-4c74-a2f5-c02769543603", "value": 137917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633580705, "uuid": "75945fe8-a525-4764-8795-e85d5815ef36", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580705, "uuid": "fa31bdac-0573-4e5a-ac03-60ba4bdd7531", "value": "6c7bb5cc59b6bb411e62cef799146270", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167cfbb5-27b7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633642785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633642785, "uuid": "46ed93d7-39e9-4322-b8a2-938b29f99a4f", "comment": "Malware payload", "value": "bb5b3ca8658a2f79c23c326025d1f358", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633642785, "uuid": "39c1f4ab-a337-49c6-b5e8-89b1eef1d30c", "comment": "Malware payload", "value": "5905da6b8ae4bd7cd8cbc7b3cd90dbc03add62c5fe41858d2646287d5007b8b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633642785, "uuid": "fd1f42f8-87de-499d-aafe-546bed8cbea1", "comment": "Malware payload", "value": "0883bf303e9bac9a4c84c58d6be9f83149333358", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633642785, "uuid": "d35872a5-08a4-4421-aa9f-8c396cb24194", "comment": "Malware payload", "value": "cd97a239be02ea679e7a8f45ced9d6aee0fcc298e59682bf8d14439c8779e2a0c842ebe4be6086d61915d2cbf7155877", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633642785, "uuid": "3904c4aa-427f-4b55-9fb6-e6ec4244df0d", "value": "T1FC73A540B2858B53D53D7C7E12923A4853F365E67E26E7262F9D85EA6082EC74F0D20E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633642785, "uuid": "434992d6-0c65-479f-b0b1-ba336db502ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633642785, "uuid": "99ce9b03-f600-496e-bf2f-4bcbc4662857", "value": "1536:bkfhgDr7lG6aOAxBdfaeTTtftN+70pKXQls:blffZkfaevtVN+70pKXQls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633642785, "uuid": "9c22e777-4670-4a4c-a97e-507aefef8f9c", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633642785, "uuid": "a7e182cd-1ea6-443c-b623-a7b1b84294ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633642785, "uuid": "91dcb6a5-7ab6-4d89-8b20-d450f853056f", "value": "bb5b3ca8658a2f79c23c326025d1f358", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17838961-273a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633589099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589099, "uuid": "c898a7e1-b512-4a8b-91c7-0357214a9df9", "comment": "Malware payload (SnakeKeylogger)", "value": "44b92b41c540ad2587ed41f117118987", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589099, "uuid": "80d43a0c-ad17-46d7-812b-8d4c62acf849", "comment": "Malware payload (SnakeKeylogger)", "value": "591c4b1b79229112cd960b877907a6fa5e48372b54aed771560d18b13459f93f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589099, "uuid": "a20c8110-a0e3-4771-a301-29f4e73e76b9", "comment": "Malware payload (SnakeKeylogger)", "value": "ba4ce7aed76641851a1ca7a8009154146275f64f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589099, "uuid": "da2b8316-2726-4396-af9a-46594896a2d5", "comment": "Malware payload (SnakeKeylogger)", "value": "a9d5fd8d7beda12d4430f5496a598cc7bd4dc07ce5f4bc291588d3ba9650b3814ede3946af9b40672c6a8da0d76ee8ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589099, "uuid": "d2568870-3db6-4a98-bcc0-0d240916de36", "value": "T11274222726D09EFAD0838734896D667AF73297522D69150F43B0AE2A3C15E09DD3E2D2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589099, "uuid": "f9667ad2-c6eb-4ac0-9c19-1c991c62bb20", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589099, "uuid": "356d9da3-5f65-4b64-8892-edb3fc7cda78", "value": "6144:F8LxBsrQo+901Xd4mQsFydL2cJBgACxaUmlvdHR9+MQy3KSEsDrfBIMzaGsHRYA:/Mv01Xd4wFILn3gHDmF39+/FBGTBQaA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633589099, "uuid": "3662bb3f-bc30-44c8-a380-ef6067b95471", "value": 360566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633589099, "uuid": "d820ac70-e2ae-4656-9a38-89973734a2d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589099, "uuid": "38396679-a4ea-4415-97b3-ce03e90c4ffa", "value": "Constructora PO021-009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba9a21c-27b5-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633641961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633641961, "uuid": "73d45ddc-72c2-41b4-a2ac-600056d6af4e", "comment": "Malware payload", "value": "c241b933feb0df373ff34dafece3027b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633641961, "uuid": "61c6acc9-d2a1-4b25-951e-17e1798df363", "comment": "Malware payload", "value": "598d92785eba31810ee8c1e55d74f7973f9e81b9f8781d2f2289a3c90607d634", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633641961, "uuid": "501507f2-3b00-41a4-a482-ff2b9618f214", "comment": "Malware payload", "value": "be5daeb6f657ae8898b6a7643f8a2568d410823c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633641961, "uuid": "f6d8a017-bcbc-4701-b1ba-03dfb17f5a62", "comment": "Malware payload", "value": "9063404ae06228b0c7c2b03884754f0170002b36ca8ef2de196011ce23f68ae7ed9df7037226568e067230c963699957", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633641961, "uuid": "f5a700c0-bfca-4924-be64-1a3e99a09fd2", "value": "T151263387428320EDDD169373BB16E55F92D82D394F25AEE8492F3336F4B11E74214E62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633641961, "uuid": "8103d48b-1dbc-499b-ac1f-2ba6b16a2a6f", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633641961, "uuid": "b1d0a6c3-98bf-4b35-9a27-5d57bae23c25", "value": "98304:jd9aKYG0NAnk2j49Ys83DZZOSIBtf6aUAHkUlYHQBNHd/7oB7V:j6K6mYo3DZZLCB6aUBHUNdoB7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633641961, "uuid": "a8c14c5f-6ef4-49bc-9b63-b9d7c5617e0e", "value": 4616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633641961, "uuid": "3f93b8ae-349c-4921-a26c-44adc1f383df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633641961, "uuid": "ad62d6a6-dfe8-43e4-8a87-c2a8bcfc1ac0", "value": "c241b933feb0df373ff34dafece3027b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e571629-2788-11ec-843c-42010a9c0014", "comment": "Malware payload (Lu0Bot)", "timestamp": 1633622773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622773, "uuid": "a7905501-10fb-4185-af0b-a663e95b6110", "comment": "Malware payload (Lu0Bot)", "value": "cd17d11bb2c8dd9942e816677df2dae2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622773, "uuid": "72efcce1-e5d4-4c13-9781-15f7a6168871", "comment": "Malware payload (Lu0Bot)", "value": "5a2264e42206d968cbcfff583853a0e0d4250f078a5e59b77b8def16a6902e3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622773, "uuid": "d7533c67-c8db-4f89-a0cd-fda5ff451a2c", "comment": "Malware payload (Lu0Bot)", "value": "140fbc4ec7fd4be8c66dd38d6836473726fa7c1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622773, "uuid": "cb5c7dc0-cfb2-4498-89fe-1f5a59799d51", "comment": "Malware payload (Lu0Bot)", "value": "aa23ee66843764195ce1bcc8e1a5e75ed68a1b6d92026be84949e4b49d457c5c6f08d3d3e6e7182bea3fea50cccd423e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622773, "uuid": "798efa13-1756-4d97-b4eb-ca5e59994d61", "value": "T18A5176EBD2916C67C43F69750A0B9480F329C366C3B191773A64035F8EE97620D2C98A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622773, "uuid": "8963423f-8beb-40de-a1c8-96275e30ef70", "value": "6545c6d8e3275d8af589e482d85068e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622773, "uuid": "d9823a45-0b83-4acc-b843-39569daa9ef9", "value": "48:63zSxEDmDGq4nTypkxED+fKSkx0CaGd4NrBS:USpD2uKP8dN4FA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633622773, "uuid": "e35bca34-09ce-411e-8c94-f825f7d557ca", "value": 2560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633622773, "uuid": "0aa47e65-346c-4941-af85-bc4848b3b61e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622773, "uuid": "18701336-ec91-425c-bab6-a683c24dfe43", "value": "cd17d11bb2c8dd9942e816677df2dae2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ec88ed-2778-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633616054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616054, "uuid": "d29cd76e-591d-4284-8388-15fc505aabf6", "comment": "Malware payload", "value": "4519803bfe47eeef4ee9ca1af09b65d3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616054, "uuid": "f95245d4-6e05-4144-af4d-5b73cc6bf11b", "comment": "Malware payload", "value": "5a4bb5c9ae341ec00ab562803c22921c6cca2a5d3556ab4b63f886a9729476d9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616054, "uuid": "7058c696-928b-4ebd-9b05-694e348b7b85", "comment": "Malware payload", "value": "3a9445ec831e5eb9d5525d7161d0d95c6a5232ff", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616054, "uuid": "783cdd22-8f31-46cd-ac2b-0d1c86b2fac3", "comment": "Malware payload", "value": "41196122c6938c9720a9351de3befeb234c145e03014c3c40ba974d89be5a98ada749ebd642d05e122e1038d16533788", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616054, "uuid": "3ff65fed-5cb7-4ae9-bb39-89115d0f9d48", "value": "T1868312AD973B38449013A6ABC75019D50C3A84DABE3AE2177C57626BB81D0D0AFF49DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616054, "uuid": "b3845902-c35c-45c5-bb90-b536351d1629", "value": "1536:IGOdrDDWuan5HmTTrZzqPD27WdZ6nI0fUdZhb7AFaLAB3qCqKcm5ADUvshMK:I5rDHgFmIPDc0ZyuvFRLCNcjDUvshMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633616054, "uuid": "443ea665-7db5-4751-9adb-4e833b0f2a32", "value": 86336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633616054, "uuid": "afa15f68-daa6-4523-859f-100e334e8a2b", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616054, "uuid": "1683ccb9-657f-4944-a7d9-9787d46d911e", "value": "bfe.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0967da0-27c5-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633649110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633649110, "uuid": "81d41b2e-8187-4dc5-a116-8d70810d34ae", "comment": "Malware payload", "value": "5a58a25307879b084aa009ef876cbec7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633649110, "uuid": "6bde60c7-1f11-49ff-baef-39e0c7666bea", "comment": "Malware payload", "value": "5a8c128432b6658b5668a426301002937e9cc83d31bb8ec864781107b2c7cdfb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633649110, "uuid": "7b869053-331b-4225-b80e-4a546b9b9e09", "comment": "Malware payload", "value": "ea3c18bc6a573715eb83deb5a0c837cc1a7be49f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633649110, "uuid": "c04bc70c-8df5-45b4-b0f8-d1665faaadf7", "comment": "Malware payload", "value": "e199cddbefb188efb3df6d8d95e313a803d70380d8c2f2efd5119aea6a820787c8e8be48845afc4072dce024224ec5e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633649110, "uuid": "5836c561-d9a0-40d0-a9ba-6c2d6b5a8bcf", "value": "T188D4020171A29077D17F16724E35CAE087BBBC71DA32948B67F527AE1F251A0CE36326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633649110, "uuid": "2dc6e9b9-5d22-4c50-a109-1ee3c938b6ff", "value": "be06676f0b26f3557b735abbe8be48ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633649110, "uuid": "8716da0a-bc8b-4316-8bbf-8f8c0d7c1749", "value": "12288:HxthJxSgtirpErxFtx6l8W/JPZ55qQv4/PWAbSwIGOg3+W:HxtBls2x7x6h/JxcHzbP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633649110, "uuid": "37366148-9c96-494a-8261-6b465cae280f", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633649110, "uuid": "d29265f0-6df4-4b7e-8445-6ebaa3f56375", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633649110, "uuid": "55674fb4-c074-4fa7-8c86-7e151778aadc", "value": "5a58a25307879b084aa009ef876cbec7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205fb411-2750-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633598563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598563, "uuid": "72b4cb38-8670-488e-88f2-3fd566d8426c", "comment": "Malware payload (AgentTesla)", "value": "cfbd1a2cbc6b71ecb11b80ddf05db117", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598563, "uuid": "95a95820-239d-4bc8-83df-e32fbba7d7e4", "comment": "Malware payload (AgentTesla)", "value": "5aa7d1bc7abef93b3ccd50f7dd880f9bf70c7b7d157d067f16377d7b0a929092", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598563, "uuid": "f17b6c2a-1e2a-44e4-b055-68b9a731ad11", "comment": "Malware payload (AgentTesla)", "value": "dcea82ff06457d6bed7718247c6cca46be48890c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598563, "uuid": "2b1d3380-1c23-4a22-8ac6-b1069a687c9b", "comment": "Malware payload (AgentTesla)", "value": "9653d85ae80a634b43073d612df74c9ef6a2af7090ab181fcc3fa299071fde9a14da111cd353d097dc178e5f9f9c865c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598563, "uuid": "7869eb5c-4516-49e8-91b6-9b1ea7c78156", "value": "T1B8A4F16803678745CD7547F02825AA611376EC2960AAD37C1AE9F0FD3EB7BF648E0643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598563, "uuid": "67655182-1af0-4f89-b624-119d48074d45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598563, "uuid": "49b214ee-0c00-4b87-882f-e37792f76d52", "value": "6144:eBvdZBDQ+3HwOXfDQ3Jv2/dHuSkwAxzwa6jSvFt4dtktYOJR8NwvEb44M5cxqltY:YkovU3Q/dHhAxMa623+SbDyqEj4Xd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598563, "uuid": "61725c8b-4cfa-4c2f-ac53-f2e1512cffac", "value": 461824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598563, "uuid": "0ff0f834-dbb4-4632-93b9-7522917a89c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598563, "uuid": "96c9c0eb-64f7-4420-a959-8394e44466ae", "value": "cfbd1a2cbc6b71ecb11b80ddf05db117.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291045b7-273a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633589129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589129, "uuid": "0b9eceeb-dc13-44e9-afd3-08f1bef417e1", "comment": "Malware payload", "value": "d7a5f0fbd8a2b6227484c9df11ada0e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589129, "uuid": "e7000a65-363b-4216-9620-6afd3e169e51", "comment": "Malware payload", "value": "5b8f3956ac2be07fe773d9c294e5cbad0968e7fa99c5f6fd5d184caa512c5106", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589129, "uuid": "c2361622-c0f8-4656-b7d0-ea3dbd56ab12", "comment": "Malware payload", "value": "c1eb86208b141939796eb798f4fc7b6ae453d918", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589129, "uuid": "aaf8ec2b-884a-41be-8003-66032363a903", "comment": "Malware payload", "value": "4d4a3540a1052c86b14af1e431b1e29eb6880bf53168c8f23d6013c6a1999bde3243b3aaae9c8503dce55ed75d396db4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589129, "uuid": "00d3d317-8b57-4c73-8a84-cb39729fea0d", "value": "T1B175F13D75C17C7BCB7EC23D8CA68D341D911A470C80699E7EE129FA4CA7640BE47A68", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589129, "uuid": "5c860f55-f289-4a20-934a-5a8a3409c5a5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589129, "uuid": "aeb422e6-fb88-4609-8c64-6a7001bd68fe", "value": "24576:973K8D54R3ubyoYIMYggneB0Jc4E9pFYtgXeYtVFB0x:9zbU3ubLFKcj8YtKFyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633589129, "uuid": "7e4db33e-8af2-489e-b46b-c0daa504c580", "value": 1567744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633589129, "uuid": "946e334c-d9c3-4453-9acf-f05d69d44c14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589129, "uuid": "19498692-51ed-4fbc-9427-f79df0ac07d6", "value": "234567890004234567890.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2da20f2-2799-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633630243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633630243, "uuid": "4f97089b-1051-4298-97b5-1dc4672d789c", "comment": "Malware payload (Formbook)", "value": "f022b6feca056d1c00e697fdd3f32ee5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633630243, "uuid": "50135bcf-0faf-4c2e-8131-f9b502da7a5f", "comment": "Malware payload (Formbook)", "value": "5c175aad872d219fa23de0c83ea085fbdca8d76601167089b4e55ee66d520276", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633630243, "uuid": "cc829e58-fea2-4375-9664-57ca32b8cdda", "comment": "Malware payload (Formbook)", "value": "7e330611d281518655c308b83cb01ba92e1a703c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633630243, "uuid": "7a1d66b9-dc3f-45b7-b68b-495bb9b33921", "comment": "Malware payload (Formbook)", "value": "b3dfbae2ed20c08e8372177d87b1f8207e9a5245c782e80ee3c7991a74c8f459e67386a764ff3c425ba4e5af4e738caa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633630243, "uuid": "0d57802c-61ac-4730-ad26-29d35618c130", "value": "T13E059D56E2E30427D0B2AA7C1D97533D7C22EAD1EA25784276BC0FC5EE361413A572E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633630243, "uuid": "21dd2eb6-9fee-4c39-b632-788f60406465", "value": "63d793c7bfed8139488cc1a5c45be64f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633630243, "uuid": "45187b01-bf94-4da4-9595-49741bc5a607", "value": "24576:lawOWWJ7S8YsUVkY7CE5L0S4PMGdMWEjI:llcJ16j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633630243, "uuid": "98cea5e2-c663-4f29-a5bd-a2463da21537", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633630243, "uuid": "83f3b6ec-7fc0-4cf8-a350-0cbf3036bb33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633630243, "uuid": "67248c8f-21ea-4db9-8307-88873bab2a05", "value": "f022b6feca056d1c00e697fdd3f32ee5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70881e73-2761-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633605999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633605999, "uuid": "1d6a09e9-d099-470a-9505-1f5a0242a276", "comment": "Malware payload (AgentTesla)", "value": "ce09212cd5e8f024229413ccf880eea8", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633605999, "uuid": "b9ade9ff-900e-4966-b88d-a30fd63fe6fb", "comment": "Malware payload (AgentTesla)", "value": "5c6ec69898602cce61cc60bead435a78b26457f100683fa4f8331b90c9f58a44", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633605999, "uuid": "c3656872-b2df-46ce-bf5e-e3d941a453a5", "comment": "Malware payload (AgentTesla)", "value": "f7b9248a50bfd3193a801c2b5256f976112f4043", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633605999, "uuid": "758a7f3e-b41d-42b3-a287-951dbc1eb1ed", "comment": "Malware payload (AgentTesla)", "value": "c3e7d9f9424d20afe6e589700f809583666ac7ee39e33974ebcca7837158ecdc3db557e59dd21eff89bf6fd32ee6a54f", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633605999, "uuid": "bc4a67b8-6af3-48eb-b8b5-2355267b938b", "value": "T10CE433E15752ABCBF1E6E7EB54187CC19EC3A4AB45A2222EC391D25CFCAC21453B5C13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633605999, "uuid": "351f88ab-6480-4fad-8ee9-dd5e1559cd11", "value": "12288:+2voeyyPmxv5TJIxfxxdD77f0GiLqi8l+UzXNPCRDqo5wpq71:toH5TJIZdD7fNl+UbNP8Qq71", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633605999, "uuid": "c5ef1824-128c-43bc-baff-804c9a6c7d6d", "value": 671319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633605999, "uuid": "5510a38e-fcda-41e6-a033-07760be98821", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633605999, "uuid": "463ea86a-c6ed-4305-9e5b-a0dbbe727e0f", "value": "Shipping docs DHL tracing No is 7682657721.7z.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f734448-27a8-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633636330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636330, "uuid": "fbe7c66b-7912-476a-87c4-151efe65ee8c", "comment": "Malware payload (DanaBot)", "value": "d429e3660bea179030351f62395ae4d4", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636330, "uuid": "26f31725-be65-4b8e-a6c2-fdb562651918", "comment": "Malware payload (DanaBot)", "value": "5cb6e770edce0f3152dc1829bac2aff71be91ee7242260b32086ee7a3768483f", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636330, "uuid": "941d018f-9aee-483b-96f4-ed8bd7df03f1", "comment": "Malware payload (DanaBot)", "value": "7a0a0dd6b4be9105033349168aa044f1d816cd66", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636330, "uuid": "0a17403e-944a-483e-b00e-bd2532aab091", "comment": "Malware payload (DanaBot)", "value": "65410c79f142fa74ab6f6f01dc9bff474887facdefd636f7a1a72674ea8553b553783a1387d548dcbfa4bebbb7e112dd", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636330, "uuid": "160b2944-c582-4028-acdb-056645ad29b6", "value": "T140451201B7A1C035F1B652F40B7583B8A92E7DA29F28A1CF56C51AF857366E0EC7074B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636330, "uuid": "6c0c443a-1877-40ef-9061-c1b55504a4c5", "value": "5723d007fd3b79d5a0887de51ad72442", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636330, "uuid": "b2fb372e-4c1d-436b-b3ce-fdf40a76db4b", "value": "24576:LWJ4XbfDmFGzGiXssAuYg93gc04T+b+uMP6GvP:LWmXb7mFGzGZsAu/dTTujM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633636330, "uuid": "da055859-c127-4187-8e95-15de0bf78147", "value": 1220608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633636330, "uuid": "c3082d85-b8cf-4c55-bb6d-a3d4a18ef5e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636330, "uuid": "21ac2b35-6470-4d4a-8cbd-d169795b7b41", "value": "d429e3660bea179030351f62395ae4d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2271076e-2767-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633608445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608445, "uuid": "aacd45eb-2dbe-4b7b-ba63-ce623951e75b", "comment": "Malware payload (ArkeiStealer)", "value": "5feeaecfcedffcfb56f058ec1d58943c", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608445, "uuid": "1ec39640-2d1e-408c-aa3e-aa9a30cbc3fa", "comment": "Malware payload (ArkeiStealer)", "value": "5cdade4f7abf84af2fab04c925456f616a170751bde63e4c1ce5f5bd7c47762d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608445, "uuid": "b4bacdc9-afd9-4f1f-b0fa-2a1f2e09b392", "comment": "Malware payload (ArkeiStealer)", "value": "04b34807af89252bc7adce7d6980b6c0dd76eb7f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608445, "uuid": "c9df242a-7078-49d0-93ad-c04c6e150d4e", "comment": "Malware payload (ArkeiStealer)", "value": "d1e299572b23a86944d046656de7f3f8b0fbf2ff870214f31fbb921a3288bc21262bb1305c2fc7f5cf811d931201b677", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608445, "uuid": "7a2329e1-a295-4eda-a090-694d48b2b4f9", "value": "T1EDE40111A7F0C035F0B706BA497652B5A93E7AB15728D1CBA2D56BF76A342E0EC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608445, "uuid": "c3a36d32-2efb-4a6a-b731-471ce8c10018", "value": "104d9977f4378bb867ddadb6d1eb3d6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608445, "uuid": "df195b37-295a-4da2-9b25-0d6de34db63e", "value": "12288:rBfuTGsqe3v2kRRRRRVvvinuR76JvIGMYcFu6wT5QSc+wv3qlIcmnM6GfGVgHz1q:rBVe3RRRRRRJqnG6JvIVulT55JBhEBRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633608445, "uuid": "4b78cce6-ab77-4c24-a889-d596884c1db5", "value": 682496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633608445, "uuid": "11b708de-d1bf-4fb7-ba10-d09bb3ff2f76", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608445, "uuid": "f0f63c57-2983-40ab-9da6-430d88ba9daa", "value": "5feeaecfcedffcfb56f058ec1d58943c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980db544-274f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633598334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598334, "uuid": "577b2d46-0405-4403-9bcd-7868c9e5fa1e", "comment": "Malware payload (RedLineStealer)", "value": "8479de034d759150c36b09ade25a4996", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598334, "uuid": "97e77a4b-12ec-454e-9688-df9f6f8c049a", "comment": "Malware payload (RedLineStealer)", "value": "5cdca6838044c712d83b192f693ae6da288d6cd065f431014f5569cbbe20b589", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598334, "uuid": "a71f0ea3-3b4f-4a82-9759-2c4b4a958cd4", "comment": "Malware payload (RedLineStealer)", "value": "749652423a707060521576f875d47850d6d3da0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598334, "uuid": "45087222-8435-4f5a-bd26-2b5d5f8827ad", "comment": "Malware payload (RedLineStealer)", "value": "adcbcf4d6da074bb89245874d2e8323e3e684df7e9da3981a6b35e2263c4ff469db4a82cbb817ecf6761b799e0a8e5ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598334, "uuid": "ba37c00a-3ee4-431f-bf86-2187ca678072", "value": "T19F64CF10ABE1C035F4B752F9097AC2B4A52D79B06B34C1CF63C52AEA4A356E4ED30797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598334, "uuid": "6e24149b-e434-4fcc-94da-b716f7e1b939", "value": "dfddb4935ecfeccd8e67f98d0f98b8e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598334, "uuid": "467e6194-8167-4868-9f01-32af4d0cdf41", "value": "6144:7FprWnQ6OH7fvLmMVXZOLTLDDPGf5Ad5UtweS3eFWuloOtFK:7FprQQ6OHzLmMryzKf5iTuloOtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598334, "uuid": "c4b75ac0-b27b-4f9e-9178-8f94e2ec548a", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598334, "uuid": "d2574d06-4b08-4cf4-8d88-4646cef2cbf4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598334, "uuid": "7bfea392-ccd1-48ea-8744-43b75f566a31", "value": "8479de034d759150c36b09ade25a4996.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c2a7a69-2790-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633626151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626151, "uuid": "db301d3a-0c89-4afd-981b-d01ae41bb928", "comment": "Malware payload (Gafgyt)", "value": "dd21b88ae8bce76681e3a95bbe634eac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626151, "uuid": "765cf35f-aa96-48d0-924a-53d8d6ddf6ae", "comment": "Malware payload (Gafgyt)", "value": "5d8359f4377c5e9d77b3c56252afd74d9d2047ac9418855df87b309b4e6089ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626151, "uuid": "c04c4653-208b-425b-bae1-a18fbb414aab", "comment": "Malware payload (Gafgyt)", "value": "190dc6363df28f2c8c70d821504ae7a38fc2d921", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626151, "uuid": "7c242ec6-e260-4073-bef1-c2ae684be325", "comment": "Malware payload (Gafgyt)", "value": "5850b31189e2bc72a7359bd5dd40a8672c05389d733635fc5e59a115c027cbafd7378027cb4569983b8c449197d0020e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626151, "uuid": "89046f9e-d3fe-43f4-9b4d-2e270175da88", "value": "T14FB3C517AB618FB7C85FCE3306AA850120CDA55612E97B6FB2B4D92CE74B84F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626151, "uuid": "e93cb935-ed92-4f86-9d0e-997b1726cb93", "value": "1536:ZLeTikthhSMOCMQS+ZjN4pjuIxreg2ONN2eDo/TUmkiSFxfC7xbXe:ZhHC3S+dUre8NTDiTUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633626151, "uuid": "302f42e8-51dc-4ba3-acbb-54e7f8cd830d", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633626151, "uuid": "03bcb142-b069-47f5-a6ee-f9c159959c19", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626151, "uuid": "e672ee1f-c62f-459f-b573-1ffc0e603693", "value": "dd21b88ae8bce76681e3a95bbe634eac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba3cf10-2765-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633607655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607655, "uuid": "f8d8e790-b1e8-42c7-9908-6f64725bf829", "comment": "Malware payload (SnakeKeylogger)", "value": "b22558d61e7aa71b9691217f60429e06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607655, "uuid": "a8640b54-792e-4635-8d31-836de8711f30", "comment": "Malware payload (SnakeKeylogger)", "value": "5d9919960fcb211bf369542b427086466e191e2c58fce8f6fb9b3449110ff90f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607655, "uuid": "9ab0b29c-c5f1-4c2b-b7fa-71a4be008a94", "comment": "Malware payload (SnakeKeylogger)", "value": "319b68c187e73eda449c2e07f734fbda3f8b5d26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607655, "uuid": "4d296c34-b4af-4059-8260-aa6e81754a43", "comment": "Malware payload (SnakeKeylogger)", "value": "c70e0c2c7591acf363dd4dac7214be94ebe44e7a3c619b61ca18feec6a44fbe1fcbfa93721537ddfd36671f542ef0b41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607655, "uuid": "74c932f4-5be1-48e9-98eb-8a436f321729", "value": "T18374016953B79608DE7807F83825AB601771D012119DC3780BD9F4FC3EA3BBA4AE465B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607655, "uuid": "b1aa0669-5504-4792-aa39-ff3ff0d8cb05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607655, "uuid": "cab7fcd8-0664-4908-8182-fd0f17b0acad", "value": "6144:J6ejZRDQ+3HwOU2I6sm3Qtc0fROQNEm9nx9NfC67o0Qam4i:bkoU56sA0cBva9NK67o0QaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633607655, "uuid": "5c6c7053-c4c6-4e4f-ae25-a30a0f90c1a6", "value": 363008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633607655, "uuid": "640b0d88-ed31-45db-bdbb-59e536dabd00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607655, "uuid": "4a1f7b1f-b653-4155-8fff-20fdb120fdd3", "value": "Halkbank_Ekstre_1007202187266479387_938938987466.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37879520-27a8-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633636398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636398, "uuid": "10605d69-99c8-40c9-9f6f-fa4ade7a64a3", "comment": "Malware payload (Loki)", "value": "f493a60bcc8e5336a439557b2b2ff58b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636398, "uuid": "0af2e273-38f3-4836-b4f3-022ec9d9c007", "comment": "Malware payload (Loki)", "value": "5e65904a7ea34c0059d10a8048eee92faebec842348fa3c52b8ed4641cbc9b7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636398, "uuid": "4f093585-d43e-4226-85e5-3b6700c04cb1", "comment": "Malware payload (Loki)", "value": "1160cd7ab28253e09d6f2b07481b6884e8f93672", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636398, "uuid": "0b10c97c-2a9a-4c77-963e-bd9db4f520a9", "comment": "Malware payload (Loki)", "value": "e4d3baed80ff6508643ef860e9c0e6e87259818e2998d22e2644f7811367e8cb9a072867857f3ba37b311eb3afc63b50", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636398, "uuid": "916b3e17-1f8e-4508-86b4-d5924eb1c7e0", "value": "T1EA64E065132B8A08CD7987F42428A7A22334D419115DC33C1AE8F4FC7FA7BF94AE5297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636398, "uuid": "055786c7-28b0-487e-b9e5-bdc209ed2912", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636398, "uuid": "12426917-05ff-4183-a8fd-192b083d2b3d", "value": "6144:E4xSNZSDQ+3HwOBG4lNQfPnw3qE8VU/SkQW92dcwPucpqXD:XkoA4EXsVKkP92daX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633636398, "uuid": "abf8c966-b3a2-472d-81b3-43f62adedb11", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633636398, "uuid": "65b9cace-7498-4748-b37c-62abceece085", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636398, "uuid": "9221ac39-2dea-44f4-9bbc-7dcb49c62ac7", "value": "f493a60bcc8e5336a439557b2b2ff58b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adada465-274b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633596653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596653, "uuid": "d6ad6cbf-d49f-4479-b751-b2435c81f7da", "comment": "Malware payload", "value": "0d5fa7873e6827fe1f21230bed45dd56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596653, "uuid": "028dc621-c64a-4366-9b5c-8a349b5216d0", "comment": "Malware payload", "value": "5f6026943ba1e337c4371c34132e9674bf0b372c16a610f05314a75bc101ca91", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596653, "uuid": "66dd8a3c-9ff1-4118-bf47-a2284789dd88", "comment": "Malware payload", "value": "5e54d0dd9cda1a47648ba671cfeb6f26c1781e09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596653, "uuid": "2916f758-d8fc-475a-90c2-03c3041b0b42", "comment": "Malware payload", "value": "77bac6cdc89ad1694626cc0cc432d3b91300fbf6a9386237b687cbfa516fca899211186f8e64074d41ab03d775dc32a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596653, "uuid": "80d2f410-1ecd-4b8a-9dbf-a6b8848c4f44", "value": "T11B836C422B499F56C27EF73B83B244C003F6E516E732E91EBEC531ED0646E954A40F66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596653, "uuid": "9224b948-961b-4f03-bfc0-6a328290c00b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596653, "uuid": "d4356ccf-57d4-434a-8724-bd4580b59116", "value": "1536:RLqFBFNppdN3Omrg1LD4pxpd9vGvCQNB2dxEW4sgEsTPiSgyyNCNcMah07+l2pKU:RLqVxpdx8CqBwaWXsrtNw07+l2pKXgXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633596653, "uuid": "df9914e6-3768-4e7e-9e11-263d6d73a6d2", "value": 83896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633596653, "uuid": "24daba15-000a-4bf3-a209-1ba8ca817e04", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596653, "uuid": "5592b969-3495-4a59-b3e4-361faddf99c3", "value": "0d5fa7873e6827fe1f21230bed45dd56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ac6c26-2759-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633602496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602496, "uuid": "b9f720f9-0dc8-4beb-b82a-555bd6bddc51", "comment": "Malware payload (Formbook)", "value": "27e82e5a6ba22fd144a1aa0499ae1acd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602496, "uuid": "9f1556c7-d7cf-4366-8520-c2d19bdf4549", "comment": "Malware payload (Formbook)", "value": "5fd22c8bf1e7e06ccaa6ebc23410086fe0e3bc30b1613cd6ee734f280c0d6979", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602496, "uuid": "a75861e0-7164-49d1-beaa-51bbcfe60d0c", "comment": "Malware payload (Formbook)", "value": "5ce54787ee210a020401ce97b2777d1b0f4b4bc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602496, "uuid": "e07406f9-15b5-4a9a-923f-2a7985123d08", "comment": "Malware payload (Formbook)", "value": "2579f5002e657eb8719476680c1069f2fccc63ec98d3287180ca392d0c068659899e31442678dcce88fe9e8fc11e2df5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602496, "uuid": "02b334f8-9316-4b39-8ffb-19d1c65fee91", "value": "T1CB54128762E485ABD58317714DBEE27BFF7AE10442C36D4B8B801E375861BC0852F79A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602496, "uuid": "a666a865-0349-4b5d-a6e0-215f0fb0e2c1", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602496, "uuid": "c3b7116f-6d45-400e-bf6f-409df7b88f5c", "value": "6144:F8LxBs96SgK9VNHLmWiovgflPWDwH8D7LEYZ8vI+tx81EeNpKU17QW/:/m8VNrmWZ4U8H8x6tx8hzKU1x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633602496, "uuid": "da52f4c8-12b3-4551-8d14-20b6b6dbc042", "value": 296492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633602496, "uuid": "a2a6cb6a-a594-43c1-b356-d505c5cfce65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602496, "uuid": "faa1ca8d-cf48-4795-b60c-a9175414bc97", "value": "27e82e5a6ba22fd144a1aa0499ae1acd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c6b3d6-2775-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633614658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614658, "uuid": "5340cd43-1cda-44e3-acbf-36d0df3a5ba9", "comment": "Malware payload (RaccoonStealer)", "value": "08d1c1084c3edd555b21d985e8f38259", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614658, "uuid": "6f82beee-20cb-46fb-b080-6ae5b42ad2cf", "comment": "Malware payload (RaccoonStealer)", "value": "5fe065477abcc7d6be9f05ca9f7ab796bcdc98776fdc7cb4abf5e99043913ac6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614658, "uuid": "85149ac7-3719-4b3c-aad4-a15314a8a922", "comment": "Malware payload (RaccoonStealer)", "value": "21504f946eb9ef47682556b60d8f9149c761dc0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614658, "uuid": "9b71880c-b1d0-4bbc-9fe1-25b2a6c83f71", "comment": "Malware payload (RaccoonStealer)", "value": "7d7f6a448fb9bcd089fa9210cb47256a61bda05ec4812b9c5cef3630853d25aa16e947bac66201d7f38b8f19bc368654", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614658, "uuid": "f91d2c67-0207-408e-b514-bd28814dc8b8", "value": "T1A2B4F100A7E0C035F5B752FE4AB593E4A52E79B09B3490CF62E51AEB5A346F4AC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614658, "uuid": "752316ee-bad1-4fe0-8e1c-8d8cad0cd224", "value": "c1d211268d6c769cc59ffca0e56e63c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614658, "uuid": "fc1aa815-24ac-4748-b247-0d6abbfd51e9", "value": "12288:E1bJpRrPWnzI1hT8vBztzQUSW4K5dVNcm9EgOIb:E14nz1Jts0dVdBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633614658, "uuid": "5923bde0-3e0e-40e5-8c4c-7d1ea9f7dd3f", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633614658, "uuid": "2ee01372-0375-4e6c-828c-d99b68fae2e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614658, "uuid": "f500b5b6-4cf7-44cb-aa1d-cf554b518bc2", "value": "08d1c1084c3edd555b21d985e8f38259.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee600da-278d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633624814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624814, "uuid": "e65bcf54-a2b5-40a2-bf3c-151e8e0164d9", "comment": "Malware payload (AgentTesla)", "value": "e38c19075b263d583cfd967a1681dc87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624814, "uuid": "9f12ee82-6003-42f3-b6f4-a45d41cdb33d", "comment": "Malware payload (AgentTesla)", "value": "602e84be6f659949013ff4acc034dc0808912e1582a2741b55a6406b919446e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624814, "uuid": "57ed1f61-3c92-46d3-958d-59b262dea758", "comment": "Malware payload (AgentTesla)", "value": "1c2508c0aeb46cca094bd072fd5f137bd4795686", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624814, "uuid": "747d2703-f47f-47d6-9167-e1e3b6259719", "comment": "Malware payload (AgentTesla)", "value": "310e5fcf05f3895b0fa488644639114563de4651ab44e3fc57b838a79e4798643b859decd8c191279ff0c3cc296d6983", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624814, "uuid": "19754b44-d224-437c-b19c-4df094616c7e", "value": "T1B3050E5363AC8ED4C06792B4DFC0C4B96C19D9EE421A53B4AB12AB60F75FC035E6A473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624814, "uuid": "b8335931-5f7e-4711-8147-532da984b443", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624814, "uuid": "a74ec102-a940-4654-b7c7-54d2be12586c", "value": "6144:7+9P6UqT4Ldkg1TWvnhEmkZnwT7+oobzf7x9YqMIn17kpmt/dFSvNU2WCHITC4:7tUta0+kZC74f7LYJM9dAC2WMIp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633624814, "uuid": "a40a400e-e7c1-4e4e-83b0-0da481fa68cc", "value": 851456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633624814, "uuid": "bdafd782-6359-4aff-b039-ba76156bc953", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624814, "uuid": "a34f107a-327e-4683-a1fa-94130c1f454b", "value": "e38c19075b263d583cfd967a1681dc87.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e29c6a0-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633597271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597271, "uuid": "e8c51199-328d-48af-afed-fd9ce141e0a5", "comment": "Malware payload (ArkeiStealer)", "value": "620af476331fa5831d46af7ba368d4fe", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597271, "uuid": "18e6d4b9-2b19-4831-a57c-f76ad665e41e", "comment": "Malware payload (ArkeiStealer)", "value": "607494be65a2860e8a4a6d5c6fd82d54a6ff6dedf32d0017e92a6bfc3690d57e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597271, "uuid": "1c497706-1b96-4870-a236-3a1578bb842a", "comment": "Malware payload (ArkeiStealer)", "value": "2529c288dbe0d78403fa4424b124e7e4cb76eb2f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597271, "uuid": "ebebb2ec-6887-42f0-ad74-65b0bcce3bfe", "comment": "Malware payload (ArkeiStealer)", "value": "83f05b1f0332c5b5cdf005909ab514e243b3a79782116e36aad44e4b8dd813876d0d5dcb31508797cd031304631b6a6a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597271, "uuid": "a7eb33c2-3479-40d3-b93d-50d07e5877b7", "value": "T153E4122172D396F4E67352307A61C6F5872ABD5D7A32716F37A0271E2F3C5E18A22306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597271, "uuid": "c3d22d4d-942e-4103-9eae-70422405a495", "value": "e7a97aff935fd5f902aa97ce23e1da74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597271, "uuid": "72bbb307-fb8f-4bcf-ab62-a206a03e4fca", "value": "12288:HtPgTC7IbVa9COcxRTRZbgYXfOYnRIz1sNX7fbas8YYn0B19b:HtlOh/pWYi1s9asTXV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597271, "uuid": "3bd50814-e863-4034-b860-b492d5f133cc", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597271, "uuid": "a7f925f9-2766-4228-92dd-aaa7df243054", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597271, "uuid": "f65138aa-974a-4aae-90db-f2566159dc9d", "value": "620af476331fa5831d46af7ba368d4fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c65855f-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633597456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597456, "uuid": "650e2a7a-fc22-493e-b87a-2481119a55a3", "comment": "Malware payload (NanoCore)", "value": "d7833f2338528f468a4e63e7715882f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597456, "uuid": "df58602c-3004-473d-9079-15f71016a680", "comment": "Malware payload (NanoCore)", "value": "6086fbb050d0431a1eada139ccaea77ec999ce00b6a6b26b4e517ff9b50b83b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597456, "uuid": "62e17e30-cdb4-40c2-880e-c7971c0e5888", "comment": "Malware payload (NanoCore)", "value": "b540cc2f6d3aa0acd27331331611892abacd2d66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597456, "uuid": "336b5154-5b3a-4b91-bb38-5f5f451a2440", "comment": "Malware payload (NanoCore)", "value": "a4741572fddc4b781d15515796c8329378c4aa4c3f9b1a60225e676fc835a1891a6a3caab520159d4a96409ce742536b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597456, "uuid": "3a0dc05a-1708-4663-a1b8-2a53765cb5e1", "value": "T1F5B4CF98322B1517CD388DF119CC618193F4AC37914AE3D94DE2F1EE6AE2FBD1A92543", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597456, "uuid": "3eb50327-41b2-4109-8972-30243026f533", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597456, "uuid": "a1ba7db7-f356-4e84-86aa-a23c4e886a37", "value": "12288:7pc1c0W1hQmTJgei/ew6MwLSF95ww6WyNlYnoY:Ec0W1hQaMworcpXsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597456, "uuid": "88090223-34d6-42ce-8104-51a5309e42c2", "value": 523776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597456, "uuid": "c14c5fc3-a9d3-4ec6-9031-ed7c44849fb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597456, "uuid": "724647dc-3a11-4b71-a915-50d4875d597c", "value": "d7833f2338528f468a4e63e7715882f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4fd0022-274c-11ec-843c-42010a9c0014", "comment": "Malware payload (a310Logger)", "timestamp": 1633597148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597148, "uuid": "aeaf6696-083a-4793-b941-9778b1d1efd1", "comment": "Malware payload (a310Logger)", "value": "e13c7ba670a1ceb573c5d297b888df6c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597148, "uuid": "8e3e7ca4-dfcf-492c-a11d-8381625fd482", "comment": "Malware payload (a310Logger)", "value": "60bdba6fc20036919b398083a3d70f044c68295fac92973b8994eda040493198", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597148, "uuid": "8637a17f-5d24-40e5-9ae8-1053ab89716b", "comment": "Malware payload (a310Logger)", "value": "2bfe27ead8d9acd340349c5943fecdf1e8e8775b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597148, "uuid": "e3009113-71a3-4ee7-98e3-f7fc17fb0cd1", "comment": "Malware payload (a310Logger)", "value": "9d8648defb093df24c97f91408925a25396e5b47b701587372fa855e3b5e5ef9cbdfb4d625ddbd34e0d0c161cc782829", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597148, "uuid": "2340e50a-7e69-4108-a90e-fec8102acfc2", "value": "T1A3C42363A4F3D0EBCA72E571ED74FA76F23A490414A09883CF75643E762A48F9E0B145", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597148, "uuid": "c7aa9bf8-a683-446b-8c34-86c9646c4d5c", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597148, "uuid": "e3e035f4-dc18-4215-bf2b-3f0108447d84", "value": "6144:F8LxBsWb2JjUKAa4aMDWin0soH1nHdgJbt9PzTeNZgJyGP2FkTrJSRTb61DJB+n+:/WoPz4aYnOH1ESGP2FkJY6DQceqgdG7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597148, "uuid": "9cf836c2-6bfe-45d3-a704-5d8a5b9c96fd", "value": 567755, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597148, "uuid": "db151df2-18e0-46c4-85ca-8c4e9f561d7e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597148, "uuid": "ed5d2c82-e7a1-4a8d-a3a1-0b8785210be3", "value": "e13c7ba670a1ceb573c5d297b888df6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1a87d48-2775-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1633614698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614698, "uuid": "d547d27c-b843-4e59-a3af-451927132486", "comment": "Malware payload (Gozi)", "value": "c309ec3264c7bf7c771cca5703e841fe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614698, "uuid": "cc0c7d2b-5f68-4c6b-ab6e-8832232b31d1", "comment": "Malware payload (Gozi)", "value": "616255c7f0697542e2a3e5e6b4834fffa5e56e7ede26612454674a9937d32a19", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614698, "uuid": "2f901803-3ed3-465f-8bc5-277b01148f94", "comment": "Malware payload (Gozi)", "value": "2af04c50d324bc6f42fe9714ea89cf300471c169", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614698, "uuid": "a9baac34-2eb1-4e7d-8159-cb632d5a8e65", "comment": "Malware payload (Gozi)", "value": "a97488363fd3ffd740c4f187d9fc77967a292eb46ece17398837c27a8fc9bdd533c28671c77de0d954082be9976d0c34", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614698, "uuid": "a9d0428c-ef4c-4586-87cf-d7b0bd722338", "value": "T17404AD0232D18072E2B74E35047EA6619BBF79508F749DAB6388362D4F336D04635FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614698, "uuid": "3630363b-1ef4-4135-9a4f-900c96eae842", "value": "41b0070c0a9513aca3e2dec57678f6a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614698, "uuid": "0792cdb7-0ab6-4fbd-95b2-c4584c365644", "value": "3072:qrvdO1LblP9WNrgFFxA9cHv3UgmvXIyLOM9LPm/wKrD3SzGamTdHJyrVoNXO47:qZgi8FTAuHPUl5SeTSnZuoN+4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633614698, "uuid": "089d47ed-8f8a-4454-b906-331afedf1f58", "value": 188928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633614698, "uuid": "88ed2c60-1a3b-4b4a-9596-7744de711352", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614698, "uuid": "09c8e825-2d5e-4387-845e-24397486fe93", "value": "c3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f820d126-27a7-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633636291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636291, "uuid": "667c757f-5e9f-4ea3-b743-9dd5c6bf222e", "comment": "Malware payload (Metamorfo)", "value": "9babe0d5cbd308f10c8cb296d83402ec", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636291, "uuid": "5d495199-1aca-4d0a-a495-57629c3f96b4", "comment": "Malware payload (Metamorfo)", "value": "616a9a7e8173760e7251e0697e8a99d37eafb8f5535b0a11bedab3c99012650d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636291, "uuid": "2adf8a66-e294-4875-b20f-5dc895698c02", "comment": "Malware payload (Metamorfo)", "value": "e707df1b303b02a221d6b05d8f73cf9215584d22", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636291, "uuid": "41432d00-bced-414b-9883-8f9f72907148", "comment": "Malware payload (Metamorfo)", "value": "d226d987d6e4b8391fbc18fd23dd104a7f6dd68b543a3f5d8f9ac1acae729b52b788798e0656783496971a4baa32d91b", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636291, "uuid": "fc11f762-f5c9-48a9-8da7-fab88117a9c4", "value": "T1D831BE091AD61329C3B7CF7A1077A2474A76FC51AE934F9D80C497DE2891150FC34E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636291, "uuid": "36b596e1-1f2c-4c40-8f73-a0e864c9b025", "value": "24:8+JUHRlVo5kcbA+PKjf+/P+PsW9z41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+CjAxX1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633636291, "uuid": "d6b50bb0-fce9-44d1-b28e-4edb0452af2c", "value": 1554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633636291, "uuid": "f3cc48e4-6c9f-46fd-a668-681a54081a22", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636291, "uuid": "cb776fd8-a0e0-4301-82df-3e0555908111", "value": "curriculum.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e29dfff-2766-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633608062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608062, "uuid": "3d314e47-9387-440f-9b14-a0198ee51e79", "comment": "Malware payload (AgentTesla)", "value": "85f405a62c89dd3fd5940197b72c580d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608062, "uuid": "84fb5954-b92d-41f8-8561-086744393cc9", "comment": "Malware payload (AgentTesla)", "value": "617507f81952084554b81638de05dfc8d6efe0e7fc8b343c825c95b993a26df8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608062, "uuid": "741abace-96f7-4d61-9eb7-05841eec1fd6", "comment": "Malware payload (AgentTesla)", "value": "8be8ba8168fe82d8a57087ca7fbba9f11feedb69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608062, "uuid": "53b6de12-7897-4296-b6f3-4c29e9805ea8", "comment": "Malware payload (AgentTesla)", "value": "c02f85338bcb9cae624dba2edb90ba9cb26f0776371c0df498e6c811e1d7cbd8f6cfc241842b3095f675d96b6d5eda0c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608062, "uuid": "53b77c32-ef4a-4096-a07a-79edb44462d1", "value": "T149457A70C6513DDEC2053F66D11E293D1CC9AA1B47BB6786EB8B58F81C62208FD8D963", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608062, "uuid": "d8973b38-4acf-445d-b893-7b709b1368b6", "value": "12288:gmxfsnuPIaOB+YidJJl4WAiiBH5YYl2VaLMo5CBbAiuFgF0:gKsn1BdiduVBH542", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633608062, "uuid": "ac9f8a17-e942-40b8-b20c-584e305300dc", "value": 1182235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633608062, "uuid": "4c4ecb92-c164-4209-8c28-0eff19c61553", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608062, "uuid": "ccc89eab-9fa6-447c-87b3-edb41b15dc0b", "value": "NEEDED ORDER.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cb67086-273f-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633591255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591255, "uuid": "1bd91965-c3cc-4c81-906f-8e52fab07119", "comment": "Malware payload (RaccoonStealer)", "value": "b32777f569040bb47b47243ac392ec16", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591255, "uuid": "90fb2069-0a15-45ae-8ade-43a5fee41f79", "comment": "Malware payload (RaccoonStealer)", "value": "619500d3ddc6add4a5d8b960b1fd37044580c9c7fd24d3e508cfd2c083fc29c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591255, "uuid": "20167a8a-8325-476b-9a3c-668e2c670fce", "comment": "Malware payload (RaccoonStealer)", "value": "6b3cfa57c440a2e90ab563f6f45f7c45e2c1dc38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591255, "uuid": "9c05f56a-d630-4d87-9fdc-b20f44a32d72", "comment": "Malware payload (RaccoonStealer)", "value": "5f6610cf528150c38f9e3afe05e6ee4532398fb9ff1bea1d0f95c9ff3f4c4121bdcd196ce2e22e157ebac420716c590e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591255, "uuid": "386c900e-d960-4c72-8eef-bfab2d242cd5", "value": "T18E348D00ABE0C034F1F716F94975D3B8A93EBDB16B2490CB62D566E99A346E4EC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591255, "uuid": "17238a25-b466-4c39-9463-c072812b3d31", "value": "654aff1ee1bc89531bd3b96ebe76ae67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591255, "uuid": "d4744809-e008-482c-8630-c860eee7658f", "value": "3072:E6QtMxIlQFQSEdVfKQdo4dYf+Uw0/QOUyjQkUj6SXanRAvBktQ3NCJlhF8wLi5:E6QtMqFddn6hf+UXUj6SqUHklX8w0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591255, "uuid": "ccdca1d0-74fa-485a-83da-0be597dfe6dc", "value": 241152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591255, "uuid": "3374f083-cffc-404c-b046-340e04d7e146", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591255, "uuid": "12727c39-61aa-49ea-9ed3-4bac927bcd22", "value": "b32777f569040bb47b47243ac392ec16.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77e19dd-27a7-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633636237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636237, "uuid": "22885242-f259-4765-b12b-278f538a1b4b", "comment": "Malware payload (TrickBot)", "value": "1428f86ccf7e3e32ebde7fab15c0049b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636237, "uuid": "7a14c652-f4ed-45c7-9d9b-695be6c6f7a1", "comment": "Malware payload (TrickBot)", "value": "61d1417ece7c1bbd2fd4ca685fc92c5239fa8ced521b90cd92cebc983d4fcc5e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636237, "uuid": "34a66565-2311-461d-92f0-fe5e5756b9bd", "comment": "Malware payload (TrickBot)", "value": "49ac2f6e901ea48f7ef0cc699d94d8386ddefb12", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636237, "uuid": "93d91e4a-d0d7-4e12-a08b-c19ff82f3793", "comment": "Malware payload (TrickBot)", "value": "b75e458cb7f7cce58c9779ead0d3c30cbcc526c77aed1c32362ee151b62090afbb0cc78dbb7906557055026eeada8a6a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636237, "uuid": "1f068b69-a3c5-4464-9cdf-1b96215f5366", "value": "T14AB4DF02B3C08836D67B227A49ABD71933B9FC204F65C38726C47E5F6E326D55E26352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636237, "uuid": "5198bc77-70c3-44b2-8218-4c89d9be4b95", "value": "fd98f67a63ecc847a2028c66b8388afb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636237, "uuid": "b0816457-8da0-4265-8417-f9f264393536", "value": "6144:b3oOkxQXFDzaLtFD2aD3NAKit6lltqFpaI28VwPHK6+TDrAo0dThI9eq0NIaP:b3ExQ1DzM1b7qFp12iwPqvDr2VI9bZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633636237, "uuid": "622f6e35-ffbc-4f36-b4bd-13bc03b192f4", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633636237, "uuid": "550a5131-1ce1-4b8a-9de1-1878c6b4ee05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636237, "uuid": "5723884f-26f7-4dda-b9b0-4ae4c90f156c", "value": "1428f86ccf7e3e32ebde7fab15c0049b.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036e3819-2767-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633608393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608393, "uuid": "cb7579cd-7e2b-4aae-b45b-be799630d6ed", "comment": "Malware payload (Mirai)", "value": "bd922045b1a2405c9a8719f57f2ac37a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608393, "uuid": "a349ba78-aabc-4008-bb79-329b00b590c7", "comment": "Malware payload (Mirai)", "value": "6215050ffdbc5c39d77fbb1e784c209906f85e7b40850605cb69bbb5436873e5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608393, "uuid": "93b9ff8b-302a-4624-9647-561ff00356a9", "comment": "Malware payload (Mirai)", "value": "7c1b09bac3ff1e870f85f8db5df41bb0cb4c155e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608393, "uuid": "5e6b573e-f151-4fa6-8ea4-ed702a1b5a2e", "comment": "Malware payload (Mirai)", "value": "f3be0acf083737e26acf5c1c88651bf24e92f61ecb8188288e5949527a7fe8517d016fef99659dbfe6f396d48ba70285", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608393, "uuid": "231fd15a-0154-4705-a9a9-ffa3a30c22e5", "value": "T1E3B32956ACC19E11C5D7227BFA1E018E331227B8E3DE72129D145F6037CA92F0EBB656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608393, "uuid": "7da9b2e2-857d-4add-bfa4-5906a7061f6f", "value": "3072:QvlkAZA+lFgiogPMGHRsacqbyfuci92Oll+:QvFAAFg5gPMGxsaDbyVOll+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633608393, "uuid": "0e000a60-7957-40e6-bb1b-deaad83c40be", "value": 112600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633608393, "uuid": "ba56d274-43df-420c-87c9-4e3026330c86", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608393, "uuid": "39fa8a85-683f-430b-9aac-3f17d31d31bc", "value": "arm6-20211007-1206", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b80cd9b-2740-11ec-843c-42010a9c0014", "comment": "Malware payload (OskiStealer)", "timestamp": 1633591817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591817, "uuid": "dd690d6a-a2bb-4ed4-a93a-906907ca9a07", "comment": "Malware payload (OskiStealer)", "value": "225ab8cc9c4ac0eab146ca3b2dbce37b", "object_relation": "md5", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591817, "uuid": "855fe23e-d373-486d-8f53-99ea72a0ccdc", "comment": "Malware payload (OskiStealer)", "value": "635c816c16007d09a9152e5e345888dec623d27d1bd8f3b7ad5407b52a1f4035", "object_relation": "sha256", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591817, "uuid": "83b5f251-8a42-4a5b-b8ed-b0fc5a866b46", "comment": "Malware payload (OskiStealer)", "value": "9a6033f7d14350644ab7b7a49500ddf50fd6ec1e", "object_relation": "sha1", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591817, "uuid": "bda8c4ae-bb68-42db-8b29-56d133d881f7", "comment": "Malware payload (OskiStealer)", "value": "80da9e6ae38195ef7f87ca46dad7f4d9064169c55d70785b17af5e781ba4f405fd0ee2fc8a86baf309014011b55973c3", "object_relation": "sha3-384", "Tag": [ { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591817, "uuid": "31f5e716-c5c1-4b19-911b-52087d55c415", "value": "T101E302F6566C023DF22E4B39F139C6A4233DCE08D164041D76CE3E2B49B2F66D54B9A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591817, "uuid": "f9b0e0bf-eaa6-43bd-ac4e-0be9a48dd9b1", "value": "3072:js2PK4CI/as9cpiGFkKagk3f8Xu9ObToqPiaPBC+lnQ4xSdyGWwYu:jsvbs9czByf8XXbTo9f+lnQ4xBwYu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591817, "uuid": "fe8b79a7-760b-4a73-b4b2-cc4522ef4769", "value": 155648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591817, "uuid": "1fa2a49a-8f34-4c7f-9087-d5adf15a73be", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591817, "uuid": "f26317ea-36ef-4722-973d-36d7e3478d75", "value": "5400040115 Pratincole Pacific PRAT-RR-21-H070 DELMAR MARINE SERVICES PTE LTD.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8506a515-2759-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633602597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602597, "uuid": "a459dec3-4437-4944-a2a2-66712f75fd68", "comment": "Malware payload (NanoCore)", "value": "78eb42d689e954676d2957213378e109", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602597, "uuid": "09171430-39e8-4344-9e35-ea6ef234c5fa", "comment": "Malware payload (NanoCore)", "value": "639d059185e5be3d7f0501dbb2112bffe611078873d1bc41c44ca50eb2913a03", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602597, "uuid": "c9cd761d-613e-4bad-93cd-9a5904bc4ce2", "comment": "Malware payload (NanoCore)", "value": "275c82e413f805c6b20c65361575d9f8359c60c4", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602597, "uuid": "9fa1fdb6-3d32-460f-b3ef-25c74f6cda9f", "comment": "Malware payload (NanoCore)", "value": "6f733970103e0578bbc841b565e2c1da7f02e8067adfb07036da2593b7d30fe8230e81da08a23a1dbda816820d5fad64", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602597, "uuid": "37f16941-ba9d-4bdf-a423-663e01c84a2f", "value": "T1198423EEA5D99EBB6790ED30B1728E4A52D3710247E03A34D2CE7E18D0C95BD5C1272B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602597, "uuid": "3ba38b25-baed-4ed4-b8ae-87e8453569c5", "value": "6144:+V0jazHymiua62MRyB/cwdkXa0KNoqg7uwuDaCFrjCZvLBIS6xIO087Pr:+V00HC1R3+W3FxwuDaCFwLBIZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633602597, "uuid": "87d2c3c2-324f-49c9-b567-e34f6cc92730", "value": 376444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633602597, "uuid": "421bfa93-9835-4f1b-aef1-dae8f1173a00", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602597, "uuid": "369ff507-5c77-41cb-85ee-15f4531f0756", "value": "Balance Payment.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2f664b2-2743-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633593199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593199, "uuid": "b50e6aed-2897-4f1b-a117-33efbf5cb057", "comment": "Malware payload (AsyncRAT)", "value": "d7db3acbf0d42b2bc1583958f822831e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593199, "uuid": "e2e6893a-0ee5-4897-9f90-0febdf27d3ba", "comment": "Malware payload (AsyncRAT)", "value": "640c8c5d9606dabc7a697e416129dd2e11f7e54f3ee8792c156b6742e6c401f8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593199, "uuid": "310f8ddb-960a-44e5-b471-f9431609d3e2", "comment": "Malware payload (AsyncRAT)", "value": "49f9cd2e6a0c6a2294158cdad50081dd2502c9ad", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593199, "uuid": "5aefc1b8-87e0-4c46-854c-92ce69930364", "comment": "Malware payload (AsyncRAT)", "value": "2ebd6cfc385e8448cd2496bd3d4da5af484ee2b1901cea94fda22f30099bdb89b50658114e9d525d4cd9c81fd063aa8b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593199, "uuid": "524ea42e-e94f-46cc-a38b-1575ba9667a4", "value": "T1BF82CBB2D00C09C70685B47983D952F5983DF7F562ED88CD718994CF2C7C4E2094E4C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593199, "uuid": "63996bb0-9c5e-4fe8-9f7f-1002cb579f4d", "value": "48:ATTTTTTTTTjePCI3rxoMVN/MwaTTTTTTTTTjePCI3rxoMVN/Mwgb:w/SOYN0/SOYN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593199, "uuid": "a2b31e49-3a33-4d33-ad3a-56fac7194b6e", "value": 17800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593199, "uuid": "85722935-7f66-4089-891a-803fe77be127", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593199, "uuid": "2a9d4779-8869-455e-b504-cd670d7c7ddb", "value": "(10.06.2021)VBUE.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e02b98-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633597582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597582, "uuid": "a83030e7-218a-4179-bd59-0ffc1b50db2c", "comment": "Malware payload (RaccoonStealer)", "value": "804daa2371dc844e44c3b004092f05cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597582, "uuid": "9b7cde30-27f4-451a-a744-3b4c6ee3fdec", "comment": "Malware payload (RaccoonStealer)", "value": "65f1c758979396b12aedf025186a9e0f864c08cdb57a63ec1668f58845573895", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597582, "uuid": "b1351df6-f827-4373-8a8c-8d5a4cc77b83", "comment": "Malware payload (RaccoonStealer)", "value": "380274a0eaa3bb86add7f4d8696e4370c324fec3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597582, "uuid": "ea963ebd-33bb-430e-88fe-894a716c16d3", "comment": "Malware payload (RaccoonStealer)", "value": "7e5f50d9a857e60997de8560420230ddeb8c9a090cfd485717a6e2503aca5ab6b659ad0bdfc7070b7aea5deb5f55f2ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597582, "uuid": "f6c0286f-811d-4f7f-a614-bea991009b1f", "value": "T188A4022032F6C436E3A65AB08E75C6615A6B3CF2DA3D51CF17A0563DEE616D08B36307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597582, "uuid": "5d31ea3f-e93e-4b4d-9d40-cefe79d65886", "value": "51f224c09b57224d474ba4b21025bdd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597582, "uuid": "5ad6cf78-4732-4096-b991-e86f66589b03", "value": "12288:8wvwg9GQQ0Urd8hSBBhLNXwuudNxpm8j:8wDvDUrd8kfJNXtaNn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597582, "uuid": "ba5e2144-2691-47a9-8faf-badf854175df", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597582, "uuid": "379d1a9e-7659-4da6-9e68-b20a2668a4bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597582, "uuid": "01165c58-0ec4-4f25-aa69-20689d380a0d", "value": "804daa2371dc844e44c3b004092f05cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef23bc12-274c-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633597192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597192, "uuid": "43e2f206-d4a1-4e3b-ab7a-c3001f0be27e", "comment": "Malware payload (Quakbot)", "value": "2fd9d16b315b1a29f3e266999f00964d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597192, "uuid": "67d7807a-6273-43d3-8599-ce8bb51e4afe", "comment": "Malware payload (Quakbot)", "value": "6638ecb2ae947540a648ec9b2d7117907a117cf44ccc5849e3123bcbfdec6958", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597192, "uuid": "4267e527-2bec-4df1-bfe1-46692425c596", "comment": "Malware payload (Quakbot)", "value": "1e85dfd044a703a4d22f43843891633ace5af16e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597192, "uuid": "1f3f4f82-fafb-46cf-9574-1d5ad6f49317", "comment": "Malware payload (Quakbot)", "value": "be2cd4cc548368aec55cfa135dfb4e998520862f08496eb1d566a8157fc9c49ae1d0a9f5f92c3613673ab1b80ed2fda6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597192, "uuid": "298f3133-9ef7-4da7-87bb-61f9b29de7bf", "value": "T11CF46C403A55E521E6BD1A328F2AD5E807187D089FB5B4DF79E03F1F2AB98D3C621316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597192, "uuid": "24ed3cb5-19f3-4b3d-8975-aa1d61c7c834", "value": "3a9ce6dbfabfc6032e0cfde571419746", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597192, "uuid": "2c50979b-1767-4ff2-8725-fcab5fc5dfe9", "value": "12288:y+bAcis08s7gQFMWC24/MFS+AWmdXWJIjJ5F3+DpEFs3H6v/+hoTN:ysDis0dFA24/MFSptoJKnx+NE23a3+hS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597192, "uuid": "237b74ca-5170-4646-b628-08975908f80f", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597192, "uuid": "da755cd1-6e36-47b5-b8b3-07a827859390", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597192, "uuid": "c60d837a-4a76-4352-b1ad-eaf4ab00c656", "value": "2fd9d16b315b1a29f3e266999f00964d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d135ad9-27ca-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633651090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633651090, "uuid": "65da0665-0ffc-41bb-8e00-052072a9c007", "comment": "Malware payload", "value": "db6a30fc47f61794d43ca50f0ac635fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633651090, "uuid": "2156917f-e4d9-422f-b8e9-f1b0c1f922b6", "comment": "Malware payload", "value": "66bdb3d017940a7e98df679cb8f45858467ef83a4d5799db1d38341c924c0692", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633651090, "uuid": "1bb4eeba-f97b-4dbe-9e18-8a6baf32b1a3", "comment": "Malware payload", "value": "744de91e5415fbe576d1a7e2a958e248794c8785", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633651090, "uuid": "5ac67e94-3374-4151-b2a1-01c3339881cc", "comment": "Malware payload", "value": "112812d3d0ede9ad723ec56c812b68d901b3532abf3f3701c0648b5f500a1172c6dc9323743d3c33d8373ee9387ab5dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633651090, "uuid": "999e41a6-ca68-4c4c-b7cd-ef8b5d80665b", "value": "T16284BF10B7A0C035F1B756F84D7982B9A93F3EA1673594CF12D52AEA5A34AE0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633651090, "uuid": "11732c20-13a4-4a87-86cb-cbae39dfbb47", "value": "5723d007fd3b79d5a0887de51ad72442", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633651090, "uuid": "230758b6-6620-4718-98a1-5e0ca2fbdd64", "value": "6144:hFPovweuq85MHHpGrYHlV25ToGj6MLSKBu45PbNnAmO:YqqGYGUD2OGj6MGKBVPbN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633651090, "uuid": "c7c40bc8-8823-41ec-8083-e4a5ddc6ddeb", "value": 395264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633651090, "uuid": "1bd0fe81-c7ee-43a2-a027-afa7c57d08f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633651090, "uuid": "5b3ed03f-e8d2-4d08-8bca-88f1bd9613d9", "value": "db6a30fc47f61794d43ca50f0ac635fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9bc934-2771-11ec-843c-42010a9c0014", "comment": "Malware payload (OskiStealer)", "timestamp": 1633612923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633612923, "uuid": "1dd99ffc-ba88-464c-96ab-e7482bd3b1a2", "comment": "Malware payload (OskiStealer)", "value": "6f61c27f84af398ed8658f08c2ec80c2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633612923, "uuid": "59305d8a-7f04-4fdd-b513-0f955ea4190d", "comment": "Malware payload (OskiStealer)", "value": "6799ea57ad108c43c3425f3a57f884337192be71c982b34ad2fd12000164a6d5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633612923, "uuid": "b0c2b3bd-4780-41ea-b022-41da04c397a3", "comment": "Malware payload (OskiStealer)", "value": "d03ce754dccd28595a8ca3401822526c587b11dd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633612923, "uuid": "d9f24219-2779-4355-a875-1579f808fcde", "comment": "Malware payload (OskiStealer)", "value": "d69d43f3bf5a20f1565d269ef7441cd358289d81421fbca982b11e0ab84f7c0d7e2fe5f7a1f85d21faf97fc8cce7582e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633612923, "uuid": "cd0af244-a157-417d-bf1e-ba3d29ca620f", "value": "T15CE2CB7DF1870A98CF8697B8130B2F81164CF51CF3D995B236A8DB3866C4D7A961293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633612923, "uuid": "ccfc7fcd-19c6-4f7c-bc70-3eef0bcaa681", "value": "768:el0DWZMDVJx8YBN75a5j2OS3Ktsl959SvMpaOWbSRCDuLRYcxm/l:U0jVJx8YBN75a5j2OS3Ktsl959SvMpa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633612923, "uuid": "9711f162-9842-4729-b872-5684d8a81042", "value": 32147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633612923, "uuid": "d490c73b-05ee-418e-8a1a-dedbd60f917d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633612923, "uuid": "86829983-748f-4f64-9fb5-9aba59e1f895", "value": "Order confirmation MSDHG021098.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "928e6c47-274f-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633598325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598325, "uuid": "b4ddf76f-bfa8-4d4b-8c6b-004c5bb37479", "comment": "Malware payload (Loki)", "value": "98ad578dd96ce376c62933e45358d392", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598325, "uuid": "d9645a2a-6fd3-46b3-8da7-9d8a1bf5b64a", "comment": "Malware payload (Loki)", "value": "67b5904c0db4a096d762df5b3133d2419e1149bba682f619e33b8a7f8ef5250d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598325, "uuid": "67b5e5bf-85f1-4e2d-8307-b3e3b09009b2", "comment": "Malware payload (Loki)", "value": "b8a1093853b333996d9c05005632705825f1a027", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598325, "uuid": "ef417b6d-a832-49fe-abc5-d500360db928", "comment": "Malware payload (Loki)", "value": "138a14da1c13cdf7f9e35b696c308d0c7d840a804ec198b5ad4b0b15289a892d1d8a95981390ccddfdeca11e7671d751", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598325, "uuid": "fd3bb0d2-5d05-4704-aac0-31d04ab6507c", "value": "T1B174CF7D3363CC04DE314276EDDED26013A9A892316AD77A3A9E71BD64623F40DC46CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598325, "uuid": "b3d8919f-25e7-48a5-95c4-5ed31a930b3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598325, "uuid": "daccbdaa-7324-4e84-b399-f02e1abcdf84", "value": "6144:R2QmaiAPBkQ+3HwOZr+ju7TjEqO9IdoaEEMz0iqHURlrWEUgXNVLt+NhUyMGG:IaiYloyCTh+IlEEGYURlrWfgXrt+Aw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598325, "uuid": "a1fc45b1-c31d-4eac-88db-871a2e5700df", "value": 341504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598325, "uuid": "1dc70a63-9ed8-4e87-bf6a-94b47489e919", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598325, "uuid": "7a844a70-78d4-4922-adde-5392c5c53b87", "value": "98ad578dd96ce376c62933e45358d392.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eabfcfd4-277b-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633617371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633617371, "uuid": "14defb24-11ce-4612-9776-7ebbf0c72ab1", "comment": "Malware payload (Quakbot)", "value": "11bf9a8771d6ab2ad341d058e4730215", "object_relation": "md5", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama111", "colour": "#5A8007", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633617371, "uuid": "fe5c9035-d577-415b-86e5-ab300fbc5ed0", "comment": "Malware payload (Quakbot)", "value": "67f1da76518474cd5a0ff14401df059ffd8257a0fd70bf4f654757e33922953f", "object_relation": "sha256", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama111", "colour": "#5A8007", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633617371, "uuid": "f8735a30-0954-449e-bf20-3c10ab5ff931", "comment": "Malware payload (Quakbot)", "value": "67b7f130b7f5510ff24e1e8a5129ead89490673e", "object_relation": "sha1", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama111", "colour": "#5A8007", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633617371, "uuid": "b2424007-15d6-41e4-98ac-30baf8074074", "comment": "Malware payload (Quakbot)", "value": "a18ad1e5d39edf30c71078e99051e1333dff557887ac8982c27f221def50ded4ae310fbf2b7b24094c4521a56eafe1fe", "object_relation": "sha3-384", "Tag": [ { "name": "dat", "colour": "#F15A56", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama111", "colour": "#5A8007", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633617371, "uuid": "e2a957b9-911a-4050-9e14-aa2b70201976", "value": "T1B8057D013A84D431E7EA55318E29D6E40A5C7C14DEB0A5CFBAE07F2F2AB89F3D215316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633617371, "uuid": "2eb53bb2-ebc6-4a20-92f1-7e22a84edc36", "value": "0bb088133cc4ca3c25a91945e93e2571", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633617371, "uuid": "792c6dce-1b12-4a64-8891-b812a7efb185", "value": "24576:egjCOuBER57hemWxOVCy632yHAMnbOMmpK6kMXn9vM+GGVdrhDDlIF:eur57hemWxOVCytCrbxmpvX90+XVd9DK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633617371, "uuid": "02bb7ce2-a3f5-4713-9ed6-025c91ac1fb9", "value": 844800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633617371, "uuid": "ad6b2499-9109-4212-adf7-f811aea99e0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633617371, "uuid": "6fc9c2fa-12bb-4e56-ae26-9bfa0a3b1b2b", "value": "44476.5965130787.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd0b8fc-274a-11ec-843c-42010a9c0014", "comment": "Malware payload (a310Logger)", "timestamp": 1633596119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596119, "uuid": "78adcb31-3dae-4d39-9053-f1f85a455aea", "comment": "Malware payload (a310Logger)", "value": "55e2cd3776de61fd52462013c5eea531", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596119, "uuid": "36200a70-3388-4d6a-be55-df32f70366cb", "comment": "Malware payload (a310Logger)", "value": "683de9f06f811629c5ff539256f0674ddcf03a60baa60783e8ef2dc1496d8b7c", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596119, "uuid": "37ca6cc1-4459-4269-bf5a-7d6e4f9d050c", "comment": "Malware payload (a310Logger)", "value": "256f42c8f4d5e0fcfc38ebe304216c7619e6fd40", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596119, "uuid": "2f7bc302-83d0-437f-bdf0-18ca74e7155e", "comment": "Malware payload (a310Logger)", "value": "d02afe155c41c29854494cf7ac68180aafd14b59acf575351c9a6759c7cc75d78eac29e9d8400c7d00b17e6b075bcfa1", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596119, "uuid": "2120cff1-c39c-4dfb-91f1-0ae7b1bf4aaf", "value": "T19CB2E911E685C922D4737A3A9C9582F80979BD1BBC93A76FA9CC3F0E3DF22040791961", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596119, "uuid": "c6b0de9a-ccf8-422c-a07b-01ff5d0c90b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596119, "uuid": "3d462144-fba5-4132-beae-2f0bd593a6e6", "value": "96:8ArEtY8srgeWU+0EEyhzmxJ2lQx/jCQS9epPh+mXT/PQyhfVPUkTDLotU6MzuvzZ:hEC8sWU+rEyhzmxJfNjClu0mknQIR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633596119, "uuid": "99e6487d-4991-46ee-9263-d9b4699f8e41", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633596119, "uuid": "e0d7fb8d-f2b8-47b9-89c6-47c55297148d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596119, "uuid": "a200e913-c635-440b-9491-15281c321508", "value": "IMG_741000106237874.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ad442d-273f-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633591294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591294, "uuid": "2afa11ff-dc61-4472-a008-ee9e4a229893", "comment": "Malware payload (Loki)", "value": "5a517571f07854b5c0e0d965a4248738", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591294, "uuid": "5359dc82-c6e0-43ca-be7e-8a6c7a62eb88", "comment": "Malware payload (Loki)", "value": "686a68e8e1ccc87dc242f6cd7041af9e6cf5eefcda3877f45201bd9a53937cc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591294, "uuid": "9fd2cab7-a2ab-4176-b8de-1881fa01ec19", "comment": "Malware payload (Loki)", "value": "4a71f9a5b80c04c6d9671bbd73ad300ee055d752", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591294, "uuid": "c3b7ee51-2d78-40a3-908b-be498fe0de79", "comment": "Malware payload (Loki)", "value": "9c8ee0ef94e0568efc1449741ba8a538dd8d24664e93c27074dbec7b9d84ac5de67cc4ac741fa052bb6c70c80d9e05d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591294, "uuid": "9281696c-95df-4256-8362-2fbc657dce43", "value": "T1AC74DF3A3267D905DF7147B6ED9DE15013B8AC13302ADB396A9E71AC3812BF44DC09DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591294, "uuid": "f11cd256-8d15-4452-a5b5-87ecc93f9586", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591294, "uuid": "02e3a816-a0eb-477f-8001-066496176527", "value": "6144:T66Ws9Q+3HwOFBf6wQAPdazQOWzPlKo3lUPeWkxyt2rS9RklK:T66V2oFBf6b4a0FdjVUPeWnteS9R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591294, "uuid": "7cdeba64-65e4-4afb-b2de-0304f8cae4a2", "value": 346112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591294, "uuid": "3168b88a-7f9e-4995-b288-3971ed98a022", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591294, "uuid": "ea2b7cfa-57c1-4b44-ba54-bce27b789e62", "value": "21038315RI0007903596242.pdf.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b8d19f-2740-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633591732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591732, "uuid": "ffdc74fb-5d45-469e-8ec6-e76d3a749f22", "comment": "Malware payload (AgentTesla)", "value": "8fcca114ddbaf621b24df0bddc018533", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591732, "uuid": "bf5ac14e-62ce-4e96-9804-0dbd2cfae2cd", "comment": "Malware payload (AgentTesla)", "value": "68a69505c637b5283ed4dafe5a92e6c996b1edca98a4e5546b6608e6e4759daa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591732, "uuid": "57615e3e-b700-4abe-b031-be9d3813c7f6", "comment": "Malware payload (AgentTesla)", "value": "79a65983c30f59e0e061e4153b920ac189569c0a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591732, "uuid": "82a8db09-fdbe-4abe-b8b1-d17efd0e2fee", "comment": "Malware payload (AgentTesla)", "value": "1e984a9a8c462ad176278b96879818840015155d1b6f96d59e4b9bb0cfb44c52a5183f1a67d92d7a3533365722405cb9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591732, "uuid": "e4df96df-9ae3-479c-b79b-6a439cb0a2d2", "value": "T11C3272011BDC59F68728F23383B9850945FDFA33350216E9B99EA1823BBD30D5EB91B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591732, "uuid": "83dca132-fabc-46c5-b502-fe1ca2b45a71", "value": "192:kSlNBdY7dvk5+708afKW4TZjSosCpE1ZdOhIKwTciH+PqeiKsQhNystP:TNBa7dvk5+70zcZGosCpEghUTcZw38hV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591732, "uuid": "3981f21b-8f5d-4c8c-8cba-b29e1786858a", "value": 11888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591732, "uuid": "7a1b4294-dc84-48c9-ac5f-890a9762e75c", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591732, "uuid": "69fe7491-57be-4cac-9470-9f53a66f0891", "value": "Purchase Order_0190.doc__.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "147cfc3e-271c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633576209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576209, "uuid": "f8a61e76-1e03-43c3-b4eb-1315a20ffd10", "comment": "Malware payload (Mirai)", "value": "bc7b1bbe19b3cd9288a89a1ec1bdb434", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576209, "uuid": "fab9716b-0069-4adf-9411-5f248e52b913", "comment": "Malware payload (Mirai)", "value": "69708c5dc9031ebbaa0f80b90e6dfb35aec6ea0a81bdcb52994a3def4f44d429", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576209, "uuid": "a39a2f9a-4ba8-4a2e-b7cb-416163bffd57", "comment": "Malware payload (Mirai)", "value": "5367c506f588231d6db658f01299da0c09f82c42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576209, "uuid": "1ebdbff8-8371-4826-a151-af8a6fdfe3fe", "comment": "Malware payload (Mirai)", "value": "d804de2f7359886bdaf4b92e64d25d1bbf412902a029fef6faa082b8370512dbd44d8d6c79998f7213d5ddb2cdd01b25", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576209, "uuid": "087af80b-b751-4ae9-97c9-73ffe41551dc", "value": "T18293D593FC01EF6BF40BA77644E34815B530BFA60EA25A767213789B9D3A0D51823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576209, "uuid": "1c404f26-7ef6-4134-abf7-a434540c0ea3", "value": "1536:AcpLOIVa0aIh8FuX2W4Wsyf0/zH1B3fc+iDwy8RAlA:AcpyqaId+WFMXxiDwy8RAlA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633576209, "uuid": "cff43d77-71c8-4eda-9667-880a35486afe", "value": 89492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633576209, "uuid": "ca325546-5dd3-434b-9d52-d986e34e050c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576209, "uuid": "e132b92a-1a85-441b-a514-d0669b80700b", "value": "bc7b1bbe19b3cd9288a89a1ec1bdb434", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1db849-2735-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633586965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586965, "uuid": "db5979c1-9c6b-4dd5-8843-24db12687aa9", "comment": "Malware payload (AgentTesla)", "value": "60a657f422b234e324eda7d379d45552", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586965, "uuid": "23edd311-36d2-47e3-a928-24c2ac9e4b7e", "comment": "Malware payload (AgentTesla)", "value": "69778ccedf60d308794f32b8549e7a928fb83f73a504b79a066ceee66870e0f8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586965, "uuid": "50416f93-09eb-441f-8c5e-11fb110f2c31", "comment": "Malware payload (AgentTesla)", "value": "52772e7bb7a3bba936660affa345b60847d942e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586965, "uuid": "18f29923-c4b9-4216-889f-d89568cf50a6", "comment": "Malware payload (AgentTesla)", "value": "b87a1efa46cd69633076803f2cddbd7652d355471dff767b63629d28a9cf50aa9e54f52f9e1aad31f5d49b9ce34100e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586965, "uuid": "928cace6-f4dd-45da-a3ac-832980de588a", "value": "T177D4CFB92157C808EE21CB3D986D9B541B7A7DF2343DD65C2C59782B3A333A708E45CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586965, "uuid": "a6bc8d8f-4509-42ad-b21a-28494a0fdb80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586965, "uuid": "8a4ffb6e-1fa5-4b85-9679-b6c9aa8b26b7", "value": "12288:lvUHoiiUpEuxYhlR0AiO5l9t0Xf5+t7qpVUnt:GHXBihz0ROW5eft", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633586965, "uuid": "419b29c6-66de-495b-b2b2-64d6fd5952bd", "value": 601600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633586965, "uuid": "01ceb631-508c-45e7-b040-ae7fa7c76cc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586965, "uuid": "3adc5a7c-7d34-46e5-855b-62e8e7981430", "value": "Protected copy of the commercial invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8de3515-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633597530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597530, "uuid": "c1426ca5-3db9-4130-a3d2-6067f04ab5c0", "comment": "Malware payload (Formbook)", "value": "e1ca1940bfbbff01e2f31a0599da9143", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597530, "uuid": "30ea38bc-529a-4750-9689-2aab85fda15d", "comment": "Malware payload (Formbook)", "value": "6a20455649aa4f8c50bb4c887ff24c4f7865f585d39423e25be18335b1c62951", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597530, "uuid": "03bd5a71-887b-449f-b45e-4d8ed2045b6a", "comment": "Malware payload (Formbook)", "value": "972ea178d5830244cd72b81b22bf568cfd5f62a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597530, "uuid": "18eb1f86-9cdb-4257-a6ce-313b5f17764c", "comment": "Malware payload (Formbook)", "value": "d2faeea777e35d7b0b9fe7c01175ab1a2ef0272b9fd7b0c1da1a56bc84e2749d96e72a465ab841f4dea1c3dea4bf118e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597530, "uuid": "e11e55a3-1b0d-4212-b316-6cb591aaf3d6", "value": "T16B158DABA1C15A3BD22F357F785706D83C176E222E3AAAC53AF41D4D3E74501B93811B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597530, "uuid": "78200b40-ab73-4385-adb3-4c0d961e45c5", "value": "a75c37244e3bdfe1f2052f7c93d03b4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597530, "uuid": "721c0694-5e21-4d44-97b4-65c35947c2e0", "value": "24576:nWv+QwSKgQ0qgQDKqOTLDE4beJlzNgojDGBav:WmWKgNxLQ4kRNRG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597530, "uuid": "311edf83-50a7-4fcc-9f41-2df71a554188", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597530, "uuid": "15eecdb2-a5b8-44bf-a221-f53ea94d6010", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597530, "uuid": "a3894f12-18ca-4aff-8169-6298f6481139", "value": "e1ca1940bfbbff01e2f31a0599da9143.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f2633b-2784-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633621170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621170, "uuid": "748ee75f-bd4e-439f-bd48-a20446a1e8f2", "comment": "Malware payload (Metamorfo)", "value": "a4b5950b7ec48255a991f1dc1d2da432", "object_relation": "md5", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621170, "uuid": "56ab7e54-5cc6-4e65-b96a-f78ae1674960", "comment": "Malware payload (Metamorfo)", "value": "6a2ab942387df2a39b7aae7aaec6260198aae3c45389542d0b543b630d03cd40", "object_relation": "sha256", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621170, "uuid": "f184c75a-556d-4975-a09f-0788a3a8832e", "comment": "Malware payload (Metamorfo)", "value": "1b6bc9c4c81169022b530c867427d6f67383cc22", "object_relation": "sha1", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621170, "uuid": "48c1f9b9-66a9-4447-9a00-fa62c482c132", "comment": "Malware payload (Metamorfo)", "value": "5648a664f3a39d5b2bb0f40fa4144c5f363657a5c456bd02369bc6783d4acc7d5fb62790b1d56f2a909f7f7b0cfe973f", "object_relation": "sha3-384", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621170, "uuid": "efb2a67e-e16c-4150-8acf-57f5d621924d", "value": "T1B8447D06B3D5437AE4DB07721B8B93628A72EC788673412B1249790E3EF1554B7B73E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621170, "uuid": "2963ffd3-4aeb-4ee9-ad9c-87d39d4ced04", "value": "3072:9mB4Ay903DaY4Auwgz88ereWn/7w05g04McB3RUN46ILJ9+ZB5yOanvn:9mF3DaY4Ar8er1nzTJron", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633621170, "uuid": "8440bf92-796e-40c5-88d9-e30f790f44c2", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633621170, "uuid": "e7b1d17a-371f-4e33-920c-f4a3627562c1", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621170, "uuid": "d1517edd-e554-459e-b245-91d462933869", "value": "a4b5950b7ec48255a991f1dc1d2da432.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6f9d99-27b1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633640516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633640516, "uuid": "64472a81-e216-4466-8f09-d8443b9dc4d4", "comment": "Malware payload (AgentTesla)", "value": "b0061c129f5f763fb825c1d32e24770e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633640516, "uuid": "5b8301a3-b318-40c0-b51e-a247a0d80395", "comment": "Malware payload (AgentTesla)", "value": "6a5511d8796008b942759967eb9f73c46fdfeaaf7f5c2b45f936a937a4d65945", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633640516, "uuid": "505843b8-b728-47c5-a00f-3ed3a4b4eecc", "comment": "Malware payload (AgentTesla)", "value": "cbb37922a2db03187321125594a69da6bcfcf32b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633640516, "uuid": "27cbe8fb-0da1-4c48-b397-9b0c5f99cf38", "comment": "Malware payload (AgentTesla)", "value": "c5423761449cc230a538ffcf28b7373191bb2eea9f5b2cb137daf2cca3173b83da145cb01a67e0f5a959bad5812a9042", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633640516, "uuid": "24fd8341-2be6-4a5a-83a0-04cc0f7c1dc3", "value": "T11365B3583610F19EC457A9B2C954DDF0E6106C66C71AC243A0E33EAFBA7DA57CF101EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633640516, "uuid": "cc809935-f473-42e1-a6ad-1acfae31ca39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633640516, "uuid": "383f8c67-0ad2-4bda-b96f-c06c9bfba93e", "value": "24576:mrPxoL+1tOP1qDHbyGVDqjh5vE61w+L7D:IxA+1YiyGVGjjvriW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633640516, "uuid": "9e57645f-0c92-4935-a50d-6ce30bb8eb4f", "value": 1421312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633640516, "uuid": "729e84f0-fee8-454f-b437-342bd66cb0d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633640516, "uuid": "ccf6cd98-43c4-43de-863e-3ab8e1eb85cf", "value": "Docs.6578000.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e118c073-2742-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633592873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592873, "uuid": "df2cc630-d053-4ec1-926d-892054cc9be5", "comment": "Malware payload", "value": "5eb74c6daca4be15f220cab851964c63", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592873, "uuid": "5decc7ec-f283-40eb-807d-4fd86353b1d6", "comment": "Malware payload", "value": "6add2eaf3d7f94c815562a135ea4099677e798b164cfeb205db9660afc2d1eb9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592873, "uuid": "d9c6775e-ad95-4315-8108-9d8a4da6c1f4", "comment": "Malware payload", "value": "4f28a6a2112a475a9b3256cbe8b2a10187253641", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592873, "uuid": "9005c4af-c0b9-45f5-8c96-d011771ba1d2", "comment": "Malware payload", "value": "7d48937875fdeb9df4f31205916c21a96bd71c80b7a6c3787db2e666ea5813a0b10b4a7c1e9de01289750c02a37c5531", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592873, "uuid": "62841f33-1205-41f2-b949-da3b0a8a4ed4", "value": "T108068088DE62E92610072BB7AF22C0F1E7ED1C5420C89E7CD588B494F59DDECD5EA790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592873, "uuid": "04f719f0-7b44-47d8-96cb-d67617e29af4", "value": "24576:wuJcxZtpQjNOBsKCHl4Ozh2n7HocMTtQACNeEXYK4eTVleZUnMugJxFdKolpPFS1:tvULN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633592873, "uuid": "f9f27c97-db92-4179-b4ec-3628b9ddd2a3", "value": 3810596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633592873, "uuid": "8354571e-67a6-4c10-8f79-5b7f98381a7d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592873, "uuid": "662fed55-b651-4450-84e9-3dd4012c8a7d", "value": "Transaction_Compliance_hold_jpg.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99041553-278c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633624535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624535, "uuid": "20f705e1-ef63-476a-83e7-6c09069f8d17", "comment": "Malware payload (Gafgyt)", "value": "5626857a79c67c971d9f437bd76b2d59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624535, "uuid": "82540a8e-9f97-4f81-a24e-949023757b80", "comment": "Malware payload (Gafgyt)", "value": "6ba02a0272aa0d35f58bfbf4d02905e26127b7348307e41775403864d8048d9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624535, "uuid": "a7d3fbe1-41dd-4812-ac76-ef26580f452e", "comment": "Malware payload (Gafgyt)", "value": "75710028c77ce363a984b37ceca8507d8c91cdc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624535, "uuid": "13536f25-d0bf-4bb4-964e-7d87f5a49173", "comment": "Malware payload (Gafgyt)", "value": "5285bd2282043c27ce857f4314d650335fd96e6755d72f5e4113c412b8aa138d8f716e6fd80c215ec5117e1193ed6bf0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624535, "uuid": "a940254c-ab6c-4808-ac37-7dde6389ba0c", "value": "T11FB3952A7E22FFFEE168863107F35F7087D521A226919385F26CE6181E7128D1C9F764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624535, "uuid": "1b51ffa3-bae5-41fd-b562-16965c2e289e", "value": "3072:R/4tNF9U4vvPKw6J73x8UmkiSFxfKxbXe:BUNFK+P8T8UmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633624535, "uuid": "6fb7e4e9-ebaf-49d8-8d44-3362abe67ce3", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633624535, "uuid": "03b9ae5f-c2ca-415c-be89-5bccd459fdd8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624535, "uuid": "57f0abb5-63fd-42d5-835d-268c2ce13926", "value": "5626857a79c67c971d9f437bd76b2d59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccdda984-273f-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633591551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591551, "uuid": "79609e1b-3c80-45e2-82cf-a566b9013fd9", "comment": "Malware payload (RaccoonStealer)", "value": "60d1952aeb47a0757386da9571162f56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591551, "uuid": "6f76c5ce-f5fc-447f-b07c-1749f4ce75ce", "comment": "Malware payload (RaccoonStealer)", "value": "6dfce00750c09d7a9927dab4bed6b81a4043fab36fba5ddf5c5536c3503dfb10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591551, "uuid": "9e691edf-e1db-4b66-a04f-3289e1cfbc31", "comment": "Malware payload (RaccoonStealer)", "value": "5a63557cd825e64db48c2e3e477ee1eb4e84852a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591551, "uuid": "ece71daa-73a0-46a2-aa63-e508b5a0fce2", "comment": "Malware payload (RaccoonStealer)", "value": "d3466be6390a72dbc09675e026d981ed06b94e349bc74d3e1258697daf28efe6875cfc9de083a6e23c85dbcdd6159577", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591551, "uuid": "55f3da78-2be3-4cfa-930f-75a8e9dfd89e", "value": "T11EA4E100EBE0C038F5B752B54A7A93E4653D7EB19B3894CB22D61AF65B746E4AC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591551, "uuid": "cf326682-02e8-4978-bf04-3d2ca50bb16d", "value": "558186eb4208ff26294240429e60d1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591551, "uuid": "ea695082-e592-4c94-8b16-7a89e8e154de", "value": "12288:WFijbeQfVFLQ0DtY/f4roL0RVjBzKhAq+RsrPTygk14s:WFsFLJe/Yo+VjB2A3OTygt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591551, "uuid": "02eec922-208c-489d-bcc8-434f7aea656d", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591551, "uuid": "1b9eccac-5759-46c8-a254-ebf9df3053ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591551, "uuid": "72e33060-1f7a-4135-b2f1-915438951c48", "value": "6dfce00750c09d7a9927dab4bed6b81a4043fab36fba5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a2b281-276a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633609769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633609769, "uuid": "288825cb-a722-46f7-b78a-201a8c18af2a", "comment": "Malware payload (AgentTesla)", "value": "6d29afda87e482e464edf200b602dca1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633609769, "uuid": "4fe514b2-8187-454f-8f49-af7054584614", "comment": "Malware payload (AgentTesla)", "value": "6dfe16250bb830a1f95feb9d365d56fa7b0f9c48371fdb8fe81cd844ca262d83", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633609769, "uuid": "7ad7534b-07b1-4ffc-babf-a41c5a837497", "comment": "Malware payload (AgentTesla)", "value": "494604b46b5c717c89e32c6eac10b1ff542c2ed5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633609769, "uuid": "951c20e8-5418-491c-8354-e665e5f3423e", "comment": "Malware payload (AgentTesla)", "value": "f16ffa5bdc10547624f67d06d89b2fe606acbf747472f6f1391cb390d5dd3f86be40eaad3a51aa6e06da4f6a0eaed824", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633609769, "uuid": "d470c733-c33e-49c7-b74d-34f4b1736610", "value": "T17815205363AC8ED4C06792B4DFC1C4B96C09D9EE421A53B4AB12AB64F75FC031E6A473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633609769, "uuid": "66497d33-8965-4f59-8bf5-dfe54c62cf8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633609769, "uuid": "8c14f928-99f3-45f0-8b13-c786c7f73a2f", "value": "6144:E9A76Uq8WcCOtaUaxB+6khy0gM6Tx5UourIRfUTdrgESfjif:E3UDWcCCaz+th56Tz4IUgESW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633609769, "uuid": "f0e01c59-7445-4e96-a675-32cf122ffcd1", "value": 902656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633609769, "uuid": "dd1efa06-12fd-47ab-bcfd-da78c7a5f961", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633609769, "uuid": "0f848cca-b331-482e-aee3-50b4c37a8b54", "value": "Md7YRHWBvo2Zprb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8998fa77-2743-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633593156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593156, "uuid": "3b483035-16d9-4c40-a04a-8a5eca9a37d4", "comment": "Malware payload (Formbook)", "value": "46bf448f0f13973dca9b0818f23fbdcb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593156, "uuid": "c24c99e5-52c4-40a9-a2d1-ea3e341b9b50", "comment": "Malware payload (Formbook)", "value": "700c8d2a1ebc0994ccd09f93acadb4806ed3554cdef24c8e9ef0b3801646bbde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593156, "uuid": "bbe1ce49-5780-458c-84d2-507ca613393f", "comment": "Malware payload (Formbook)", "value": "83e78c785903a560b44bd419f5a2e74266a98eab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593156, "uuid": "657b1544-02ab-4a25-80ec-8e9cb4b5fb79", "comment": "Malware payload (Formbook)", "value": "845bd34fa51609432714cd0a8041e58c26aba30d93d69f6f835006c32ab64ac4915a92c0643244f661f3bf3693510c92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593156, "uuid": "87bfd438-a0fc-420e-a6fe-d07f90b90104", "value": "T1D4F45B43F6D2C1B2E0372E741C4782788C1C2D15DED4E58F25E4BB9DEA396932B164AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593156, "uuid": "9951269b-9650-4c29-bb4e-6216f6ec7178", "value": "a85da29f7c79b749e46738d8b965ea53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593156, "uuid": "a0736074-8aca-4415-a1c5-30534e61514d", "value": "12288:5siTtPf0MEakNE3XqKkjY2Nh4kY7CE5L0S4rrMGdMpGyS:KaF0MEakNMrkE2UkY7CE5L0S4PMGdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593156, "uuid": "4b3bfdd5-0b18-4aa9-8729-15e512cd668c", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593156, "uuid": "ef5dd8ff-5403-4ee9-bb6b-ce66512b3b67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593156, "uuid": "88245398-56b9-43ab-ab97-9d63834ec916", "value": "IMG100897 TWI-SHA 202102 BANK SHEETS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1859a45-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633597491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597491, "uuid": "f39dfa09-e9cc-4bfa-bf4d-45298ce89343", "comment": "Malware payload (ArkeiStealer)", "value": "a52c4745cdbcd6ac7019c968d8a05f44", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597491, "uuid": "a245c6ef-b69a-4a58-a018-97cbf750dfd9", "comment": "Malware payload (ArkeiStealer)", "value": "71247faf517e2d421cda99741856f21bc1eec72ac6e6ae4aa8a5ca5e5b7e7db4", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597491, "uuid": "cdcd82c0-458d-4ef3-a7e0-53d80822224e", "comment": "Malware payload (ArkeiStealer)", "value": "bfc22a9ff6647aaa0c5962b18d2af18a8404db5e", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597491, "uuid": "1cb4789c-2995-4c39-bbbe-2221f7398ad3", "comment": "Malware payload (ArkeiStealer)", "value": "86add3dd163a4966f45b1743876f6360c43657124e05b6880764164e60ab55a626bb38df142de0efbb5a41708f33b7a5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597491, "uuid": "1b879d30-8b16-4ae8-9124-5ad7a76721b8", "value": "T12FE4012036E5C536EBB769340E71D3B5673A78729931D58B3BED162F9F35290CA2030A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597491, "uuid": "d0c57aab-ccc9-4055-8d9b-42ce58e8fedc", "value": "01c64e8a0bf942eae9e15adaebb52144", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597491, "uuid": "23325b67-10eb-432e-a47a-e54d971fface", "value": "12288:uMmQ5jljgOMl77yYH+tyVmiWs8M8F+nJG0l/Qf+o0l7oelF9UwN7NFeH8VWcASKV:BmQ5mV7+6vnJBfo03Ugs8VWcFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597491, "uuid": "6a8d9c4d-f7f2-4d85-ad42-e70e12abcea2", "value": 666624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597491, "uuid": "fea33187-ab67-4486-be60-2a72b5eb4ecc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597491, "uuid": "4ec9aab0-d737-4f59-851b-6526e1916eb4", "value": "a52c4745cdbcd6ac7019c968d8a05f44.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63a176cd-2743-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633593092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593092, "uuid": "e37ad583-5ec7-4a45-9d68-e5607c3af0e0", "comment": "Malware payload (RemcosRAT)", "value": "7cdc19a52a1d3ecc98520d2f3393a586", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593092, "uuid": "6725c8b5-9ce3-4d7c-8a34-65db5266d83d", "comment": "Malware payload (RemcosRAT)", "value": "712c752641d2f7b504efd7631bb3b36dbdbafcc3fd4a371dbe03b5499ac67053", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593092, "uuid": "fe6b81a0-0c70-4267-8007-aeda77e4f573", "comment": "Malware payload (RemcosRAT)", "value": "955817835e85d8531f4cfa4bb04b24dae3c1bfc0", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593092, "uuid": "361c79cf-cdd8-42ac-87a7-d7d0906f4536", "comment": "Malware payload (RemcosRAT)", "value": "c265d7a4fc83ea7e8ee1f0c9472ae5aa64283fc5f0b94078a636511faa432ef0c91a18af806539827b3e2f31460613b7", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593092, "uuid": "dec20bff-6fbb-47fc-85d3-69b835010a33", "value": "T1BDF47C92FA81C835E0336D781C079AB59C5E3D12AD20994E67D1FBDDDF78893A22701B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593092, "uuid": "913a6801-f20f-4b2b-bca1-fbbefcdfc7a0", "value": "a85da29f7c79b749e46738d8b965ea53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593092, "uuid": "8584f7af-4f6a-4ca6-b255-26f911e1ecd8", "value": "12288:5siTtPf0MEakNE3XqKkjY2Ns4kY7CE5L0S4rrMGdMpGyS:KaF0MEakNMrkE2pkY7CE5L0S4PMGdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593092, "uuid": "eb33807d-1b44-4473-9833-39676d11403c", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593092, "uuid": "278480f5-a513-435c-be98-7bb518e41f64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593092, "uuid": "e6e42d3a-0b31-4af3-ad07-52f7558ee3a7", "value": "DHL_1012617429350,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8cfbaf-273d-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633590393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590393, "uuid": "9c96609f-cb75-4406-80ab-0adf80aca971", "comment": "Malware payload (TrickBot)", "value": "55ee6dca51e918bd51a000b0899e275a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590393, "uuid": "c76c989f-db47-4d76-9603-a66c42854ba1", "comment": "Malware payload (TrickBot)", "value": "72534ec2c4fc2499e1f85e9149598d240177afc8b9e7b04e1df2abcf92a7b677", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590393, "uuid": "039b0cfa-4458-45c0-80a8-b454c4af696b", "comment": "Malware payload (TrickBot)", "value": "fea67687d4fd185246267305a76b53060407c7e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590393, "uuid": "803e3f2d-99cb-49d2-a97a-18c414149686", "comment": "Malware payload (TrickBot)", "value": "0ced71bff6161a0e9e7737fa0e52950a285ae713b2297dfe493fd9663c9c3a42577c829e2a7df320f757f6aa7d5b79c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590393, "uuid": "302e6452-6d6f-437d-b8a1-eeefd06d65f2", "value": "T1E6F4CBF8AC20D695F896B5BAE8D0B84500017CBC75AF8F850554BB3E39E74849F989CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590393, "uuid": "f813d64e-7cd9-438c-882b-874e9068bc04", "value": "e94090a99a943b0e253b62a04e66d644", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590393, "uuid": "200b9458-9ce7-40fe-9632-85e80b373ef5", "value": "6144:uxkqYmlu8xpGrCYEmAO4sYb3+KnQk+pf4RZp1BpY6z1:uuqYmE8lm+HbH1Ef4RZTsW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633590393, "uuid": "ae7fcc66-d445-4506-acb5-873a4961ec1b", "value": 755712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633590393, "uuid": "6ab37f3f-221c-40ee-bed0-c8edf8ee8e25", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590393, "uuid": "733a3268-13fc-44ef-b604-0a22379513fe", "value": "55ee6dca51e918bd51a000b0899e275a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a01f59-278a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633623533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623533, "uuid": "edd6cbe3-e6f7-4d79-abfa-e2104f96d2e8", "comment": "Malware payload (Mirai)", "value": "67d89b95ca16f208957b686bbb63ca5d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623533, "uuid": "bde0b1e8-4b31-41c8-8641-835095fd9af2", "comment": "Malware payload (Mirai)", "value": "734e8f67e43c5e22dffab518d33eb9bcceb124da647b16e747fbcc889550eea5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623533, "uuid": "e9e985f5-5d2b-4cbd-a1e0-51e6e62b4d53", "comment": "Malware payload (Mirai)", "value": "9d5e9aadb86926cc312162acd3a69e2076a6f6ee", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623533, "uuid": "a6968efc-abc8-4ce3-8b7d-36f3e6181e60", "comment": "Malware payload (Mirai)", "value": "21c4fa60f3464e31d84dc040311450886415a21977b9a9f7e7ac220f76e70a6155401cf60e2a7524fe406423957e6fc5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623533, "uuid": "fdbb255f-b41b-40f2-a98c-92d633150a0d", "value": "T172730942BC819A6BC5D423FBEA6E118E3321B3F8D1DE3117CD114B24B69A52F0D67B52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623533, "uuid": "bd5f647e-7854-4cea-b250-caf2038cf249", "value": "1536:8SiA4CHGSsoOsZqAQ4WUf+xDIDQo8F4d1/sfCQAclTGxBYpp2b7zMPd42+caV3X:8tA4dfURWs8ojd1e3NGzYp2Sy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633623533, "uuid": "b91a28b5-d4ea-4f3f-a058-d81cfb0e121b", "value": 76660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633623533, "uuid": "b71f15b2-b274-4365-b497-99bf16b3f8d6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623533, "uuid": "7d7830c1-d22f-425e-8072-d817bb9e3be9", "value": "arm5-20211007-1618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "694f4c00-2759-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633602551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602551, "uuid": "92ef1444-d6a2-41ef-b93d-7a1fb173e954", "comment": "Malware payload (AgentTesla)", "value": "4f8e8a3db418436e86b97d5919197469", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602551, "uuid": "8fe910ae-e6c5-4ff9-aa6b-59687efcb20d", "comment": "Malware payload (AgentTesla)", "value": "736879ae8513016812f80ba90efbcec36af5b705fc3c76fc4fc1de67251df3d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602551, "uuid": "a9a7a996-4b52-4089-bfc8-896d6408d114", "comment": "Malware payload (AgentTesla)", "value": "4c96289d9ffc4489279a0a0da5117cdb9378732f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602551, "uuid": "22d4267c-e1d5-491c-a947-042677170f97", "comment": "Malware payload (AgentTesla)", "value": "c59db2dc988823a96029f95884bb7dcf2f8f2bb4fb2fbe0af966159caef18157f734ff840f59293b32441ff8b21bf85a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602551, "uuid": "4cd0c389-1a8d-4aff-887f-1386dd5ead41", "value": "T1F19423DA6DC4B9A649827CDEA23D310559F8F84324CF244DEF6C3A4A3174C61DABCD29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602551, "uuid": "3abb59a4-89df-4bb7-acdb-08d2f239d668", "value": "6144:4BKhUATNG5woSfElTr43mICDEW8tpXbxM4dxCdGDJuUzOvfATVLBarxvSMPBiub1:4BLKKwokl7W0tbK4dUGDlqvfwOdSMPV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633602551, "uuid": "acfcef17-732d-4221-a046-fd228c2c7264", "value": 418145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633602551, "uuid": "261dcf20-0394-48d8-8336-caac6ab52636", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602551, "uuid": "0098109b-9925-4271-b2cc-fedad7b8a007", "value": "new price quote inquiry FOB sgz67889 dfx46667.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd6676a-2743-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633593167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593167, "uuid": "bb52e6c2-6889-4b15-ad8d-06bf9d47c401", "comment": "Malware payload (AsyncRAT)", "value": "14e349ad8b785a87268f734b82117cd6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593167, "uuid": "2755e8f2-7631-451a-bcad-de149d7f72cb", "comment": "Malware payload (AsyncRAT)", "value": "73a0a0c9f5cf9b2eb8a16d8abe3252b30114f7f2f59b5551eea424c19fd5470d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593167, "uuid": "8e5f76d0-2918-4b0b-a182-3577b1133d33", "comment": "Malware payload (AsyncRAT)", "value": "1793603f9f89021f5931210f7919f21290d5e5b4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593167, "uuid": "7e87e506-333d-4d83-89b8-3cb7d917831c", "comment": "Malware payload (AsyncRAT)", "value": "7428e9c516aa090f46d6926a19adf88b3548bc0f2a8f22e1f8fcdcceef7c2d057c3759191d1f111d1cbc126b8337c8b2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593167, "uuid": "dbe7c0ca-7c12-44d8-b875-dec0ccd890eb", "value": "T11101DD01D56EFE770682F2669DCEA4A0F535178703B0C49A3061E165CC297F885EA682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593167, "uuid": "6d4ea58a-6692-48c4-84ff-d8a64537228c", "value": "12:IVuVDSb8Pgd3pm9iV5R9Gg2IIxmZ9y5H1mHnGo6R9GgAq:zjP2EUMg2IIxmZcnwnGoeMgAq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593167, "uuid": "a42bf232-fea5-4281-8394-2ae243aa2368", "value": 658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593167, "uuid": "1122160b-06d8-4ff0-9576-771322f350d8", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593167, "uuid": "1e3a95a5-10b0-4d28-8023-d62d40e0a022", "value": "DKWFO7791.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a9af91-2740-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633591918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591918, "uuid": "0896762c-202a-4fa4-8224-1c41a1cb5d81", "comment": "Malware payload (Loki)", "value": "13f1b67187e0dc31e560697d687e5c4f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591918, "uuid": "1e17e7fa-e789-4456-b5da-bfc474be4c63", "comment": "Malware payload (Loki)", "value": "75b2831d387a27b3ecfda6be6ff0523de50ec86e6ac3e7a2ce302690570b7d18", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591918, "uuid": "5aeb826f-a300-4108-ba9c-321fffc9b1a7", "comment": "Malware payload (Loki)", "value": "a74d39087c7c183615ce00a8672dde437b33fa0b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591918, "uuid": "b800e7e9-fe1a-484a-a050-5229b34d252e", "comment": "Malware payload (Loki)", "value": "ebea26f0a26fbcb5198c4fb31c1017b8403d6a3c869e6702e19c291234c736a69a87ba31b910503a25b08d3fc21bab7c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591918, "uuid": "2803d6f3-5927-47fe-a2f0-69120ee01797", "value": "T17594228C3A6B5B83F24B11372E45CD140876AC251F99E0677447BE8860BDFED3D528AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591918, "uuid": "5a2bb21f-77c2-4a56-ab6a-41930876c68b", "value": "6144:bx74rLfnj+uow3puUFdDN9J1hvB260p0BpdUK3M49LwijJ4alS1TAn6DEOlGqp3Y:d2mM3zJjvBVk09184pBGta6PFp3B8L3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591918, "uuid": "01c0eb7c-f3a3-4c2f-ac3b-b29947646264", "value": 410112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591918, "uuid": "da7ef492-d2db-4957-8a8a-5f265b1f9ab5", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591918, "uuid": "9f1b45ba-064c-4035-b41c-bc7b905e56f1", "value": "Order Acknowledgement(Indonesia).xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8ea9a4-2743-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1633593077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593077, "uuid": "599d1c0c-e7fa-4584-bbee-97ce477749dd", "comment": "Malware payload (BitRAT)", "value": "2c3192ab09b559948fac8108c85f0005", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593077, "uuid": "1e762479-1f6a-45b2-954c-2f77c6779f04", "comment": "Malware payload (BitRAT)", "value": "75f615f27b23cc56767ed8b3e684d69b27376165432116913f30cbc12c439fb2", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593077, "uuid": "ff555ed1-f19d-4345-adc7-cafe9a9f6ada", "comment": "Malware payload (BitRAT)", "value": "441b21fce961dd7436b6ac8aad64db509ad9de98", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593077, "uuid": "fa1e59c8-f1d7-4de7-90bb-81f37f44348a", "comment": "Malware payload (BitRAT)", "value": "dc94c9607af20612c00c70aa41717795e9c095e9c03a2dbbd5690d64617f174ef02f43c009aaeb2611f1aba39ed9ef38", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593077, "uuid": "c7c54f1b-928c-447d-81d4-6fbda3677ccc", "value": "T104D5D024B3CAD61BC82D0E3A083EAB8753E1F5C93739DA5E30DD17467B01966BF8A154", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593077, "uuid": "4f61ed40-aef2-4229-a777-f4b5b2cef058", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593077, "uuid": "b36c093b-2c37-4b62-818e-e175495b1821", "value": "24576:e7urW8H86ZAIHLPjl94j9srIq7w0HqOT7IsMCfrXB4h8iaVAYYb9ra8mkmrXFEf7:P/rjTSi7j1DXyh8ij0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593077, "uuid": "e7c92946-87f1-4f23-ac8b-c1c2699aaa35", "value": 2881536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593077, "uuid": "557ba409-1730-414c-a6f2-8a79aad5abae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593077, "uuid": "7f96738d-8a8e-4c8f-b659-3ce123876da8", "value": "DHL_Shipment_20210621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de7afc2-2765-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633607686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607686, "uuid": "667317db-52a8-45f2-87bf-e942b4fe41a3", "comment": "Malware payload (AgentTesla)", "value": "dd8542d5c18c44a9bc5e6dd4aa24ebc5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607686, "uuid": "3596ca16-5321-413e-b3e5-94e7018638ac", "comment": "Malware payload (AgentTesla)", "value": "7651c440ce42a1070bcb82745602bf2a857af718a65da24e26cd509f867603a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607686, "uuid": "bd8a162c-289b-421d-a440-12ada72e860f", "comment": "Malware payload (AgentTesla)", "value": "4fc13916f77c086d07f86ed5766e9883594aa0d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607686, "uuid": "84988af3-bdd4-473e-a76a-9f35def9697c", "comment": "Malware payload (AgentTesla)", "value": "2e3dd9c76db534b9849cdaa684bc21bd8aefed530cd6865550e0479d8cb54f5d221ca84caf682e345d62e88487b355a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607686, "uuid": "824efd26-bee0-4802-a658-79b9d8d225da", "value": "T1D264222B3F0B2F2BD5F7D27F6580DF01C8828EE50761740795A732C96BBA69B0E24456", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607686, "uuid": "0712d263-bb9a-4c85-bf04-c68b8940e8ed", "value": "6144:+q5pixu8DFSRxlu9nmFa7A6Bjm2lP0j2kg+FD+AdIHm:zHiI8RSRxlu95AYhRkHD+AdIG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633607686, "uuid": "9c37be53-f49a-49ea-bf52-026ad8be2b7c", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633607686, "uuid": "540d4697-4b18-4245-9bc0-3539d08fe4c8", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607686, "uuid": "a0479bc1-87f1-40ca-9c44-d6645872d731", "value": "REVISED PI 7-10-2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d543c33c-2783-11ec-843c-42010a9c0014", "comment": "Malware payload (a310Logger)", "timestamp": 1633620771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620771, "uuid": "0c2b5656-0bc9-48ae-915e-332dc87a9b68", "comment": "Malware payload (a310Logger)", "value": "20c8a48c4bdad327f4d4a705542a2e55", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620771, "uuid": "e054c1ab-5d6d-447c-8c53-bf70b2e2a1e1", "comment": "Malware payload (a310Logger)", "value": "76dad9cb62814916f7e0e38b329db46c05c8992df91ce981f93e18d8a42e3dfa", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620771, "uuid": "8ee704af-a58b-40c9-ab51-7964303c4303", "comment": "Malware payload (a310Logger)", "value": "e3045fac9a740aed434adffd3ae9ab2f7e0f15d2", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620771, "uuid": "0f810b20-a4c4-4c85-8598-4b88874cefb1", "comment": "Malware payload (a310Logger)", "value": "51752c8c77a5e0301d5ffad3c0fb94c732c111a6e06ad4e2386ee22f6fc09f40ce12dcac7c703db1be5dcb69d011aa57", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620771, "uuid": "bde33181-2655-4250-af1f-530a878cfec7", "value": "T131E292A5E654CA10C2EB3AFA981BD6B40B65EE5BF913879B18CC3F8E3DF27024711505", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620771, "uuid": "895728a5-78d5-4794-892b-5b9ed12a7fb9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620771, "uuid": "6501e40b-914e-4518-89bd-96305649af29", "value": "384:Tc/V+WL3+H8TbhZNutudGKBp1eB60vkzQU:TWkw3+cTbxxBp1exv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633620771, "uuid": "7ceac5d3-fa57-451d-9e86-34a55f96e713", "value": 33280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633620771, "uuid": "4d09f4be-9d47-4baf-a2d8-29c2127cc475", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620771, "uuid": "92b91d4f-a48d-4ae4-a6cc-f0aaf8b8a08f", "value": "IMG_141271010226.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df087fb3-274a-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633596306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596306, "uuid": "9fd95692-08e4-44a4-9e96-7a514c0e6859", "comment": "Malware payload (TrickBot)", "value": "138925da4d5bf0ce59d0a63512e5fd12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596306, "uuid": "97d618e1-6581-4b3d-8bc4-7bb6949a898f", "comment": "Malware payload (TrickBot)", "value": "76e78467254c1222cf7d03484a2584a707fdcaa9ffcab2b7323a2958c72667f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596306, "uuid": "45b1a273-168c-452a-b35f-ba147a015a55", "comment": "Malware payload (TrickBot)", "value": "7cc61af016ec8c930ce18d1b9d0a32657f35d165", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596306, "uuid": "faf89eae-7120-4177-bdfe-7e6bd1457d7f", "comment": "Malware payload (TrickBot)", "value": "45609a4eafd0c544a0de0add8542f3e8deb638dbd5b8260ab3e7371a7effa19fe96b38ea9b0c2c5f2d72a177c0b3721b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596306, "uuid": "04a269fe-0f6e-43c7-ad5d-1c9cdeb33cff", "value": "T181D4D052BBD0C876C9A311320EE29B3567FDED115B228BC757D45E1EACB26C08E36316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596306, "uuid": "5ec5e41a-edea-419a-a97a-2c868a243326", "value": "96459f3ac5474c1f5d7b0f19d0d0d7ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596306, "uuid": "18f9cace-2afe-4838-bace-9c21e23e3198", "value": "12288:SeDQXlHsrpApiu2YOMrnnRY2Lx1yZR9qVa:nKlHsrpAHEMjDT44Va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633596306, "uuid": "c6186cdb-ae3c-4538-9a7c-0975544f4bff", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633596306, "uuid": "adef94f5-269c-4cbd-959a-c94f6134e77a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596306, "uuid": "facaa7e2-bd26-4672-81a0-46e70ce8d227", "value": "138925da4d5bf0ce59d0a63512e5fd12.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977a7f72-2719-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633575141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633575141, "uuid": "c1ad2e7b-edfc-4e18-86c1-a5f2017bd4a4", "comment": "Malware payload (Gafgyt)", "value": "7b88a760044f3d9c730b7e5a0ed259a0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633575141, "uuid": "9a5b224b-b62a-4698-a04b-e203d2867d01", "comment": "Malware payload (Gafgyt)", "value": "77f8ba46c9c6f609401293835ceadaa59a19b7368ea42d00cc4f9275678df0f5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633575141, "uuid": "47b8a8ad-8883-4b27-8563-53b2f87ae683", "comment": "Malware payload (Gafgyt)", "value": "c5e814cab446e7ce0abfaed6fd66b42415c3635a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633575141, "uuid": "3abdbecc-9ee0-4859-8308-dbfe75c36a81", "comment": "Malware payload (Gafgyt)", "value": "4425cb1ba37345355271744e59971e51eadf2df4016a46b16cb30285d1f2be1201be63411c309484deac9c957963d683", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633575141, "uuid": "8c256a64-c10b-4284-baaf-e6bb33f4cde7", "value": "T181833A276391C67AC047A1F027FB9972E821BDBE0A36B15E33D0BE615F39DC11A4A711", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633575141, "uuid": "6a626465-c926-4c6f-9805-17ad3fc3d32b", "value": "1536:aVnirf3qAhHvvX6YbESLAvM0gLVxoOOqjYum0Hi1pczCf3k:ahir3hPvX6YRcvapOqjXLC1pUCvk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633575141, "uuid": "a175e0b3-3832-46c1-9ab2-d7a184082b61", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633575141, "uuid": "2a748860-e009-4ebe-b804-1532bb15f601", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633575141, "uuid": "27f0629d-dcd4-4b73-a41f-1f8617ffb1ea", "value": "X86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09d8029-2755-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633601033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633601033, "uuid": "62f0afaa-924d-401f-9f6a-d4edbfa4b04a", "comment": "Malware payload", "value": "a4fd453636d07090a43331648719838c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633601033, "uuid": "fe1b3ca5-34ff-4b55-a413-12b1c06218c9", "comment": "Malware payload", "value": "78088e2a0f090934bf670cb564b988b0f008574fd7156b4f0a5eb34468330f80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633601033, "uuid": "c72dd82b-d94b-477a-bffc-5a8c25372b5a", "comment": "Malware payload", "value": "3301bb11de74e07604e4d31aac801e959058a47b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633601033, "uuid": "a795d4a6-5d03-4140-a0af-670334dfd08e", "comment": "Malware payload", "value": "7600429175e48257c39e46f1a2d26e835090a4d6c4dc030c1a36788b12bbb62c00ec246455daf40f392f2eb813766d6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633601033, "uuid": "b73ce64a-c2d6-4c5f-aa8f-618ec8da5f92", "value": "T1EB1489B4747BC618C427DFB52DDCD5EAC99A7D226408A053E482731FC926A80CE4F5BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633601033, "uuid": "4f3148d7-c80d-4763-aa15-1e5131a43f1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633601033, "uuid": "1f130e99-a7a0-4680-9c1b-5b6f286d03a1", "value": "3072:M5WrS9lcPhsKNOxcLOslReltanAyegAgzwJ5gze:afcJsuOaLOslklU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633601033, "uuid": "0109fb3e-5cb3-462d-9089-b27e4f196cab", "value": 197120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633601033, "uuid": "de581a24-c685-4634-a984-c2d1194db49d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633601033, "uuid": "c7337731-434c-4d7e-99a7-d409b78026bd", "value": "a4fd453636d07090a43331648719838c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23bdf472-2766-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633608018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608018, "uuid": "97cc9796-c002-4fe0-8d09-8fbac6cb9c3d", "comment": "Malware payload (Metamorfo)", "value": "b67fb8d016fffb97becc97646c3f8b52", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608018, "uuid": "effe6b29-bd89-4163-ab00-849f2ab8f7fe", "comment": "Malware payload (Metamorfo)", "value": "7819f1ee817e7cea45772e503dc563c14ec38142a9e1ab1708a7dcb53f5db728", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608018, "uuid": "c14d06f8-ed6d-47eb-9363-d38eec68f1cc", "comment": "Malware payload (Metamorfo)", "value": "dc08f73ff457f7c365aaa65e9510c3bfaa3a897c", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608018, "uuid": "cde1c784-a887-455b-bb6d-b35528089376", "comment": "Malware payload (Metamorfo)", "value": "758984255ec6f3e25ab171ab45f4a54df3cfde708617dc887decfbc449c5dca814c72ee14b2c925eb0960b38d34b6935", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608018, "uuid": "7bd53bbf-783c-4125-9795-5b7601d1859c", "value": "T165317C051AEA0329C3B3CE7A5076A2464A76FC51AE934F5D848497DE2891054EC34E6A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608018, "uuid": "a0ac6065-2117-49d2-a281-479b62908f57", "value": "24:8+JUHRlVo5kcbA+Px5+/P+0rMw41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+5Gxy1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633608018, "uuid": "e8cc6c67-8cf7-4c3d-a173-03637cfd0003", "value": 1542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633608018, "uuid": "9d98a320-38df-4b09-8774-dbae8a8bfe78", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608018, "uuid": "07af190e-8c18-4275-975d-cebb1baf2d2c", "value": "curriculum.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab582b0-278e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633625290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633625290, "uuid": "255a4d80-f5be-4350-8c02-d838f1d8a002", "comment": "Malware payload (AgentTesla)", "value": "aa0587b1af5e4295ae3e65bddacfd201", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633625290, "uuid": "4b7a8932-0544-4d3f-b516-7f3ff02ec85c", "comment": "Malware payload (AgentTesla)", "value": "78a4ffb137aee23cf3c529e9d4bd718b9ba206ac646230d72676dcccb593d550", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633625290, "uuid": "638cc18b-30d5-4aa0-aeb5-fd6a236611b8", "comment": "Malware payload (AgentTesla)", "value": "f6e3dd5e88719c953416b67b71fa32bb5ab5b264", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633625290, "uuid": "d920f1bc-8913-40b7-baa8-dac633cca19a", "comment": "Malware payload (AgentTesla)", "value": "c110a403b8967bb800e14bb1749ca110b0b686f4815b6c8855fa05f52d23c9dcaf0367c1874d85cec1693b36f1d8917e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633625290, "uuid": "6cf94172-4080-4cc8-a19a-0e03433ba19d", "value": "T1D635F6002295C711D1B637F4D864CAF097A56C15DA29C28B2DF1BEEB79B1B03CE11A9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633625290, "uuid": "baa3ca99-37db-42cc-8f3c-af8af88276d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633625290, "uuid": "55f7d775-49a0-43f7-bd46-68a01b536d6e", "value": "12288:wrX0WDyL9pD3n+0S2C5f05wPYdGQNVfrBeu3Gd4su7C6R3nCci6ptmM31g:qx+L7D3+12CR01n9rBr3ycCA3f1ptF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633625290, "uuid": "910c2946-171e-4694-9707-1fd15b5b2851", "value": 1072128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633625290, "uuid": "cec99c9b-3cf2-4ae0-8dfe-7cee60d57046", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633625290, "uuid": "00eeeda7-01de-42dd-8ee9-89eba41bb2ff", "value": "October Final Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006e4c4d-279b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633630722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633630722, "uuid": "0c4b452b-3635-4671-9de6-276c238b6fe3", "comment": "Malware payload (AgentTesla)", "value": "e9091c46a3b8ed2cf6ec4e810492bba3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633630722, "uuid": "fec2e7f4-586e-40eb-b0fc-03c8e058fb42", "comment": "Malware payload (AgentTesla)", "value": "7962a3af61a4ac9f4139a07bde78fe4b22b3699982c4350fa42fe9f0890d9a42", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633630722, "uuid": "47ea662b-2c67-40e7-8343-e9de2d88b4fe", "comment": "Malware payload (AgentTesla)", "value": "7ec89c4fe70af6ef330569be5396ae85f159592a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633630722, "uuid": "431fb312-b6ed-443b-b946-7aca64b8ef26", "comment": "Malware payload (AgentTesla)", "value": "9a2d429d97e7f123939d98db898a16e79942a4f1924dd8653c0c5ccba1df85583d307e5e2be0beec858c3860ec8372e0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633630722, "uuid": "73ec6f02-b5ba-4eb4-8bae-9e06e866076e", "value": "T15635F6002695C611D1B637F4D861CAF093656D45DA29C28B2DF1BEEF79B1B03CE01AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633630722, "uuid": "ac93fb3a-2365-451d-87f8-347f22d88373", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633630722, "uuid": "d5879096-591e-489d-9928-f00950da5b67", "value": "12288:A4v0dyBDyL9pD3n+0SpeiCIy7+OojbwwtbBzDoxp:RoyB+L7D3+1pefhi5XwwIxp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633630722, "uuid": "0715aef7-bc80-449b-abf5-4d88a28517b4", "value": 1070080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633630722, "uuid": "dfbe3a81-64cc-41c9-b1c8-945641694870", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633630722, "uuid": "cb9ff861-e05f-447f-bb26-c460468b3391", "value": "HIPV0259 1X40HQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41bc391b-2784-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633620953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620953, "uuid": "3f9ab394-92f1-402a-96ad-571fae37e6c8", "comment": "Malware payload (RaccoonStealer)", "value": "dce1aac316f25ecf913bf4d800540136", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620953, "uuid": "b2cd9d3d-d73f-4cf5-bc48-cc017cb626df", "comment": "Malware payload (RaccoonStealer)", "value": "79b2b081a4388f48148f97af8c51024ea9abda0d04ff67e8c0b0ed0a00495594", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620953, "uuid": "68a2da83-4f96-44b3-8c11-6250f066e729", "comment": "Malware payload (RaccoonStealer)", "value": "74390b76ddcf361dcaa1a97d0e0604fbc004668b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620953, "uuid": "b286997b-15a5-427c-83bd-a3f42bfe2ff9", "comment": "Malware payload (RaccoonStealer)", "value": "231ba32ef37d962e8903a6a34d3d982b9dc0c38073dd454806d96e1b451fb647444c8e7e7394a606aa4bd2030529b9dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620953, "uuid": "4b2fd330-9ef1-4319-87ae-edbc4fbd1993", "value": "T196B4E100A7B0C035F1BA16F44D79C2B9B43E79A1AB2994CF62E017EB56756E0EC70357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620953, "uuid": "bb339935-6f55-4bae-922b-27df172bfb00", "value": "0d61443d5aeb8f94dcb0465acbd1f25d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620953, "uuid": "53704deb-c8e8-461f-b7bf-3fc9fde3c38b", "value": "12288:xI1QfDgeqIXY9RLJp/RFUiKP74dylG0JrFcUNrKz:x0vewpQRPiy+Usz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633620953, "uuid": "9c2d1a5a-dec3-4219-9e4a-0e1a26d4a965", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633620953, "uuid": "af788a8a-d959-44d8-89e7-f8a431de8cbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620953, "uuid": "b2fc8f9c-e1c1-403c-a0d3-a0d7a0d658ae", "value": "dce1aac316f25ecf913bf4d800540136.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677b2624-2785-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1633621446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621446, "uuid": "047e81df-6b3a-4add-aaf3-11de323cca35", "comment": "Malware payload (Vjw0rm)", "value": "38ecf70cf09d8c499546c01c028dd70f", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621446, "uuid": "b7af3867-295b-467f-94a3-d345c84bdcae", "comment": "Malware payload (Vjw0rm)", "value": "7acb1e3e7f173f2cc884c87a15260f06f59ed45e79e979afb37e361dd0b2625d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621446, "uuid": "3a8234ac-bc53-4911-8596-3203ed23f1a7", "comment": "Malware payload (Vjw0rm)", "value": "d4d57eeb688d2abe1eeae5b0dc142d588246648b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621446, "uuid": "16dd6e17-e6d0-4685-8c89-df001f35dd15", "comment": "Malware payload (Vjw0rm)", "value": "5c8273b7d4c979c19da45dd24e4a6ce9f8a9c9d103703a3d315198ae523b53a8d10d3823a7a322cabb7c37dc851ecd88", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621446, "uuid": "50bf1d9d-54c5-4cc4-a441-ee17aec6ae7b", "value": "T1CA81209D284BC63C53D27B8A802ED148CDF948B47E28D2B5148CDAC5360ED7987B19BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621446, "uuid": "ad453947-9098-43ee-836d-1d9873e98ba0", "value": "96:SABNo5Dek2c24ZRMHXE6/BIy+Ys+fJg4DdQqR7bJyKhGOS4UK:zSX2c24ZRMlBIBYs+fJg+fRfHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633621446, "uuid": "1a653e17-582d-425a-86d7-9dae8ad48acf", "value": 3884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633621446, "uuid": "722df7d4-5adf-41a7-90c8-ac09d9f4557e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621446, "uuid": "7a1a75d3-1c4f-4e1b-8558-5445de9e82f4", "value": "INTERAC Service Request9466544665440.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ab8a13-27b5-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1633642292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633642292, "uuid": "831b0e9f-8895-434b-ad06-b4a3fd060de0", "comment": "Malware payload (DCRat)", "value": "a8a268b325b9f31bfb17bd2fa2b20c0e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633642292, "uuid": "ae33edb1-98ed-4603-addf-17d30b815d1b", "comment": "Malware payload (DCRat)", "value": "7b0f445718f91d7d32669089ecf436c8cfc3639f756ef1d91f8ba5aa90c5145a", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633642292, "uuid": "d32e9db0-d481-47ad-a62a-6b02562af6f7", "comment": "Malware payload (DCRat)", "value": "23c27e28d42c940d653e2a31322c64ae01025df9", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633642292, "uuid": "13fbee9b-1940-4736-8e43-1acf47853d15", "comment": "Malware payload (DCRat)", "value": "0b665b333ed5a3ba2645fa0c39abf4e8018992b02ca326fd5b0b2157b7cb06c15417e900ad43ae449da51a5a267cc0f0", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633642292, "uuid": "b76d5f0c-26fa-419e-b8e0-527f9efb1953", "value": "T1085533DC4FD694FEC92C227692BFDF7459CC1F11EC0666A4189989E286FC0A2C2791DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633642292, "uuid": "49c790e6-565f-41df-8d3d-c6a414fd3e21", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633642292, "uuid": "33f6c4ed-cce3-46cc-8e5b-41e7a6751348", "value": "24576:ngSVPoLFLQzdci/AkCkUS7/oc0CMjddf1YvNRpSvlyfKjkE/SYRjxM4:gSV2dQzdcCcMP1qDavNRpU42KCjxM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633642292, "uuid": "72b42305-fb2c-4042-a369-d42276ed38cd", "value": 1333248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633642292, "uuid": "6799f37d-0377-4409-8f69-b7c6c1c05312", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633642292, "uuid": "36d95834-6fed-4807-a26c-7287a072cc42", "value": "a8a268b325b9f31bfb17bd2fa2b20c0e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f1af65-2721-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633578727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633578727, "uuid": "be118c62-f5d0-4b58-9c32-5d836a56cd43", "comment": "Malware payload (Formbook)", "value": "08be9eb13ce48889a767c1faf80fc855", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633578727, "uuid": "68d347cc-994e-4db0-9820-fcfc9ced631c", "comment": "Malware payload (Formbook)", "value": "7b5de7135bd7e3c2eb98a94977c138597d357def8a9851a8df3ee442f83ec737", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633578727, "uuid": "a4c04a05-286a-49af-8140-046b55b98cb1", "comment": "Malware payload (Formbook)", "value": "4f8c369ff1be2d9e02594b971ee24f4a2c8e18c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633578727, "uuid": "120d2970-4984-4a98-bc76-46b24137be14", "comment": "Malware payload (Formbook)", "value": "7c4d161eb654ec257ff309cfdf485389577688b93c7004e8be95cb98f76909704bc6d217fe684d8366ab62255229c491", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633578727, "uuid": "2da7a626-10db-4500-8ad6-5dff3ecfe763", "value": "T1B194D03E33A3DD00DE7186B2EC8ED55147B8B81621AAC7393A8D327D78127F54D90AC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633578727, "uuid": "ef4b3b46-338b-4752-b974-8e886ab7dc31", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633578727, "uuid": "c477b722-5b4b-4714-971f-f23568625c86", "value": "6144:b/jIGIZdF7MzKQ+3HwO+rlInJvSuvEP+9ET1b8/4ZTwAUN0rrThAf4DkohHBXDXJ:b/Mk7o+rwc3N8/4lj7if4DkmzXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633578727, "uuid": "75562a91-f733-4176-9f05-cc4965d9f1c7", "value": 422400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633578727, "uuid": "33360812-ba5c-47e3-ae54-8b78e250ccd5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633578727, "uuid": "c1bb0145-3c44-4447-a1c8-cad8982ca22a", "value": "INVPRF2100114_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2701bef9-275e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633604587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633604587, "uuid": "51b4179c-3464-4c1f-b3a2-30af3f2f3aa2", "comment": "Malware payload", "value": "a1a6e9d23d017f11193700753a10b6cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633604587, "uuid": "a1dacb60-d4e7-488d-affd-4dc9f5b2e395", "comment": "Malware payload", "value": "7dd9601ba0eeb045253dda732ed38b8ac491d65794ea99f01ee0472684425e3e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633604587, "uuid": "6038ca9a-7511-4d11-97a0-bf0ecfa0fc74", "comment": "Malware payload", "value": "55c090161cb853f0dd968df985fb9f024bfff27b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633604587, "uuid": "00981ef2-7d1f-4ffe-ac37-f531f015c110", "comment": "Malware payload", "value": "0eb6cffb08012fd4c9e6ab6d16bbc33aa15399ccb25a8dbe5da6f7a3eafc9ba33e7bdb6440ce9c09b92e9325ed2486f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633604587, "uuid": "0c90a3da-002e-4398-9acd-a61ec080b921", "value": "T18A14A454586A491FEC329EF5A9B873E5BDD5DC137388F0128C432A1AA73364C8BCB467", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633604587, "uuid": "1246b063-4838-4678-8096-ef99491a2a5c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633604587, "uuid": "765f5ed2-32b1-433a-ae9d-c518bde2026e", "value": "1536:ILlVHevpbOrgdepo4fVT60N3e7EZIKtPftCOUeu+bLl4UflRy9ltVshRMh:I5p0SEdcPhsKNOxcLOslRelta4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633604587, "uuid": "50df0657-8d3c-45be-bd45-5c3b93e4ec97", "value": 196096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633604587, "uuid": "ded756a7-898b-4cd8-8d67-0dbb3e45ea3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633604587, "uuid": "6cdf79f7-2bfc-44b6-a9cc-cf327ca35d62", "value": "a1a6e9d23d017f11193700753a10b6cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d766179-27a7-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633636139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636139, "uuid": "a8072d06-ca79-4003-8aa6-f2446cd9efae", "comment": "Malware payload (RedLineStealer)", "value": "4aa9798ac88cd4c133b54bb2b224bead", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636139, "uuid": "cbabcae5-70f8-45cb-b1af-dcf61baca687", "comment": "Malware payload (RedLineStealer)", "value": "800346e0531230e0cde13dad6e6795fbf298fdc95c97481f6c28c4a1043227ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636139, "uuid": "e95e9491-59f0-4b1b-8668-96e5724f55ec", "comment": "Malware payload (RedLineStealer)", "value": "02a05ae5ff6ce5702a648e58763888c382dfe849", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636139, "uuid": "34247a70-cd84-4516-abd2-51ce94ec5738", "comment": "Malware payload (RedLineStealer)", "value": "8f11aea1bac6b7abbe2851f0172a4eb3c991814829c3599614066d3f81aeed5ec2fc5d1cbdd158c39c4e9da41badad2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636139, "uuid": "7114d68e-c7c1-4616-ab91-76fc8ef6d5ae", "value": "T10E344A1C2B989E20F33C067AC4E14104F7F19A96604BE74B6DD038E97E52BD6E61B6C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636139, "uuid": "0f3b4839-a6f1-4739-a0d9-9fef35d9417c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636139, "uuid": "9baed8bf-2f7f-4afe-8d2d-e6115407c846", "value": "3072:OIf0S3VwBvG9amMq6n+3AmDONQzdn/MEfdJYeLBJdsHi7+24vLnN5f0xnJvIfyWP:x8S88/ME1JYeLBTqk+7N5f0zEy0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633636139, "uuid": "c2ea4ebc-992d-4947-99a9-fc746fae8179", "value": 230640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633636139, "uuid": "96933387-b217-45db-bf6e-bef578167a2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636139, "uuid": "d9bf402a-4e88-4589-93b6-427909f516fa", "value": "4aa9798ac88cd4c133b54bb2b224bead.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7594e491-2778-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633615886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633615886, "uuid": "4a62d515-b426-4361-a773-4f46cbff396f", "comment": "Malware payload", "value": "4a17f9d1143ca583caf510571701464d", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633615886, "uuid": "78232d22-fad7-452e-bc87-ed387b352804", "comment": "Malware payload", "value": "802545018352ad604c04937731e3ab00cf3d0e616f6b2dae5012a8a1d1fde4c2", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633615886, "uuid": "c242644a-b3d4-4e9d-897e-6297dc38e515", "comment": "Malware payload", "value": "3f119a7e8fbb1d7b75378c18c105296d360f8a29", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633615886, "uuid": "787c27d1-b542-4384-825a-4bc09e29b133", "comment": "Malware payload", "value": "a456b98906216567a4f5acf8a40cfc366e706f5d9935db8857fce151a43229d61d78431b163e2f7b3e5b66913f9908e1", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633615886, "uuid": "bb4811b6-e757-4b95-a71b-ceef960c0141", "value": "T12651860AFC47D14C6B79236BED978522FF1B811B5DA2104C71DCC2495F30809A76CA89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633615886, "uuid": "c103ecc6-fedd-4266-8b14-0aa92acd9d8e", "value": "48:AA48OjOLuDQjvUKmc4TQ7QZE96pAUYRAGqqsUoyWKLrj6l1CelkEJmZVoQBozl4X:1WChrffoypvK0elkEYZa5ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633615886, "uuid": "a1aefd6e-3770-4685-b0ed-502d2f1eacbd", "value": 3155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633615886, "uuid": "37c0106f-b456-4138-9732-5fd13cae9ea0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633615886, "uuid": "800b406c-3490-4e63-9f85-9261099c4c80", "value": "Fq5WppVk.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "506e6268-2725-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633580175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580175, "uuid": "cc0a0e4e-f403-4534-a63b-c056808cf7f2", "comment": "Malware payload (Gafgyt)", "value": "8872ff95eab118f287d5bd75609cf4ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580175, "uuid": "1991f9db-333c-4f24-b61d-29b40c969f0d", "comment": "Malware payload (Gafgyt)", "value": "8176e28759b9c3abd9f2cf633c47d8051d5f67801fee051bfa263542447046b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580175, "uuid": "f7c29c31-aa49-4171-97a9-7b7e136aa523", "comment": "Malware payload (Gafgyt)", "value": "ec47a9df7656f5db4d599f8c8a62674b915232ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580175, "uuid": "4125b3bf-6564-41c2-875f-aba183e2df56", "comment": "Malware payload (Gafgyt)", "value": "c933be16f22df842672cca49e8a1afc0add1ed51818c9f365d28632fb6081f498d65dd1ba203f1283327343d89cea94d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580175, "uuid": "ad22688b-b1f2-4f8c-ad17-521999c2dcca", "value": "T134B31905FD404B27C6D22BBBF79B428D77366658ABD73301A6297EF02BC17982E39150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580175, "uuid": "9cb5d76d-fdf8-49e9-af47-9c67e094d5c7", "value": "3072:e9DMjalFQEnohuIZnR5nOR0V55hsobplD7YHQQ/hVOmAD3m:1R5OyV55hsobv7YHQQ/hVOmAD3m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633580175, "uuid": "44e1c791-d660-401f-b353-937482545a90", "value": 116072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633580175, "uuid": "66d0de1d-1f8d-44c1-a67c-004060894c0f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580175, "uuid": "988109ab-03cf-4f40-880c-d6739514b508", "value": "8872ff95eab118f287d5bd75609cf4ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9210bbdd-2726-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633580715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580715, "uuid": "e973aef7-fb43-4637-b22d-4d01672bc070", "comment": "Malware payload (Gafgyt)", "value": "8092b587b3f991891067039286755447", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580715, "uuid": "5d64910b-e77f-4788-bba0-27e277418b93", "comment": "Malware payload (Gafgyt)", "value": "847f4f06b3af92d14afbd6cc98d0e26d1b2b58e260df9bea6888cb4ec9b3f973", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580715, "uuid": "2ae49bf0-d974-4ae0-9fb7-91c0c263a87c", "comment": "Malware payload (Gafgyt)", "value": "d4363869984c2c25e9b308102c174d2ae2ffe40a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580715, "uuid": "7cc52f26-441c-4cce-9923-308cdd26b59d", "comment": "Malware payload (Gafgyt)", "value": "4a474c0cf188774030689845ba6feaf0aef30083d63ee72b1f5dad3819a7ca16fe620aa01db5c20c6f311440513e33ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580715, "uuid": "7ae0eb10-568f-41d2-b621-d045144a59c4", "value": "T193D33905D9508B63C6D22B7AF7AF528E77232BA897CB331156286EF42FC179D1E39110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580715, "uuid": "38129f02-8c6a-41d7-b14f-b174d1bd89ea", "value": "3072:WLfltud9pSeQoIHyVKtacNxbWr0PrYeVc45hwMqiO1fDJmlDCmy/QsYJ0Yj/:ChtacNxbRVv5hwMqf3my/QsYJ0Yj/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633580715, "uuid": "1f1a5409-ac06-4e51-9884-7fb5a4f07702", "value": 130434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633580715, "uuid": "1bf43516-9117-489d-8b67-f05a61218a14", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580715, "uuid": "aa1ff999-ff0f-46e1-8f29-995426d0a45d", "value": "8092b587b3f991891067039286755447", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b39db7-2767-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1633608472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608472, "uuid": "fbe6f121-763d-4282-9bb5-e263d11f41ee", "comment": "Malware payload (DanaBot)", "value": "557436315ac51f9a29574d474a728402", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608472, "uuid": "f9b5a093-4db9-4bdf-8d1c-17ece7c05dbf", "comment": "Malware payload (DanaBot)", "value": "84dcb2e1236f428d52bd4cb3f5d5e7a6c79d44778858012b746c1658b1a844fd", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608472, "uuid": "9196c0b3-47b7-404f-8140-aa4bd67165c7", "comment": "Malware payload (DanaBot)", "value": "163c917a4cc9e242e5195ae3461f95d0266cd5d4", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608472, "uuid": "b0b6bba5-d031-4354-b9ee-262301357d69", "comment": "Malware payload (DanaBot)", "value": "d5cc949071209e218a62d777fb830dd9bee1b002f4b9e02195ed1e4f9e57c0f80d18cdb0c4f99bd040c0b3bbb3464c8c", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608472, "uuid": "114b23cc-f965-4697-b3a9-aeb2b817ef93", "value": "T1CB351210B3E1C035F1BB16F69AB993B0A529B971AB3990C763D13AEB66345D4BD30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608472, "uuid": "603a9d0d-71ae-46d9-b5a6-97865e6b2f7a", "value": "104d9977f4378bb867ddadb6d1eb3d6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608472, "uuid": "5bdecb8e-1e7e-432a-bd26-d57be6b2a621", "value": "24576:qBE83FTTbykD/odyRGYR1bOGwQ3htmOEzYHfhhglI1mpsDb1:kXsOR1bOP5OEzYHJaq1mpsv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633608472, "uuid": "8d2d0ce8-c09c-4151-b04f-3bc49c907d8d", "value": 1151488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633608472, "uuid": "761e85bf-045b-44cc-9391-4aa82259a795", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608472, "uuid": "b77f3553-d1ea-42a8-a869-2cb2403573be", "value": "557436315ac51f9a29574d474a728402.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2792c6-2743-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1633593137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593137, "uuid": "dcbb827f-6514-40c2-bf6e-c8824a45de03", "comment": "Malware payload (STRRAT)", "value": "8760508b129ac7a839ccc51e8522b4ee", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593137, "uuid": "626e1cec-7e3f-46db-8724-7b083786c936", "comment": "Malware payload (STRRAT)", "value": "84df2e31a948b6010fce8f288002365d8faed382ef4b9176b0a2116fd109b301", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593137, "uuid": "7cd85952-36b8-4eb4-ab83-109530fdc714", "comment": "Malware payload (STRRAT)", "value": "96c8607e956c7f5f1702c64981479647fa011235", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593137, "uuid": "1637065e-5fda-400f-bb9b-1a7c458ec845", "comment": "Malware payload (STRRAT)", "value": "614e2f174aeec308da5076c646b438963e4b18c591b702e5a732e0f88ab98bf4ed367e7d63c89c070e022a6b87b27f0d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593137, "uuid": "52728c67-bbfe-4340-806c-cb65e9b3232b", "value": "T12604CED1C6C0678E76D8EE0C9C3AC121E2F3E5EF64469785BBAE7A357B30C0417A4A15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593137, "uuid": "5b8fc917-b4ca-41c0-9cc7-40ad0a36fd0b", "value": "3072:6D9GtZoykB1NrgSf5LCvSc83Xh1PsFXUIO75vew4TldNEePVWtG0K/lRsRraJYRL:49MODH/ceXTPhN0rNVTcIooYoTBV5A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593137, "uuid": "3f8e9eb0-f279-4711-b541-90f0d6fcbfc0", "value": 189770, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593137, "uuid": "f6b2de1d-2778-4268-bf82-825d26fae8ac", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593137, "uuid": "0a76c0af-7553-4d3a-817f-e14266eacaa0", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fab8399-275d-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633604306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633604306, "uuid": "76da54db-b108-448c-b8a5-3991a1aed5b6", "comment": "Malware payload (RemcosRAT)", "value": "695b46208470fb3808cc6aa2fbfde975", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633604306, "uuid": "09c0fb78-b183-4615-8a9a-0ba8c3fad0d1", "comment": "Malware payload (RemcosRAT)", "value": "8544b5ecffa12c5f0b35b931ef7dd9b738bac2b2d7ea75419a6216b8d2174670", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633604306, "uuid": "73b3de39-5346-4beb-97a4-5b07c05a7b8e", "comment": "Malware payload (RemcosRAT)", "value": "383b48dccabe31a6eec7f495820b1c0077084ec6", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633604306, "uuid": "ab9dd9fb-ee60-40f2-bbb5-4037bd6d270e", "comment": "Malware payload (RemcosRAT)", "value": "7cdc23498e32ec9016f197210205cc208af48052033cc49a16b4386026c0a11561a7b96b430b1d22ab32a10a46e7206b", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633604306, "uuid": "e0275a68-7578-4469-9ce4-02393a31bd80", "value": "T1AFD423CC48CE44F851D6693260589D6E2A9FFE82CCA2451F32F9AD4C1BABDDC75F0486", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633604306, "uuid": "9e2a7a9e-1821-4031-8ef6-9aa973674a23", "value": "12288:jv9r97X611Tj8hi88tLQRDOCrkB0y2rZ8hkx+c1ESa+LpK:r95ezjTteOCQL6ZMgxpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633604306, "uuid": "4fb8c1f4-47c2-4d3c-a8c0-e2a331115e48", "value": 622235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633604306, "uuid": "d16ba915-46ca-44e4-9b56-bcdbc1beab44", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633604306, "uuid": "201dcc64-f167-4f3b-90c2-eb3b1da83195", "value": "SWIFT_USD_9250.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0220047-2742-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633592899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592899, "uuid": "8b146f5b-e92a-413e-96d9-7f8415fbe50f", "comment": "Malware payload (GuLoader)", "value": "949c37036f725e839124a4acc5eef3b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592899, "uuid": "66f64863-f387-4c58-86fe-fd9cff18af6c", "comment": "Malware payload (GuLoader)", "value": "8583bb7884df6ec6687b80289893015972f8097e9d4a6010e77a01f5cf3188c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592899, "uuid": "3975f7e6-4d54-46bc-bb24-c60e2bf5c4c5", "comment": "Malware payload (GuLoader)", "value": "fc8aeee99131b8c55302c3b64845713ef91ba129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592899, "uuid": "f2ede904-e38d-4e05-a9c2-38a856a2106d", "comment": "Malware payload (GuLoader)", "value": "6902a4d7177c297939335f9605c04cd6fade88d4f5733f3e32a5c1b0a9544f83cb93e7400250b36ab1277204e6351b4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592899, "uuid": "24e0d1c1-5a01-48a7-b8ed-ba91cfdd7752", "value": "T1F8A30531E9A0CBE6F969CAFDB735F8FA05F1AC22D9910D0B35443F0625F61C268B1646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592899, "uuid": "8c99f428-a3d0-436b-9ed7-271455aa92fb", "value": "64e4aee665feef1b106b6eccf2b2e39f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592899, "uuid": "d7ccb886-80f2-45c5-b773-6dce434ed44e", "value": "1536:teIQ0BKGUl1TN5lkuABgl9lsP+xp9swzZAVe3tW:teI1i353tABglPsy9sw1Z3tW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633592899, "uuid": "22217496-596f-44b1-8714-8b556890dce5", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633592899, "uuid": "afb61d07-33fa-497b-8433-d74bb5e557cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592899, "uuid": "22748e74-3f48-4971-8125-6357bf7c6521", "value": "Zapytanie ofertowe 189245.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa682b2-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633597238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597238, "uuid": "c25d5336-8560-46e4-bd4f-7f024feecb96", "comment": "Malware payload (AgentTesla)", "value": "694bfd7e3c03e08e4cdd7cd7318f1d06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597238, "uuid": "3ecf5d71-6b24-4ff2-80a9-85b98f81853a", "comment": "Malware payload (AgentTesla)", "value": "8603ca6d35734e60dd57add6e34ce36cef415410c377b581929c9d0c5cab734e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597238, "uuid": "592f8216-c438-4014-bb16-c3219bca82a5", "comment": "Malware payload (AgentTesla)", "value": "33d0dd93bc55c9901040aa4ca45cdcbe08468633", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597238, "uuid": "544708fa-1a80-4a39-a147-a343c7e10914", "comment": "Malware payload (AgentTesla)", "value": "94eed31340e99ee228a63be2b7e85e96df6b936a908b1336bdbda2c7197f05e4b989d1c7d5eb13944d96c9d6bca81f90", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597238, "uuid": "00190879-d529-46ea-833d-c3122cff9c67", "value": "T141A4F15463675B5DCE3C83F51800F5626FFA652B216DC7388DC6A4EE2892F701AD0AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597238, "uuid": "062c25e7-a273-49fe-bebe-fda76626d430", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597238, "uuid": "d958f00e-a4e6-4f03-9e6a-6c14af82b9a0", "value": "6144:7pMNVQ+3HwO2+fhviKF5VOA3Nka9T8xPWCYjsFsB1Tkd/Zf/W197SIwnQ0EBymC:toOKF553dT8Zc/Bgx29VwnlEF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597238, "uuid": "12c64905-d0c1-402e-9f5f-430bb581742d", "value": 465920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597238, "uuid": "7be684b7-599a-4e5a-a3d9-0c1c54341e2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597238, "uuid": "0cbcba52-a2a5-49c4-a7ec-4477bda42b03", "value": "694bfd7e3c03e08e4cdd7cd7318f1d06.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b01a2d8-277a-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633616754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616754, "uuid": "1d3012f2-ff5f-4d48-91c1-437d30b1a514", "comment": "Malware payload (RaccoonStealer)", "value": "01c403fc63a44b50597c53503581ea95", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616754, "uuid": "0bd8fe46-a24c-4cd4-a686-87e18d372d50", "comment": "Malware payload (RaccoonStealer)", "value": "86a52a844928c72e0e51f369092b44e9924b588d131ae14ff31cee2d0bf94558", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616754, "uuid": "9d027c19-62c4-4c22-abf6-7e809b75dc69", "comment": "Malware payload (RaccoonStealer)", "value": "b281a53c506683742fc9b4314c799847e868256b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616754, "uuid": "e49f0545-74ff-4974-8643-0d16958a8f77", "comment": "Malware payload (RaccoonStealer)", "value": "c650cf4965ae44669ea42a46433f9a5410c16084d07084508a281e49fcb2663812b01a62f04076a51622a04cf6fbf932", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616754, "uuid": "ee0d62f5-f99f-449c-b55f-b2ec20133451", "value": "T11AB4E111B6F0C035F1B752FA46BA53A4A839BDB0672890CF62D55BFA5A346E4DC30387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616754, "uuid": "3c0633af-4c00-4d49-8075-598bfeda5c8d", "value": "104d9977f4378bb867ddadb6d1eb3d6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616754, "uuid": "50ccebfa-fe1e-4c24-bad8-18af25ce00ba", "value": "12288:nBsRFCQTm3lWgpru7jOoHxE39gEr/NaAFsB9:nBYm3W7aEcN/N10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633616754, "uuid": "4053b464-a7b8-4970-a399-f71ff532df36", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633616754, "uuid": "75595ad6-acdf-4805-a708-a28597cafb26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616754, "uuid": "6c190dcc-5071-4233-a4dd-fc0fbbb0d13f", "value": "01c403fc63a44b50597c53503581ea95.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e87c61e-273e-11ec-843c-42010a9c0014", "comment": "Malware payload (Tofsee)", "timestamp": 1633590936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590936, "uuid": "ad11f4fa-095b-4919-8791-4e949c447716", "comment": "Malware payload (Tofsee)", "value": "16dcefe162ad79fe4d09b0341cb160d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590936, "uuid": "b573834e-da26-4979-8579-df51e821dc06", "comment": "Malware payload (Tofsee)", "value": "86d515f9e9c08a224bffe977ccfd6ced11781e02c1a294d82c1eb2946a29690d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590936, "uuid": "3da76eda-17ee-4ac5-9944-523038105180", "comment": "Malware payload (Tofsee)", "value": "e04243e0dcbd88d6542eac7783feb748865d6f7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590936, "uuid": "1779daff-0434-4211-ac7c-ada240e3e5ec", "comment": "Malware payload (Tofsee)", "value": "f5f98fbda00915c44ea48db385294c66faba549dd35cc7873ec78df49b78c2dd8f377aa25462da5be5c51a0a60799cc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590936, "uuid": "5e379194-d523-4609-8f86-01714894073f", "value": "T19F349E00A7E1C035F0B712FA497A83B8A53DBDB05B6480CF62D51EFA5A756E4AC31397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590936, "uuid": "6c6e32f9-6274-4632-98be-aecda62fdd25", "value": "558186eb4208ff26294240429e60d1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590936, "uuid": "6119c262-3983-43f7-ab71-572a743231dd", "value": "3072:2Fj49V5nLnx8OzH6yV0hikEZ8nkO0SXO7yHy/xCepPbigtAGhNIcMnjL7Yj8l7U:2FjoDx8OzHf0LEZ8kxxN+CA2IjLtU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633590936, "uuid": "f367f0ad-e3a3-4a9b-a5f7-da42c3cd486b", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633590936, "uuid": "59c6617d-eed8-49fb-a51a-180077aa0953", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590936, "uuid": "54878eb6-787e-406d-b1ad-ea0ebd1ae924", "value": "16dcefe162ad79fe4d09b0341cb160d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f89ef62-2730-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633584818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633584818, "uuid": "2cfa034c-e8a9-4ba8-bc2c-0dbbdf92f025", "comment": "Malware payload (AgentTesla)", "value": "88ebfcbf63638f7a9258d1148bfff0d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633584818, "uuid": "bd735f60-0372-476f-af10-269223445f4f", "comment": "Malware payload (AgentTesla)", "value": "86f800e29aac5d49b559bc5028a53fe6d18ed28ea919d0bdf295e047edf7f2db", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633584818, "uuid": "3a577dff-dbd8-4d79-8b39-17787b510efd", "comment": "Malware payload (AgentTesla)", "value": "3ed76cff46524d0ed535c81c74325559a149d12c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633584818, "uuid": "111b4595-4a82-4e53-84ea-0184c553449d", "comment": "Malware payload (AgentTesla)", "value": "574025add4d25ada4ae78f4c32e5bd7bb5d416b381617dfabefa0aa1d40373e88d183b615420415db4505f5f5f5f406f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633584818, "uuid": "641a303e-e7f7-478c-8fe2-1eb2b1ab0b60", "value": "T10AD423297798F29364A1827A65D7473B3506DE027CED7E242844C2FEB3E23117B8879D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633584818, "uuid": "e5b26ead-688d-40c9-aeb5-500ee2564846", "value": "12288:VSZK7HRiw60M34Cf8VI0NpRUTxkvglx6/xyFRTZ2FzhqVByf:EZKdk0ntVI0XiT6YcEfT8thQyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633584818, "uuid": "e51abcbf-dca9-4812-921c-8f6ccddcf376", "value": 655508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633584818, "uuid": "e0993a21-e6da-4b22-847b-50300f4ccba9", "value": "application/x-xz", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633584818, "uuid": "ad308d32-8e40-4cfe-8937-d64b680e057f", "value": "CI & PL DOC..exe.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4505b089-276c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633610650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633610650, "uuid": "4bbbce0a-8bd3-4229-8c1d-16c148fed8e1", "comment": "Malware payload (Formbook)", "value": "b172b8e0bc46d457b39e4ac74e76e326", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633610650, "uuid": "fbf315c1-c118-48f0-86d1-09bfdbe5af75", "comment": "Malware payload (Formbook)", "value": "8758c8727fc2f359daee8f056460f3353bd807cc591000570b97358b2c914c96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633610650, "uuid": "351d3685-1560-4ffa-a870-ec3fedc040ec", "comment": "Malware payload (Formbook)", "value": "4b49ee0b3f98dc9fc024c390024987cc0b41c6f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633610650, "uuid": "7187ba4a-87e9-4901-91b3-ffec031ba123", "comment": "Malware payload (Formbook)", "value": "6a0937cd5f05ee3a4c101f9f00cc88669406e4b323106098bc253e9f9f766cbcaa13eeb4930d70f95b27258139fe6e13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633610650, "uuid": "74def50f-a51c-4372-aa6a-2fa7a5c8b456", "value": "T1F815305363AC8ED4C06792B4DFC0C4B96C19D9EE421A53B4AB12AB64F75FC031E6A473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633610650, "uuid": "2292f0d0-b004-45c9-94a4-540871b431ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633610650, "uuid": "368df6be-c5a9-4e80-8485-83657978c50f", "value": "6144:FDIhf6UqmXpPATMGrg+NdoMEXFDx3qPUdPLywvydHDLwRcz2vdFW7vyRFfGtzaqo:dLU/XpYNg+NypJHmDicCuyR2zaqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633610650, "uuid": "9a3fd687-5c75-440f-9d7e-ce6a29958a6a", "value": 912384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633610650, "uuid": "e99b0971-bd13-48f1-8ee6-31191bc1e93e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633610650, "uuid": "b5c2cd08-0e2f-4840-a27c-44b8745649d0", "value": "b172b8e0bc46d457b39e4ac74e76e326", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634e373d-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633597387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597387, "uuid": "3ac23310-3e4e-4d86-9e60-60dd15ea239a", "comment": "Malware payload (ArkeiStealer)", "value": "f00de15b4e8697910b0d74a3218a1131", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597387, "uuid": "70d02bb4-9fc1-4e60-a3b6-87a8dbbcdcf3", "comment": "Malware payload (ArkeiStealer)", "value": "876dcdde9e27c0fbace05dade75d4babbaceb760de154945984ea4ba28b8a4a7", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597387, "uuid": "437ddaba-ddc8-4284-b396-c4c15eb732c2", "comment": "Malware payload (ArkeiStealer)", "value": "4ec6ddc25e34bf9614f59f20653895514f61d487", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597387, "uuid": "d3d643ff-d7c1-45d0-9ccf-d32a36428126", "comment": "Malware payload (ArkeiStealer)", "value": "c8f6abac714bd247147e197f1a0fcf6f2c3a1ec4df905fa1a5f2bc8610eb7334a6b568b82bc57885b293c2d937ef2dc0", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597387, "uuid": "3d6966cf-d6df-404e-941f-bc2bcd32ba32", "value": "T1C8E402317DE1C036D7A316708CA5C7A54B6BB8B3C87265CB3B90D62ECE652D08729B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597387, "uuid": "c0956670-d2e1-40d3-ba87-89f8a2d0232b", "value": "51f224c09b57224d474ba4b21025bdd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597387, "uuid": "b84769de-a768-4559-ae80-440d1936610b", "value": "12288:CD7U8QjoJo3WdwD8wE9OxUbmOEkFdWonfgQuzeDpncpC:CDmjoJoBD8SxqmMWQuIpnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597387, "uuid": "772b5f08-fcc4-45fc-8209-25927ab2d5dd", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597387, "uuid": "d054100b-014d-424a-a0eb-909caf1cdc85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597387, "uuid": "847a607d-dea4-4f9d-b910-44bba86b7a84", "value": "f00de15b4e8697910b0d74a3218a1131.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63e25506-2742-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633592663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592663, "uuid": "b45ef8b4-4515-4780-8b05-3ac510eab018", "comment": "Malware payload (AgentTesla)", "value": "3f3cea67f709ecf1da6d8aced4f50081", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592663, "uuid": "8b32705a-3a5d-4af3-8eab-ea3a9a866394", "comment": "Malware payload (AgentTesla)", "value": "8774cee6b1cc614ce918cdefdbb78eb3f14958f59f9f0788e87ad729147ef54e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592663, "uuid": "f455b93a-d160-4f70-9a21-b704a6f9ac1e", "comment": "Malware payload (AgentTesla)", "value": "e60751817e92d0efa69132269fe2588993705a42", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592663, "uuid": "f2937db9-aa29-4406-91d2-188dd49c568a", "comment": "Malware payload (AgentTesla)", "value": "7b4d5878cd980bfb5b170ca5de9e7e615d3f4951ad9ab356f992f200f6d3b9fdfc24588c10e9ed52648017bd8f255be6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592663, "uuid": "f4cfac22-4af7-4189-bb45-7f20dce8d50b", "value": "T1D8A4026813BB9719CD388BF52C18D7301335D02B115AD3785AE8F4BD7E96BB889E025B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592663, "uuid": "f28513dd-9ca3-46ae-b4e1-5d1ac7e7ad69", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592663, "uuid": "64776f90-806a-4e41-8a72-c9977ef977f0", "value": "12288:DZkol9D/Mx9UHEkcNkF+YGGG60gzzPbw:DZkch/Mx9UgM+YGv67zzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633592663, "uuid": "e993f4ca-59a9-46bc-a97b-3aa96abe404a", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633592663, "uuid": "784dbb99-6e74-42b5-ae90-c724039d2143", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592663, "uuid": "bc187c8f-e785-45e1-bcf2-d320e94b11a2", "value": "\u041f\u043b\u0430\u0442\u0456\u0436.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd7402d-2709-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633568169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633568169, "uuid": "51fed796-01eb-4c8b-8374-d22374a16b42", "comment": "Malware payload", "value": "b9b0a03d3102e82d508253665b5c1ccd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633568169, "uuid": "ee1cf866-2544-48f3-aaf9-ef2a938c3eee", "comment": "Malware payload", "value": "88458c1c9be62a81545833eca7a4a759f9271fb1cf3a3fdf395778a2bb0fc397", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633568169, "uuid": "0b637bf0-1544-4c75-a6dc-8c88dce70351", "comment": "Malware payload", "value": "d5d4c7b6864e5ae952b11e9e5622b35574ca3b57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633568169, "uuid": "b6bccac5-903e-4c32-913e-0a3f935c05bf", "comment": "Malware payload", "value": "86f5355f426cb706a4b35d3943530045b4b764063db00f036bd7c9447d1d149a902c41c050a148117f96ad4e2f70b00f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633568169, "uuid": "0f76b5b2-3acb-410f-9092-c36aa7314c4b", "value": "T185853319764650F2D884CBB01DB3A3095DE7B6BD5C3CA00E7ACDACAD1B1D792E61DB80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633568169, "uuid": "8571961a-d70d-4ed4-924a-b59be615dc61", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633568169, "uuid": "15d7186d-a64d-49cf-9f2d-2a79c6624e73", "value": "49152:z750RK5yr3gbs8WwXuq9n/VIUMPSAL7mkIfxX+sm8Y3:X50YmQw8RD9/WPdLakI2X3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633568169, "uuid": "506b905f-d84e-410c-a6b1-524a7689e7dd", "value": 1792132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633568169, "uuid": "ede2082a-c945-4a7e-a4f0-040095238471", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633568169, "uuid": "21a51580-4caf-4e5b-857d-76cae7a09be3", "value": "b9b0a03d3102e82d508253665b5c1ccd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3266e7f-2725-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633580448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580448, "uuid": "817918dc-af2d-4808-90b8-9fc5456873bf", "comment": "Malware payload (Gafgyt)", "value": "41b1d8bdbd628799863c98c36e8e5c65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580448, "uuid": "35b1237c-770d-49e3-8b6d-991b96e2ac38", "comment": "Malware payload (Gafgyt)", "value": "889ed8d2e90fd837b94dc122449310874117540c48a81c01a741806131ec4e49", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580448, "uuid": "fc6f339c-c15d-450d-8c42-c5bad1e62fe5", "comment": "Malware payload (Gafgyt)", "value": "29246d2c4947bd5a3c34c4948689f721ced3da6d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580448, "uuid": "4c60b1fa-242d-44c9-b3d4-48fb217b6ab5", "comment": "Malware payload (Gafgyt)", "value": "64b6e1e37c2ba934d2616a844ef28be72d10925a44e3505a0fae1ea9621f7f121669148ac850a3c029e5e5c69b71185e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580448, "uuid": "69d870f8-ed83-409b-8205-80cb0e844a7a", "value": "T1B8B31993F801DEA2F40EEA7605D70721B630FB660F432A7263577966AE362D53427F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580448, "uuid": "9961479d-0133-4ef1-af90-aff062ed2070", "value": "3072:WpudxeY2pCiRobh2y+sDJ3pOQ1RtmFZ09DRAoQfgm:WpuDeY2pCmXy+KJ3pOQ1zmFZ09DRAoQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633580448, "uuid": "7f786e24-476f-416b-a803-a5cfc252e021", "value": 109373, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633580448, "uuid": "bc4b0a96-7948-426e-bdbe-207dce5956e9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580448, "uuid": "a9f51346-dbf1-4d1b-9819-380283633f4e", "value": "41b1d8bdbd628799863c98c36e8e5c65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab4a1ac0-2758-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633602232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602232, "uuid": "197eb5b8-6277-4204-8102-7875cf831500", "comment": "Malware payload", "value": "f4a9bdacd452bf98e4069b91bcbd94a5", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602232, "uuid": "afbb3316-2b3f-4cf0-bb4c-ba2b2cc61396", "comment": "Malware payload", "value": "88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602232, "uuid": "86c0a59c-812a-4eda-85a4-a1d11ed31eab", "comment": "Malware payload", "value": "e254e41862361acafff59449697dd32d127d8921", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602232, "uuid": "d5d24b51-635f-4e5c-b16b-38edb27e6e86", "comment": "Malware payload", "value": "5f70700d096426006e39b6836f3d17d7b57c567269c8d7a4cb062480accb44c21aab03f619921f2b2128444b6269387c", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602232, "uuid": "6af38f6c-0c00-409c-a8a2-e4cf9119ad09", "value": "T1AAB142AE2ECF2111D0B1593087A80AE17C967A4DBEED8D09E4418B0C9113E03DFF5B79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602232, "uuid": "c3141d5a-7854-4583-a85b-cd601601c5a7", "value": "48:8ysJijPugwMfXvLxXFoM+a62iJefyUVGM68a8pbY2ljVfDhC8a37RlEbb:8yGmPywVVCUIrYc2Jg0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633602232, "uuid": "7a32be9c-c7e8-4185-89b1-cb67e73a4acb", "value": 5400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633602232, "uuid": "86ac972f-0363-41e2-848c-bd5718ea1d94", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602232, "uuid": "3f20c53f-6a1f-4f9e-8d39-b1ee35f3676b", "value": "88b0b1d9988fb2a42934f862944be0b32d00cb5e6ffc71e3164fa7c4cacff62d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d06af9-274b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633596686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596686, "uuid": "36fd75cf-b4d4-4728-8b77-671bcd34ff92", "comment": "Malware payload (AgentTesla)", "value": "09cad340d06161ee616eaa1419024f53", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596686, "uuid": "78d4797e-26ca-4bd6-91ef-ff9373ed8e74", "comment": "Malware payload (AgentTesla)", "value": "89c7ec4e7251285bade32256b09239d6ef245f8b1efce6361954baa6ddd6fe5d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596686, "uuid": "08fadf17-6711-4baf-987b-7c2fc2ba7aa0", "comment": "Malware payload (AgentTesla)", "value": "cbaf201aaabfa7769449a867a28c40b78cfe130c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596686, "uuid": "8d5f3514-6e46-46f4-869b-552a5ef0a084", "comment": "Malware payload (AgentTesla)", "value": "e4e99957a9b3f7791bf2bbf9ab6594449cf0fb900a5528e692a46ed5487b12c63080b0b6cf18b19235d51bc1dfedadb5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596686, "uuid": "914ff9c3-32b2-4867-8065-8f85197c6931", "value": "T1D1842387E02D25D8737918BE8126D48212F5D0BC61694CE933E3A3C7B782E15B7FA971", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596686, "uuid": "82714751-37e0-458b-91aa-cd06efd26099", "value": "6144:vh1NWm4Gwy1/+D4c7+A1eqxXmHUn/xrv56O7iAP0hoj1loqhNxSkjHOcrAXB:J1NWmN1/a4INeqxVnLKO1loqhNxSSPq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633596686, "uuid": "51f4caf0-e664-452d-976b-dbde48acbbd3", "value": 400649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633596686, "uuid": "b1218113-fbe0-49e6-82b5-2d1c87209ead", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596686, "uuid": "60b14723-ca4f-4c95-b579-0bcec2d73542", "value": "CI+PL+AD+OWNERSHIP TRANSFER.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "670e3652-2755-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633600829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600829, "uuid": "df7c712f-dae3-4bed-9a5f-f39412ae6a08", "comment": "Malware payload (AgentTesla)", "value": "f9bf67697d0da7a78d8b436bde5ef431", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600829, "uuid": "289b4131-2710-42cf-a9c9-7530758b1fc6", "comment": "Malware payload (AgentTesla)", "value": "8a4f79751237850a96ceb4de45cc650d7b5903327219ae26e83fe61633aba581", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600829, "uuid": "a5defcab-47be-465a-a963-83f4e18bfe50", "comment": "Malware payload (AgentTesla)", "value": "08197a749f433c9a36af6911a0f06808d0937d24", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600829, "uuid": "088eab1e-8d36-4b04-9d9c-79c184c8b101", "comment": "Malware payload (AgentTesla)", "value": "57ab061160a8e3e374ed390e7086b03a6db54ae025bc1d2f4eb43d426e7182fbfeb9340a64341cad23204b251a15b720", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600829, "uuid": "7873aaf4-8d96-4386-a883-6a8e0957ffb2", "value": "T1FF842367452520C7DDB6894B378F37A8BB31A0D69B0064593CE2DBE0F8EB2A811357C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600829, "uuid": "e8d4a7c7-b3e6-485b-8a40-64a5846c971a", "value": "6144:9cJqwdQUNZnyh854mdGq+0jG5BD4wwQ0NIj8GDML/bduHC/LNPceDWca8JJJw:qJkh8CPz0qDB0xGQL/kizNPzfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633600829, "uuid": "bdd969fc-e27f-4e43-ab50-e5ba748d16e9", "value": 391910, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633600829, "uuid": "0e765e24-6f43-49b5-ab7c-f17ebf237215", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600829, "uuid": "cf9eec3a-d21b-4f96-972c-2bc41b4b8f3a", "value": "CGK HAWB 01.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a261ec3-2776-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633614927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614927, "uuid": "d4c094ae-fd95-44d8-9a1b-6a0a2fc5dd23", "comment": "Malware payload (Quakbot)", "value": "c7cddf1a0c390a58944f7b909019c64b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614927, "uuid": "24d3217b-11f8-44f1-b28b-0411a0cad269", "comment": "Malware payload (Quakbot)", "value": "8a7ba0389467eb3c26a2f0e1fd64f5d23e3ef8d04a8b947251c52b778f507308", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614927, "uuid": "95b002e9-29ff-4e33-a20e-90919cb47137", "comment": "Malware payload (Quakbot)", "value": "1de0e312c2e548bd51c4917a714355c2347454cb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614927, "uuid": "b6a1fad6-e9be-44fa-8405-1a15749150ee", "comment": "Malware payload (Quakbot)", "value": "2a7785185e871a7493c28b7ff8441035051a01351f2001a902df59b030d021913195ab8d3269f6846ab87defcb53d082", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614927, "uuid": "f3d17197-44fb-42ce-9ba9-22ec77a390c8", "value": "T1E9057D013A84D431E7EA55318E29D6E40A5C7D14DEB0A5CFBAE07F2F2AB89F3D215316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614927, "uuid": "0fd3afd8-cf37-44bd-8f75-e31cf5a09818", "value": "0bb088133cc4ca3c25a91945e93e2571", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614927, "uuid": "f4d3d2ba-53d0-4a78-b755-1ead83a6df26", "value": "24576:itjCOuBER57hemWxOVCy632yHAMnbOMmpK6kMXn9vM+GGVdrhDflIF:idr57hemWxOVCytCrbxmpvX90+XVd9Du", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633614927, "uuid": "7bf9fbe1-7045-49c9-ab1f-67937a363732", "value": 844800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633614927, "uuid": "2a31aadb-affb-4db0-a7e4-df12d9d8e98f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614927, "uuid": "8fd4d855-cc5c-4928-88d7-98c399874211", "value": "c7cddf1a0c390a58944f7b909019c64b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56cca5d1-2725-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633580186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580186, "uuid": "376b6b01-9b85-4414-9589-6b06067ae79f", "comment": "Malware payload (Gafgyt)", "value": "b38c4dab511087f2db9fefb80ad20cea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580186, "uuid": "89934725-b0b7-4739-b80a-865d25f5b9ef", "comment": "Malware payload (Gafgyt)", "value": "8aa4ca184928fb0ce92b332c219362fd8510211da1878cbe13e3e4afef55e808", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580186, "uuid": "bbed73f9-6db1-4036-8abc-e7d639112dfc", "comment": "Malware payload (Gafgyt)", "value": "9022c2a8a7269fdd2d4a61b5e6cee4ffc4d6993e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580186, "uuid": "0c9f4b35-738f-4653-8ca6-78eb2d4c13b7", "comment": "Malware payload (Gafgyt)", "value": "ebc06e147e18a9a7ed6ffea8fb0f1b2effa4fd6b324c2986e53ec2cff3f48cb654c71eadbfb486d6b8c54dd98e16d8e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580186, "uuid": "479fbd15-63c6-40e3-b616-28811ba8bb28", "value": "T17E930A41FD458B27C2D327BAE79F429D37356A6467EB33056A346EB42FC17C82E29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580186, "uuid": "f68c59bb-f545-48c1-a40a-557bdcd1c430", "value": "1536:ZfjNq5P8fgPcPHfL/ekyjICaHxtOQyzWCPcyHThdjtmREqQ4b/X7XSee:W5pc6ksaH9CPcyH1mREqQ4bv7XSee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633580186, "uuid": "f0adbf51-ff4e-4895-9f81-942ba06464da", "value": 90368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633580186, "uuid": "3f95df9b-4dc3-4f70-83b6-38b773455169", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580186, "uuid": "c514090c-bacc-4899-9d60-2c0dbf0e9657", "value": "b38c4dab511087f2db9fefb80ad20cea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15c408c4-274e-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633597686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597686, "uuid": "d4eeeadc-056f-4ff2-8f42-aba3b3de2677", "comment": "Malware payload (RaccoonStealer)", "value": "d7f8d0a3ec513ce9cbdd7a357be80aec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597686, "uuid": "550c914a-00b6-477c-a899-e469b8f1847c", "comment": "Malware payload (RaccoonStealer)", "value": "8b33d101cb310b23e41a526a1a5b8424fffbf10ec753c559350938b161bbf61b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597686, "uuid": "5a2da322-e351-4052-bcc3-397886d0628b", "comment": "Malware payload (RaccoonStealer)", "value": "8da28b604de336f8fefb6f386f50a8cdd98155d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597686, "uuid": "74c4c5f4-21af-45fb-a162-c7680917acd2", "comment": "Malware payload (RaccoonStealer)", "value": "228686f62c9c1ce3e8197c806283968e92e9629dbddebb2aadbc55ab127885ee4c60addcadb6135d565a103c6f618b47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597686, "uuid": "ace8c274-08cf-4024-b869-d2725e157e8f", "value": "T180A4F11136B6C076E6A79A700975C6B44A2E7C627E3081CF2BE472EF1F356E18B64316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597686, "uuid": "c6eed9e9-6cb8-4740-bb22-df20f73cc9ae", "value": "51f224c09b57224d474ba4b21025bdd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597686, "uuid": "a18ce9ec-db9d-4faa-a4f7-2d9168db82f4", "value": "12288:XTGwg9jh/TIlhXqATURL+YywQvyVTB2Dmf5b:XTyZM/XSRNyeV9Umfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597686, "uuid": "ccc5af44-87b7-42ee-8b63-6e736cc86dfb", "value": 492544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597686, "uuid": "b52ca025-6411-470a-a12a-fe9961171d91", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597686, "uuid": "1c5d0b55-25c8-49c7-aacc-c536c977d524", "value": "d7f8d0a3ec513ce9cbdd7a357be80aec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a40282c9-275c-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633603938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633603938, "uuid": "390a4ac2-f2b4-4fc5-a068-356561fa3b95", "comment": "Malware payload (GuLoader)", "value": "36e56ca33226a58d835192481dc3ef32", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633603938, "uuid": "54a383c5-9a77-436f-9341-2d1dc85427c2", "comment": "Malware payload (GuLoader)", "value": "8bd2088df673c9e9ee6227a521bcadce468a7e9e0b6a7f6a462c20fc19a3d4bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633603938, "uuid": "1a4e3868-e49c-479d-9580-cef34094d1bc", "comment": "Malware payload (GuLoader)", "value": "56355a6b0a7bf72f385eb2688cefdbe63ccfcbdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633603938, "uuid": "f944ab3f-8644-44f4-8354-7ea135b75765", "comment": "Malware payload (GuLoader)", "value": "047dac11c4bb955480bf383268d561acccf0f2ce73670561bb0e093975baf030577b906eb3ce1347298b1d9dcd24ddde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633603938, "uuid": "89ff4c3c-7eb5-4f48-8477-dd36193b722f", "value": "T167D317D1BA8D8536C402E07E2F3FD4ABBB1D3C3305512983724E2B89D7722EA69B1355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633603938, "uuid": "40113678-1bcb-4fbf-ac14-4209db6b36ae", "value": "d0ac0bdf3a5152bcac064d77eed21690", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633603938, "uuid": "626d54de-8012-4d7f-9cfb-eb4520cefec3", "value": "3072:tjQs3oCH/xTWvPg1lga2dRsqkaMUCMK9TLIzh/jrVB:tUS5/Ig7n2dDxLrVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633603938, "uuid": "f272a5df-3d98-406e-bcba-73e222cee0b9", "value": 139264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633603938, "uuid": "beed03b5-09d9-4c05-9d6a-9ad0f940aadc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633603938, "uuid": "2d744238-bd09-40ba-98a1-50174c2703e7", "value": "FACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad7ce850-2740-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633591928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591928, "uuid": "52812261-ad69-4fb8-9e8d-88ec0d9d10e4", "comment": "Malware payload (Loki)", "value": "1bfd6bc55060073ab5659da849b67851", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591928, "uuid": "e08a4c97-dc0c-4da7-a54e-fe54d8de0059", "comment": "Malware payload (Loki)", "value": "8c31cd5af3676ea0210ed597e54212efb4666dcc4387bcbc8988657ddd1b1614", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591928, "uuid": "427e2e2f-6c50-44fb-b216-a4468898c611", "comment": "Malware payload (Loki)", "value": "c3aacf0cff3f9fb8a495e07639e29255513f81a6", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591928, "uuid": "a0153c84-94ac-4569-b69a-7cf4f6501c89", "comment": "Malware payload (Loki)", "value": "0743ef629330272639fb56ebdd0517f75fd10f3f2e2fb10b5b5b6bc869543eff1091b1e417bcdde20fa7f5528d48e3ad", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591928, "uuid": "37793667-3734-4d8f-a70a-a20d3635b0fd", "value": "T14584222E37C8179FC3B749768A5A2CB64010CEA287F5217E85CBBA5C65727770DE0287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591928, "uuid": "9bd2db42-f38f-4972-afa7-fe1fe1a0f2c5", "value": "6144:jgAoxhMilOh7PY2RmIf576B7Ssy4+wHkRPJYTZd8CysLIRccmmOqeAsW3U6:sAJkOh7PYwv56B7XTHcPJUkqbwOqTsW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591928, "uuid": "71415e8e-7fef-4b97-a946-a873a121e99d", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591928, "uuid": "b8a38989-f29f-422b-83f0-1415ea00dd1b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591928, "uuid": "fddc17c4-37db-4ccb-882f-b12bdcdcd04b", "value": "RFQ_Version 2.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf4686b-274d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633597507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597507, "uuid": "fd39a6eb-f2f1-4177-a56a-0e0ae153ddff", "comment": "Malware payload", "value": "7d490b957c53094cb972141b082c0b41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597507, "uuid": "e23701d2-8a50-4405-8eec-15cd6e54574e", "comment": "Malware payload", "value": "8d9ed28e4ff869fb32f2f4a97c12d40c43942e72a31e9c14c3ce6ddfa0eb63be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597507, "uuid": "5dff0fcc-f8b7-4468-babe-f7eeb721b5c4", "comment": "Malware payload", "value": "40acca2f51a9f40ed4e671ebcbd0233c4149dc08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597507, "uuid": "f371dd0e-30d5-402b-b24e-091deef0d9ff", "comment": "Malware payload", "value": "911c098ad52e98fe646652e2919568ffc41635a1d89d82556f93afb5e7e6e88e89811224a06e8257c1d16488e3f6ddf5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597507, "uuid": "d30b0faf-478b-4836-8696-ab61d230b3bb", "value": "T14EA4F16AB2E41095DBF641F2D4911706EA70B4721B2573CF2BA453771B2B8CA9F3D3A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597507, "uuid": "cd3f8568-89fc-4377-9a1e-78394ad986a1", "value": "7182b1ea6f92adbf459a2c65d8d4dd9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597507, "uuid": "ddd75bbc-16c8-49f1-a68c-b10a4ea28bba", "value": "12288:IbjDhu9TaseNlEP959axuflmi/fLCwQtvu:21eTaLNmD9axuf/LZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597507, "uuid": "787ca39e-7567-4ca9-b077-e1ad900446c2", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597507, "uuid": "cb3a6a02-24d5-4aff-b278-c469a1c5d24c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597507, "uuid": "8f8d456f-5b88-4ebc-92fb-2a7f9fe165c5", "value": "7d490b957c53094cb972141b082c0b41.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a5ace10-274f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633598338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598338, "uuid": "851f3bd5-3fe7-460a-93cf-7ea6215e739c", "comment": "Malware payload (AgentTesla)", "value": "bf97251fd4c601420d82c9cb0b2af2d5", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598338, "uuid": "98a4f881-ea12-468a-a913-af3053d3bf1a", "comment": "Malware payload (AgentTesla)", "value": "8db913bf605fa05ae36e44fb107c6330e8e7971a3e412b83c33780ea89dc7835", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598338, "uuid": "2d8b640e-5151-44ea-b96c-c52c8654d737", "comment": "Malware payload (AgentTesla)", "value": "a60870c9a67380e48e6f4452573c5d329f4492de", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598338, "uuid": "5295082c-5d37-4bc4-a4b3-a36e6445bcb9", "comment": "Malware payload (AgentTesla)", "value": "7b6e8d25cb711326b734b5d94cd83b7ff77a43ac425877d936c6fea2b3fe7f4e5f25c716782083867ae84d66e64d618a", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598338, "uuid": "c87ffc2f-aac5-49e6-9a36-199b7f64d829", "value": "T14345D85363AC8DC4C0A792B4DFC1C4B96C19D9EE421A53B4AB12AB64F75FC031E6A473", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598338, "uuid": "0e65d250-ae07-4f76-8c0e-54e0d1c34e16", "value": "12288:iMUF5CTTJzqQ9xeDx7F2itLVBJuOm1CZJTqWE41Ubw:vU6TTJzdeDxvBMOm1qqNZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598338, "uuid": "f9c1c568-4ac3-479b-8964-d3798044f8f9", "value": 1209344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598338, "uuid": "75e5627d-3cbe-497c-a8e7-02944a62c6c2", "value": "application/x-tar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598338, "uuid": "752d0035-82d0-450e-936b-6b95fca9e843", "value": "AUG_Statement of Account.tar.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab7899a6-279d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633631868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633631868, "uuid": "9a10c498-3483-4e28-afe9-e9b9f87c1797", "comment": "Malware payload (AgentTesla)", "value": "c2a066e66dc740a329a80199dbb6fb12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633631868, "uuid": "bee6b990-7f0f-4f1a-a9e6-1aba27aae815", "comment": "Malware payload (AgentTesla)", "value": "8f041a2b01622d7d672d41a89445e1bc2cce58e3b2c842486b10bd94b3367355", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633631868, "uuid": "7f07ea07-9ea7-4b35-aa2a-cc4aa9d0db56", "comment": "Malware payload (AgentTesla)", "value": "8f6f36b5525d67580874bdbb2885ceb0d6cb20f5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633631868, "uuid": "4cdd9d9b-f8fc-4fab-abba-2b6f0941f135", "comment": "Malware payload (AgentTesla)", "value": "f0c87ebb472a9466bc7740b7403208392aad735d7afce6acce92930023cfe45fd957a44bcdeaf107173f2f9c78dc9cf2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633631868, "uuid": "0f20640d-ad5f-4175-b691-9c609617b5e1", "value": "T1A5B4236BDA9114D2B34DAD8F93B4B7E05430D14F261654C063A313A2E6FF857CADD8A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633631868, "uuid": "278b81d1-be37-416b-9dd1-17e98ef6f0e5", "value": "12288:QwJRDbaCaYlUcfcezgydwv1dkijJs+BUx0Vo8bp:dRqCFzgydoLkCs30VFp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633631868, "uuid": "874c0020-169c-40c9-8a12-3e083a36c376", "value": 496032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633631868, "uuid": "6787dabc-8e6c-4581-b6d9-fce2a0d5dac3", "value": "application/x-xz", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633631868, "uuid": "33ef72c5-4172-4062-a348-e750ccbcf89f", "value": "DN NPL.exe.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a72131f-2790-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633626202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626202, "uuid": "203ff24c-648d-4dd3-82f9-00dd8721b82e", "comment": "Malware payload (Gafgyt)", "value": "f1a7269bcd692510166bee6e52ef2357", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626202, "uuid": "59951a10-f081-4cac-8432-65c6978f5647", "comment": "Malware payload (Gafgyt)", "value": "8f55f85993fef59bf9d2780e827c409ec6af68d7f20ac6ec02c1ba632811be03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626202, "uuid": "bf60c34d-696e-4b77-ac37-336d740f837f", "comment": "Malware payload (Gafgyt)", "value": "2458e74681b270a119ed604e246f4ddb1db0ce20", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626202, "uuid": "161f1fc2-e2f8-442f-97a0-346b97de586f", "comment": "Malware payload (Gafgyt)", "value": "2407b37385d9bf7d81c5bc1703e9561a897c379bb790c78cedea28d1ebbc33f4db2eb2c3ea911a6a557ebd0e889690dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626202, "uuid": "1bd36448-f9cf-475b-906e-1272ba4106d0", "value": "T123931A41F9408B27C2D227B7E78F439D37366A54A7DB330269257EB42BC279D2E39520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626202, "uuid": "133e9a37-5b91-43ba-9928-316b5c3a8cf1", "value": "1536:EIkg9VQPAWeMTEb82Mm3xDKMsF0rOLcvjNPzRxQMpy2SjmokCmCVrQAFW9OXkYe:dQaMTDWWFGjNPX5SmCmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633626202, "uuid": "b7cc79f2-108d-4d17-9c3e-7a2c9d057c00", "value": 97538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633626202, "uuid": "82436b4c-a33e-44a1-ae36-b06a67bc6b35", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626202, "uuid": "66f5c0fa-fe2e-4640-a123-033bf5110525", "value": "f1a7269bcd692510166bee6e52ef2357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2ad3c3-27a5-11ec-843c-42010a9c0014", "comment": "Malware payload (Banload)", "timestamp": 1633635172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635172, "uuid": "826421a0-bc9d-4591-b4a3-5ef5e98a7074", "comment": "Malware payload (Banload)", "value": "e49804b21a1eddfed309a790f4d4c1a0", "object_relation": "md5", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635172, "uuid": "4cd4c9cd-7ea9-478a-b876-76f0a744e48e", "comment": "Malware payload (Banload)", "value": "8f983b92dea0643ef2b8411e5506def0c0235b1addd4daa9d13e59ff4f88a1ef", "object_relation": "sha256", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635172, "uuid": "f862807f-49e7-4229-8812-e24cf09208da", "comment": "Malware payload (Banload)", "value": "10dac00fa5ba2a9948f7e5bf7acbc5293803bb1b", "object_relation": "sha1", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635172, "uuid": "2acc2c01-2b37-45c9-817e-ea9cc9045171", "comment": "Malware payload (Banload)", "value": "0a6c7287f2bf5dafa12aec1726f1a1d005821f9a9971370c8b274797f4bc79ce4ae6faab7cdc33403506c833c671cf30", "object_relation": "sha3-384", "Tag": [ { "name": "Banload", "colour": "#C13579", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635172, "uuid": "a0b90c9e-4d1b-4dbb-af29-5acc530b99e9", "value": "T1DBE52307B7C54B76D59A0130969FC3275635ECA08622C617634AAB0D7EF26A4F3B33E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635172, "uuid": "74855f42-0235-4295-a5a9-b92c2aa23b81", "value": "49152:sziuY5Agb6VmVcbQ/rklQrT2l1LDk3BsvrAA3vcni+/YHFf1eh0gqF11kPt:cY5Agb6Vm1cQylDaWvrgni+/Ylf1JgqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633635172, "uuid": "8c1036b3-cf9f-475e-a198-f00a0521a338", "value": 3091456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633635172, "uuid": "b0da8cf5-79d8-46a2-b50f-ea1298c7c9f7", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635172, "uuid": "97c250b5-f2ec-420e-9d4c-e8e81e90e022", "value": "e49804b21a1eddfed309a790f4d4c1a0.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74794cc4-2743-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633593121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593121, "uuid": "34323f09-efa0-4952-827f-f8c7b5b8b364", "comment": "Malware payload (Formbook)", "value": "5fc60c604acf8e4cae28be5a9556a61b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593121, "uuid": "d209d606-1054-4f9e-931b-ab0dc9c65cda", "comment": "Malware payload (Formbook)", "value": "90995079eb10cbbc7da16c81c68775a46c65a2901eca1731d537192d8266fed0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593121, "uuid": "3e288f4e-42e9-4698-bdbc-5b99df91546f", "comment": "Malware payload (Formbook)", "value": "b69370436d7911e23ec8c8e632c0cf47cb4fa275", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593121, "uuid": "b428e732-f0e8-411f-a663-1fe9c192b0eb", "comment": "Malware payload (Formbook)", "value": "1fc0aa0be2415f29aa47346cd0ece63547643d848a86491173bbc85ae3252ddee7fad8accafc269d192c11f5d6c8c442", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593121, "uuid": "ecae6c20-dfeb-4e45-bbf2-4eaa985d6b99", "value": "T1A8542396B5D486F5C8D11BB119B2B3ADFE7EC198054105130F361F763F22A5F8A29BC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593121, "uuid": "cc6e937d-7d04-4964-ac7d-9ec0563a2960", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593121, "uuid": "c020b379-be52-4d03-99e2-af38f9f11bfb", "value": "6144:F8LxBsdhv1aV6LHT8AlSBYpDKsFr/ok3PiAfl/5lzsW7/LQm:/dhdy48AvKsFr/ok3PXflxl4ML", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593121, "uuid": "50abbcca-9ce5-4412-8d8e-efcbd3306177", "value": 300814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593121, "uuid": "a7fca024-3541-48bd-b62f-4b7fa9ac0bdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593121, "uuid": "f4cebc32-c214-4613-abd4-ff8a99e253a2", "value": "FedEx_AWB#_224174658447.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14400dbf-2767-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633608421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608421, "uuid": "31ed40d3-0cf4-481e-93b7-bb7c2a4fb2a2", "comment": "Malware payload (SnakeKeylogger)", "value": "3aed2b1df64c62b18c58138b5f80c0a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608421, "uuid": "cb226f74-e18d-4bcd-b796-f90e34a5db4f", "comment": "Malware payload (SnakeKeylogger)", "value": "91c9bb3a40a837b095cdaff8f8308aa4e151f6e2d2815f1fc510e4684c9960ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608421, "uuid": "a2a0ad11-5193-4777-94e9-74acb1bdb4f4", "comment": "Malware payload (SnakeKeylogger)", "value": "dad25ac4f9543df537ed7e00681b81b61de6afc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608421, "uuid": "84629ace-02ed-4b2e-8d4e-07a81b516fc0", "comment": "Malware payload (SnakeKeylogger)", "value": "a90f8e7841ab3c3c81056ed01b96cea8ed736c8ca68fed8b129531a08b91b9ebe6ce1d07d357198f5f3bf66fef7acc7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608421, "uuid": "cf98a7a6-2e10-4749-aa66-9c5abec123da", "value": "T18E731A83718614FDE8EA59F3E11B982016035C6AF475986D039A377A19F336352EBF0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608421, "uuid": "4530b039-5271-4a34-af05-cd402711f027", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608421, "uuid": "b98fbe2c-f30a-4ac8-82de-4d273a9dc357", "value": "1536:RU7JFejMgznOM5YwwbkZ/R9hH9BGK2osztFsEzLaURroCoU30+HG58F2g7ELBw4g:OOMgzOM5Yw6kZ/R9hH9BGK2osztFsEzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633608421, "uuid": "ad9c5576-58ce-49a1-a8d9-0fa3760b9c69", "value": 73728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633608421, "uuid": "5fa0933c-9b88-4d6a-a8c7-c7cc5427a88e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608421, "uuid": "9989e03c-f026-49da-9d83-e2b38f50a141", "value": "Halkbank,docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "617e9761-27a5-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633635180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635180, "uuid": "5281c381-edca-41b1-8d5b-064b16e1bff1", "comment": "Malware payload", "value": "fdc97807b7e10757c621604074eac93c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635180, "uuid": "09f739a8-7e6d-4611-852e-68315310e3f3", "comment": "Malware payload", "value": "92c8e516fb2bbc64dab5522a7322852f7a64f4e11819f59650bb48c5c16a93ba", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635180, "uuid": "7198511d-938f-48d1-ad4c-57a700f5de76", "comment": "Malware payload", "value": "7ea8a673e717aaa24eb073f906ad2c7582f99b9b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635180, "uuid": "61e8e5a3-05f2-4159-9844-08082be47519", "comment": "Malware payload", "value": "505f40e31e165af710970cdc6412be053996366ffe19a024601b1def38743468917b94691a3d5f1b75729b56e77d0508", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635180, "uuid": "536b5cfe-0df1-4d79-8bb1-1e31e8182237", "value": "T13FB57D23B2C18437C0771A3D9C5BA7A89939BE112E38995B3FE41D4C1F396817E292D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635180, "uuid": "5e40cf89-f92d-4c17-9ae2-29abbdd576d3", "value": "49152:/xWtu8xVA9ao6JPcy36J+QGmTP/OYLfA:stuWVsa1VcyhA/OYbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633635180, "uuid": "b14fe2f5-9a77-4a56-84dc-708bb7e0cd41", "value": 2482176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633635180, "uuid": "be793136-6ff5-41ff-9956-718611d0c14e", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635180, "uuid": "0797da01-2946-4761-9d2b-c496dcf1faaa", "value": "fatura - zvqyxnfsltfdaqaaowfo.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1199f58a-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (Neshta)", "timestamp": 1633597250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597250, "uuid": "f1446fde-fb38-4273-9841-7f2797f1a35c", "comment": "Malware payload (Neshta)", "value": "5ecdf9607af624d3ec1ed2bc9f0e9146", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597250, "uuid": "5ca3403e-12e6-45f2-aaf0-58c6db9dfad7", "comment": "Malware payload (Neshta)", "value": "934615bde495d4cbbfd0178c6eea46804cb19a447db1a8781bb43c5986012cbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597250, "uuid": "e1cf6332-8f43-4349-bc0a-d83db01a1537", "comment": "Malware payload (Neshta)", "value": "d68079d495932ef242efc76e96fe6d75a1ab8dc0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597250, "uuid": "3ae47dcd-a96f-49d8-9fe5-611cbe2dd73d", "comment": "Malware payload (Neshta)", "value": "9ce573827be9baefb92a116b6b491e6593c0e316285c7e9f5ffd0b15c63e9d64f2806f08280ff7021efd8d36975deeba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597250, "uuid": "23f4b101-fb45-40a7-90c5-7f38d78dfa69", "value": "T1A3741296FBE0C4B2E0211E74CD26D7B4E637BA2698141743EBB85D6EEC793C18E0C615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597250, "uuid": "794a23d6-1f06-4ff6-b6fd-b8af9b09d3f9", "value": "9f4693fc0c511135129493f2161d1e86", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597250, "uuid": "64524a35-fbf7-4dc3-839e-3ed79abb10bd", "value": "6144:k9cJrv0zlkc8PbinRR2Nciu3WcHcdu9FYlIRVFAyC7RoCadesoWqJh8LxBs3T:1Jr85mPbWiu39uRIRcHFxxv1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597250, "uuid": "5d8ab739-f842-4415-836c-359e345ce0ac", "value": 347329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597250, "uuid": "3f1a93ae-e99e-436a-adaa-f23526d8456d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597250, "uuid": "dc459668-b3b4-43e0-89b9-3a0768e68afe", "value": "5ecdf9607af624d3ec1ed2bc9f0e9146.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae1f7ce-278f-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633625827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633625827, "uuid": "5c3ed801-d559-43b7-ba08-1925d651b19b", "comment": "Malware payload (Gafgyt)", "value": "082ce20af53fb2a998daca3332c3a001", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633625827, "uuid": "e0a9ceac-14ec-4eb3-ad7b-d5e9f30935dd", "comment": "Malware payload (Gafgyt)", "value": "93c0a5b2259d74aa77b760fe02b7d954c2d56628c14fad50ff74d36ade8f64df", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633625827, "uuid": "2e5955f2-e01f-4383-ba87-9bd8a64a27b6", "comment": "Malware payload (Gafgyt)", "value": "e8873560718bb12409ca485ea1e614811304cbda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633625827, "uuid": "07da0a17-5adb-464f-89a7-063b161fad6e", "comment": "Malware payload (Gafgyt)", "value": "2ea67f9fd2800ead367fe0060e869f110521195e9890b5a09eb68cd8c40a772716f138c0696cdb8dff5a20878575defc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633625827, "uuid": "44d90737-4ae0-4469-bbd4-18cec26dfc32", "value": "T18C734A47AD628FB7C146AAB525A759300723B8215F0F1B89713DAAF8470F8CDB80F765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633625827, "uuid": "a868eac7-6f7c-4361-9e4f-5e5179ae6d14", "value": "1536:kAmbedEfIKy1BABWWNxiEVN/Cv3yzTN7mj9VqYLe8f26e:v+eefvyoWWF/w3Mhmj9VqYq8f26e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633625827, "uuid": "8c8e1eb3-129a-4a9c-80e7-61737327fcd3", "value": 77753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633625827, "uuid": "7d927c44-f333-4473-aef3-b01dfcc5aed8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633625827, "uuid": "4bbe189e-b754-4434-a159-86a32eff87d4", "value": "082ce20af53fb2a998daca3332c3a001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d7b06af-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633597484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597484, "uuid": "8f78d659-f5ff-4dbc-a8b8-7e1a300a8963", "comment": "Malware payload (RemcosRAT)", "value": "96c9050cab0b7564a37b7083fbe5cc72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597484, "uuid": "b346dd6f-4a92-469c-a43c-ee5e86906ae2", "comment": "Malware payload (RemcosRAT)", "value": "945a23f76067b7458968401a2b7e45f763425c4eb3bcec1c31b7a1465dfb5df1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597484, "uuid": "b5e483f8-bb23-4601-bf99-0905ef2b01a0", "comment": "Malware payload (RemcosRAT)", "value": "08a5c4fa30c80abbf4a15f60eb27838b5fd1e7b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597484, "uuid": "cbce95ea-4f67-4b61-82f3-2842f7e10357", "comment": "Malware payload (RemcosRAT)", "value": "34c28973c0476cdfe35f4b442254f72082a00ca674a69f295e5cb3ec83bbbb09c033437d185098dc29fb58d8dcf867ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597484, "uuid": "be6c176f-390c-45c7-a21b-b7e904a37d90", "value": "T1ACC493D053CB99C4B57B2139B0222CEBB47D630DF3AECF1151977A938CBA790561DA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597484, "uuid": "01e6bd71-9f9d-4892-95cd-92ef109fdaa6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597484, "uuid": "e2e108cf-47ac-459e-b261-61cf9a001e2c", "value": "12288:1qzI046Mnq0UnsO5lJkKzUvoPUu9YvdTl0wRB6J0bZ8d06ptBdVxh:0qT0Y6w/+tB/3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597484, "uuid": "06c4a37d-013c-4974-a51a-eb636a248e8c", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597484, "uuid": "5684a483-436b-4642-9aed-540e08946ff9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597484, "uuid": "5c44fc82-f66d-40b5-be24-83d9242c06e2", "value": "96c9050cab0b7564a37b7083fbe5cc72.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa26b16-273e-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633590938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590938, "uuid": "6580f32c-2bb4-4ac3-babd-76e02d67c898", "comment": "Malware payload (RaccoonStealer)", "value": "8249b5d4481c5b4eb20c1aac1e33c620", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590938, "uuid": "91c3e662-22d4-4ce0-b30d-38eefc246ef3", "comment": "Malware payload (RaccoonStealer)", "value": "948b7be55369e1fc991440d1a6fb52e334288a978582c276b8fa46c6de9a7648", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590938, "uuid": "6aea133b-0dc7-4e96-8624-cf6ca0e3e901", "comment": "Malware payload (RaccoonStealer)", "value": "cfb46c38f38db7df865aeccc22b3b6a738a1396f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590938, "uuid": "aa0ba0d5-7503-4c73-a1d5-3b78577d5a6a", "comment": "Malware payload (RaccoonStealer)", "value": "7376ddefdc98065ca92ad4bc7f29be84e97c20c1dc8a728521fe6d7cc6f05932d562e5d24b75edb8627e1985029557b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590938, "uuid": "a6460d50-98de-437c-ba62-484197cb3a86", "value": "T132B4D010A7E0C035F0B716B60979D2B8953EBDB12B6590CF62D116FE9A796E4ED30343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590938, "uuid": "633fa52e-3ae6-4c79-8210-49db2b86ba48", "value": "654aff1ee1bc89531bd3b96ebe76ae67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590938, "uuid": "e85333b7-df31-4adf-93ff-c208a2cf6958", "value": "12288:cQw6MdwncucKvhEqQsWj5PCfezhTjuirwPFlC9U25x0V/WsTdqn:cQBnAKJr0j5eGhHuirWFE9L/CWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633590938, "uuid": "e9e17882-ccf0-40ab-b6fa-395acb6198fa", "value": 496128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633590938, "uuid": "3e006fef-ff1f-461c-8b7c-108f902bbce9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590938, "uuid": "1319907e-38a0-4a8f-8203-683b02686f05", "value": "8249b5d4481c5b4eb20c1aac1e33c620.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b1f35f-279c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633631353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633631353, "uuid": "fc19e9ef-3959-495c-b24b-441f00a3ecb8", "comment": "Malware payload", "value": "8720826b89bda1dafa5ba5468f67efa4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633631353, "uuid": "e05650bf-e8c0-467c-b470-c63ded0f83e9", "comment": "Malware payload", "value": "94aa24f8b40073f3474809c5e7b5c0bb808a88a65810d92ee231baeb8efc0cb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633631353, "uuid": "58f0b19a-b176-42cc-b0fd-3f5196bbc120", "comment": "Malware payload", "value": "64e4fb4b7e020b23b37969ed1c83593a6aed408d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633631353, "uuid": "4b8440a1-6b1e-439b-8911-492bf984fadc", "comment": "Malware payload", "value": "c8ac60c8d33f72f5ffcf23c2e70d5ab4da16ce54d77c5f52a67ebc2308b4475de7d483c59aa343fafdf36041374d7d3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633631353, "uuid": "7ea9cb1e-d678-4737-8869-416618678b66", "value": "T117E4B32C3A0D5AB2FD9D9D30CD062A19BB660F0363F0A9D2579B26CB875F1F52D05E84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633631353, "uuid": "7e27601a-27a4-4ff1-8c15-a2b52cc4b27c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633631353, "uuid": "5c665982-8c97-433e-9ebd-d633a1bc2703", "value": "12288:dEWB2/De38aTiJgJgMluUOJ+Oj2Bd3X3uIIIkIxV0DT:aDDM5iJWgMlF7OyBd3X3B+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633631353, "uuid": "b32bd26a-36d6-4d97-bf18-1633153cc363", "value": 719360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633631353, "uuid": "f738e636-e94f-4e59-b69d-05c9223c5438", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633631353, "uuid": "d399a6eb-3997-4690-a0da-c30c6af03979", "value": "8720826b89bda1dafa5ba5468f67efa4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1e5217-275e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633604762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633604762, "uuid": "0832586e-6ad1-4a46-bbd0-601942b0e024", "comment": "Malware payload (AgentTesla)", "value": "5e724132fdbf824d4a1bd9b0030d62f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633604762, "uuid": "15f16bdb-e2e4-4c54-950c-d96fb9a7afcc", "comment": "Malware payload (AgentTesla)", "value": "9510626388d0491262d6b2bcf9a58fd987a2b539e403ce2915515b9098c1586f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633604762, "uuid": "8c8d97ef-9438-4b6f-acb7-28a7f7b0d02a", "comment": "Malware payload (AgentTesla)", "value": "6328019216c9205bf1eee7bad764584ed6bc4edf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633604762, "uuid": "6841d0a9-323b-41e4-80ff-01a87180c860", "comment": "Malware payload (AgentTesla)", "value": "a0465f0f704894a4cfa746f083d0e8e53ec65f559cf120d10d0678f4aa29ead37dfd8b34d078d0d9aafb469128335ea4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633604762, "uuid": "de062809-da8a-4934-8045-33cf397ebd3a", "value": "T166C4CFE41157C148ED28CFBC6429AB101B3A7DF6253CD26C5DA8B86B3E733AB44F5582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633604762, "uuid": "47cb905c-9b00-4fbc-b117-3370ed4b5306", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633604762, "uuid": "897b40af-cbff-4b4c-993c-9394f284d5b2", "value": "12288:4kovbgmFhpNTZ7QRTH9Sd7H1qrgPY1VUnt:4kyhZnuM7VqEPbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633604762, "uuid": "327eac05-c436-44ac-9b69-8f1e9c92459d", "value": 574464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633604762, "uuid": "f4d58d47-a176-4ce6-80cd-585bfb911503", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633604762, "uuid": "6fa4cab3-4ab2-4b80-be82-87648c4a1c18", "value": "PaZLQnZSFmBq1Zh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61096e9-2737-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633588077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633588077, "uuid": "58363fc9-9dd8-4e03-8296-3708c25a7469", "comment": "Malware payload (AgentTesla)", "value": "eea604286eba1b167fac8db3845c2130", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633588077, "uuid": "b16f3865-71bf-4fd3-ad5d-27f065cac9bd", "comment": "Malware payload (AgentTesla)", "value": "95345176c2469dc184001d8055b0257760235a947c4ab56bd25155e8e7911667", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633588077, "uuid": "ce32d305-e468-4628-823d-e075aecfa51a", "comment": "Malware payload (AgentTesla)", "value": "c46ac60597717f8709cc235bd6462315d703179a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633588077, "uuid": "56d84124-f081-41c9-b311-ab400ab85b4f", "comment": "Malware payload (AgentTesla)", "value": "80efcbfc9fe8fae662b1ffbbed4dc17bb2e3ebd185ee7ca4c9900b91f86b0768cbca41c189551bdae07d975d2da9b72c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633588077, "uuid": "cdca0d59-b782-469f-9d19-4c87f904bd81", "value": "T12F150E5363AC8EC4C06792B4DFC1C4B96C19D9EE421A53B4AB12AB64F75FC031E6A473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633588077, "uuid": "a115efd3-42f9-4b46-89b1-68c80f3eaf3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633588077, "uuid": "44e232e1-6622-49b9-a00f-91de2a75af85", "value": "12288:hzUrlBLnoVNhabBQUWJ8PNxq4xrvGoQZO:ZUTLw3xKPNxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633588077, "uuid": "7f379023-55d7-47a5-b463-546744d52ed0", "value": 875008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633588077, "uuid": "7fafe716-4547-4a08-b597-f28f911e5cab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633588077, "uuid": "9aae4258-bcde-4c0d-a982-d1c5543e24c1", "value": "009876789NM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944f385a-2775-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1633614649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614649, "uuid": "47288f75-ee08-4799-9e1e-7756cae3fa08", "comment": "Malware payload (Gozi)", "value": "0f90b21a2cdc35511626509c67c8cbf5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614649, "uuid": "d5490930-d353-4e05-bce8-06620c5682e9", "comment": "Malware payload (Gozi)", "value": "95dbbfc33223e8e670b4f25d086d65a41d67f0434d3fe37469a7bd23e134f1f6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614649, "uuid": "8b150a4e-d132-440e-83af-c39f34c83eee", "comment": "Malware payload (Gozi)", "value": "1293aa454365b3679afd77b34749ce8e175c997a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614649, "uuid": "bc911706-69a0-41d5-8261-4344d200e018", "comment": "Malware payload (Gozi)", "value": "098f1f8498bfee7448a08acb45165dd0ca03925c3f203fc12e3ac59f7bab7ace5309f56a7235159385b5f5ddba93086a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614649, "uuid": "a4081277-e928-41fb-9fcb-277eb742ca4d", "value": "T11784BF14FAB884C1C2CD2474687E8D21D34DFD48BC959A6712F56E3B79F02672E6C88B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614649, "uuid": "84194017-9dc7-4df8-b6d0-23e7160fe934", "value": "6a47c078cd001e32ce158eef785cbcae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614649, "uuid": "b078fdcb-69bf-4705-a47d-906a42d96aa1", "value": "3072:/NCW8aQutBgN/+bz37UGw+24RwFBatjKqe0FucS:/1oig+TRwTYKqe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633614649, "uuid": "61b07032-af27-4ab9-b0b0-dd456cea67a2", "value": 397824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633614649, "uuid": "3f100947-fc67-4741-aecf-7a03bfe0f0f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614649, "uuid": "8efe83d7-d53b-4e79-864e-29ee570848a9", "value": "0f.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f77d323-2765-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633607688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607688, "uuid": "f2a8a683-8e1b-4f57-8fa9-703147396846", "comment": "Malware payload (Formbook)", "value": "2e34120087275cbbc65d17980917162f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607688, "uuid": "02bcafa2-26ef-4b71-a389-4852940f0c0f", "comment": "Malware payload (Formbook)", "value": "96ac71b8d9aeee5634301ce728ad4594d7e0bf87542241e157d31b4c8a1aaa2f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607688, "uuid": "788ff797-ad0a-45b6-bd79-1b3432a06a93", "comment": "Malware payload (Formbook)", "value": "fc3dfd7e738e44ae0eb203bc0a5b56c0afd8d9b5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607688, "uuid": "467d1f06-aef3-48e3-bbef-cfcb55408966", "comment": "Malware payload (Formbook)", "value": "a12df0e9240d297218d11749ec2fa206b8d9e3a9114153bea962a239dac20f2ca975595be6e4a11b5f71fc314e591a7a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607688, "uuid": "9b2cc35a-232e-44ce-abfd-45382ff75319", "value": "T1B964221DFD8C1A33EBBBECBAE1764A5D1C2EDC461283564579A039839872B7CD84831D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607688, "uuid": "312c7a5c-190b-466e-97c1-30901164555d", "value": "6144:bGd+PBj9UF3tvdxLCERPc6IRCr7QdbBAY2BttqXPTQXq:adihct7LVRPc6IRCPmbu5ntq/0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633607688, "uuid": "de0ecbb5-c752-4430-a06b-50df883344e7", "value": 332288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633607688, "uuid": "a539bd62-343f-4d66-b3b7-8dd29da60bdd", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607688, "uuid": "9c6bfc76-e247-49cb-83fb-0505c1769a61", "value": "SCAN COPY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f265d39-27a5-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633635176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635176, "uuid": "9d0b6b8a-d55f-4b31-8eb8-ed9b7e100cd3", "comment": "Malware payload (Metamorfo)", "value": "362c8be775b925a3181001ef4c0deb8e", "object_relation": "md5", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635176, "uuid": "52580485-3449-43de-bc45-bf0b92fd0ba0", "comment": "Malware payload (Metamorfo)", "value": "96b40d51dc1cd8448ab19aa355592008850497d3af106cdf2b33544fdbbd5fce", "object_relation": "sha256", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635176, "uuid": "dd3fcf45-f494-46c2-9086-8310f9bb2952", "comment": "Malware payload (Metamorfo)", "value": "a6d5ea7d9dfd439add79fc5444c8022a7d605f4c", "object_relation": "sha1", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633635176, "uuid": "bdbcb33d-fad2-4a63-80cd-648929d553b7", "comment": "Malware payload (Metamorfo)", "value": "798f471ae90bbb098ef9668f37f877301a4fc2f4e880d1c2af1efb97f31f32071134688e674a9b72fbbdddfd277242fa", "object_relation": "sha3-384", "Tag": [ { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635176, "uuid": "dbcc006b-023c-418f-b041-be5df267ca5e", "value": "T143447D06B3D5437AE4DB07721B8B93628A72EC788673412B1249790E3EF1554B7B73E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635176, "uuid": "11381230-0226-45a5-835e-4154d9823205", "value": "3072:jmB4Ay903DaY4Auwgz88ereWn/7w05g0ZMcB3RUN46ILJ9+ZB5yOanvD:jmF3DaY4Ar8er1nzTwroD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633635176, "uuid": "42bcc9a4-7c94-4873-a6d7-fae802d8d361", "value": 270336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633635176, "uuid": "6ff64ad7-777c-4a3f-8c02-56cacc3e8c0b", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633635176, "uuid": "90fb2c05-0740-4fdc-9dc7-81637d84183b", "value": "362c8be775b925a3181001ef4c0deb8e.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49e100cc-2725-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633580164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580164, "uuid": "7c37b2a9-2fbb-4cc5-9514-9f45bb43a5cb", "comment": "Malware payload (Gafgyt)", "value": "d3274e4f0bc005ed9eb68122d694c661", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580164, "uuid": "225b6d01-e596-4e39-926e-bedff996b9c1", "comment": "Malware payload (Gafgyt)", "value": "96b7b88eebc962cf6964bfdcde6cd0f3c7e44114f1822a9e12e5b11dc4648c1e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580164, "uuid": "fcc0adfa-4eeb-46a8-91a8-f88feaa149d2", "comment": "Malware payload (Gafgyt)", "value": "311ec932cab6804fdbb21b31776bd9bcff063639", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580164, "uuid": "3cb77ca5-5c26-4720-9c32-a9debe861855", "comment": "Malware payload (Gafgyt)", "value": "910197f01d888197814454eb77833ed045af054161a2f0d0c761b92ea4fda75d7d9ffe35ba4f4211125ae530e73c5cb5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580164, "uuid": "782d4c13-6f56-48e7-b9ad-3a98d1b23c52", "value": "T16F933B86E602C6B3C4431BF502AFAA5A0732FD2A4A3B8EA6F71C7DF45B119C53215791", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580164, "uuid": "b7da02bd-f567-4cdc-bc2d-973b4adcee22", "value": "1536:Wb8423LJOxYRQzdmbWzKWQC8jIOlfPUEikuI75hN/aEGTWshe0QzUzJYQ2Wk:e2QxYRQRuq98jIOFPUEuc5hN/atWUe0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633580164, "uuid": "aee152ed-68da-48b0-8b89-f717596fcb81", "value": 91540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633580164, "uuid": "04b66a25-7c40-41e6-9e11-9dac6f227afc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580164, "uuid": "d8fc4c27-9c8c-430b-ab77-0aa1e0a69983", "value": "d3274e4f0bc005ed9eb68122d694c661", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afae2de8-2776-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1633615124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633615124, "uuid": "d455e49b-112c-4205-b18f-36a2efb3cfba", "comment": "Malware payload (Gozi)", "value": "c9cd971a083303b1b7c4c912f8739f6b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633615124, "uuid": "cbabdae6-e44f-4fbf-be9a-82ea46c1a94e", "comment": "Malware payload (Gozi)", "value": "96defacb7096fc81b809c4b0e427399cb2f7da2fb7eb278dd676785a8a476181", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633615124, "uuid": "a3ed91af-f66f-4202-8b92-5e46d722869c", "comment": "Malware payload (Gozi)", "value": "25fc199dbb5a7c0a71dfa8f430d8f09d09c0326d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633615124, "uuid": "ad49821c-677a-4c95-ab1e-99cc2b4b79dc", "comment": "Malware payload (Gozi)", "value": "12814d25b10e5eea51f3cd2cbd5f2f0419009ab75aa35d2746f016e2e65f3627feae5eeb166fb5997ddd633bfed8df86", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633615124, "uuid": "d6c8f502-8532-4230-9fb4-7f480f752a38", "value": "T180F38D127584E135D72E16344CA7DAB80667BC0057BAEC4B33EF1E9F47A3292F622785", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633615124, "uuid": "9e687615-8c69-4ceb-90dc-0df97198ce5a", "value": "03950ae48622d89c2d077838afd282e9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633615124, "uuid": "01daebad-2500-4ffd-9de1-a8b4a90b169a", "value": "3072:LPt9UofdP4nIFJABRIGM2k0xe2Iy95auD3H8t2YmzQPJbN:DtLdP4QaBaGM2k0xe2T55bQ2PiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633615124, "uuid": "faf80dd1-8e08-41c6-b60b-76a089a8418b", "value": 167426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633615124, "uuid": "e5f06720-8a59-4dcf-a633-141e451adb69", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633615124, "uuid": "871d1b9f-7043-489b-8680-5d343abc31ce", "value": "c9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "252fbe66-273a-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633589122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589122, "uuid": "58460fb3-b144-495b-8e91-8c10c5ba9680", "comment": "Malware payload (RemcosRAT)", "value": "138950dee458fd6eba983c5121d6b6db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589122, "uuid": "634b9e8e-fd4c-4dfb-b3e3-96d1322eb59d", "comment": "Malware payload (RemcosRAT)", "value": "978567f9e1c96845ed398ae0a75445a68cea415395c1df41cfeb673bf4ca57a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589122, "uuid": "1451bb57-726b-4b5f-96a8-00b8a511dbaa", "comment": "Malware payload (RemcosRAT)", "value": "4d8afefd74fbb9913ab8b43d100ae44efc1d9751", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589122, "uuid": "1cebef99-1598-454b-af49-b3fe9851e754", "comment": "Malware payload (RemcosRAT)", "value": "75dbe01341c4c891d3d940e9f035998d8c49317c1ce6d07281e287c0c29ca1cdc0bad14b50d0d6165b844d0f36ea116f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589122, "uuid": "00169cbc-0b63-4947-bd53-167d82545b3e", "value": "T163E4013D636F8F14FE3A8BB52CECC105A17EEC776497E36C6A44A02D98617B899540C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589122, "uuid": "054d328d-fb1f-4e50-9414-6fb4d91ee820", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589122, "uuid": "96f76098-cec5-47b2-9de7-53b13260b8a8", "value": "12288:1a1A82cEXurovr8A79IbaqQe0f6dIS3POK2o7QkJFrNEXWo:buwIc9IVQkaoPH7QkJFrNEG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633589122, "uuid": "b120a7d3-c0b4-4566-9d77-1ad2701d7aa5", "value": 708608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633589122, "uuid": "0a18f036-f217-463d-be7b-4238dead7aca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589122, "uuid": "8e97fa02-3512-4bb5-bc16-153506bf1531", "value": "RFQ - QT-2021-10-0701-005 - (DWG.NO-CH-03) -RITTAL VIETNAM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9851290-2743-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633593344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593344, "uuid": "6912dcca-465e-41ce-927f-51bd4d0f1282", "comment": "Malware payload (AsyncRAT)", "value": "b3c791affa9ceba9cce2a958e46bf92c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593344, "uuid": "c891aa73-dafd-4251-9896-c0389428fb92", "comment": "Malware payload (AsyncRAT)", "value": "978e10c5bfe31a74edacc283556ec39e9934093ffc3936f76855cfe9e6fc97ed", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593344, "uuid": "ac7c9be1-c62b-445a-ac66-bca0f95da162", "comment": "Malware payload (AsyncRAT)", "value": "4cd7cb97c1b2e8b8ce35577021afeb04e2aa1a60", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593344, "uuid": "c2e90094-0e8e-45cf-be68-aaa9c79f59d3", "comment": "Malware payload (AsyncRAT)", "value": "ce7b4b33f542a2091494cfef41f0bce5fdbcc4ef3472ee53280651ff6b85cd9149b75897619e39fa1d1253ed23e5fed3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593344, "uuid": "e1529b27-697a-46bf-8472-99a24320ef30", "value": "T17EC1FDA2D04E28CB3106B8340BE881AA267DF3F3C1DC59D17658B9EF083C06456EDBA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593344, "uuid": "878847d4-9c0b-4f6e-b2a2-2287f5dd97fa", "value": "48:WTTTTTTTTTj3EKOnIyOHACFzUxqCNTTTTTTTTTj3EKOnIyOHACFzUxqCO:23EKgIfHACFzYqK3EKgIfHACFzYq5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593344, "uuid": "a32c62bd-0a6d-42f5-8e34-45cd3deda252", "value": 5745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593344, "uuid": "6a94bae5-62a2-4ead-a347-eb70b29c2636", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593344, "uuid": "5cbbd2b8-fcf0-40b5-b431-e6cf546d1781", "value": "(10.06.2021)IDLP.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91202c6b-274c-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633597034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597034, "uuid": "1b4fe31e-cc90-4879-80a0-54f987bd2366", "comment": "Malware payload (ArkeiStealer)", "value": "09bfe175150951f7151c6ef1dd81a768", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597034, "uuid": "67f4b25c-f190-4d23-9ce8-82f88d088e91", "comment": "Malware payload (ArkeiStealer)", "value": "97c4e1873b91faf541dfdabee7dd930d97e9d8781fc157f1d7ce6ec7ea561eb2", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597034, "uuid": "3208375f-4f5d-4b1c-9166-e902c675650f", "comment": "Malware payload (ArkeiStealer)", "value": "d67aec5177874c5887107cc106990f9436836772", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597034, "uuid": "7c268e8f-0e30-4cc5-9b03-0c4bfcb67c2a", "comment": "Malware payload (ArkeiStealer)", "value": "b173c76a44b2e1c5a79f754be570865745c1811ad1f42baffa1fe08062c51bbda3145f3f6e18685b1bdd8e170db5a846", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597034, "uuid": "d2b38db6-20c3-4a01-8577-e8836d95705d", "value": "T160E40110BBE1C031F57756B64A7983F4A43EBAB1672492CB53C426EE5B746E0AC30387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597034, "uuid": "6878117c-d60b-429a-bff4-ee0ade37d776", "value": "dfddb4935ecfeccd8e67f98d0f98b8e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597034, "uuid": "9f505fb7-dac5-479c-9ad8-a42009f65e81", "value": "12288:7Fx9USdHcmgL7IwtkhfYH/1vd2AT4P06IA6wI8Bo1Zkpvo0rGI5DFmXVaUtN9:7F0YgLJtkhfsdvd2AT4s6I1CNNDlUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597034, "uuid": "7d8f9d18-9142-4fb4-a202-b1036acc860c", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597034, "uuid": "9c7f12f8-fe69-484a-8064-985603e0ac73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597034, "uuid": "723df6cb-e1fd-4c85-8f74-9bb245232a94", "value": "09bfe175150951f7151c6ef1dd81a768.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5abd2bff-278d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633624860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624860, "uuid": "719226f7-784e-42da-a998-0a2e60c9caac", "comment": "Malware payload", "value": "6bac0ec214fff2871ddae38a5d6c5b83", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624860, "uuid": "697e258d-9bfc-49ae-bdf0-4e9c543ac724", "comment": "Malware payload", "value": "98041f1d954b2448a86fb228caacd5864d3f355b5cef78a14d3716ef2090efd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624860, "uuid": "c8a9fbc4-59c6-48ca-b573-ba793cdb29ea", "comment": "Malware payload", "value": "51dda4d5236eb7d70f28d48f22e5b3ba29d88009", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624860, "uuid": "511776f0-68f9-4633-bc5b-aea382a430bd", "comment": "Malware payload", "value": "043f8d5700ec005869d4e30d507df1355f7fb4acf08db428a6fa79ac6d64a03cfc75d93c070a1723ac0b5ae47fd9ad96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624860, "uuid": "d0378bda-1d3c-4e38-b611-63f68bed4e7d", "value": "T1C984CF00BBA0C035F5F652B8097993B8B53F7EA16B39D4CB62D516EA46346E4EC3170B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624860, "uuid": "7b4dfee7-b95d-4d1c-a68d-eeda42b11733", "value": "c1d211268d6c769cc59ffca0e56e63c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624860, "uuid": "02749c70-7b4f-4572-aeca-a1274f6937b7", "value": "6144:SyZ8hOkt6d9RnbgMEQrReLwpsSU4JSHpe2lyyK5+270a4lhplr9y:pdfbLrRJsGge2lyyK5+27Elh1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633624860, "uuid": "efbaa119-a860-4bba-aa24-7d94db8731b1", "value": 380416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633624860, "uuid": "95a947c4-9291-4e1c-84ad-6b864c07fc32", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624860, "uuid": "85a9e948-6861-4ac2-a111-7897ff198457", "value": "6bac0ec214fff2871ddae38a5d6c5b83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57858664-274b-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633596508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596508, "uuid": "26f0f7f3-5cb9-4e44-a264-89c9dbd3129b", "comment": "Malware payload (TrickBot)", "value": "6b3106498b7a96f2c81226e9f8b641db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596508, "uuid": "0f7fd75e-b437-4c8f-9ae4-1d0913e82f87", "comment": "Malware payload (TrickBot)", "value": "98190daef6fabe0513518943ffbc9abcaf4dd7c0bfd37bc996fbbe261d831b3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596508, "uuid": "e7294530-f689-448e-b516-1c5e488fdf3d", "comment": "Malware payload (TrickBot)", "value": "c7093ee0bee24393dddfd45cd4758fdbe2cbb3a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596508, "uuid": "1eeb8f41-8ce0-4762-b5b6-7fc017f772e2", "comment": "Malware payload (TrickBot)", "value": "8236725f3f2c13ccd900326195126d02e4991d21cac88ee475c545cffd9334f9a187157366a1e76d0524dff1dfebaac1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596508, "uuid": "82406984-c130-4443-adc9-85ed71a6fdea", "value": "T19DD4C012BBD08876C99322324AE3A735A7FDEC015B22C7CB57D46E1EAC726C54D36316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596508, "uuid": "0305b024-8cd2-44a9-82c8-da7e45a2408a", "value": "96459f3ac5474c1f5d7b0f19d0d0d7ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596508, "uuid": "53103f4b-8793-40a1-b662-2bcc76f8c3e8", "value": "12288:f+t405GC8+pDumfo7RBBun3vDNopBzZ3a:eB5GC8+pDsbBMvB4BFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633596508, "uuid": "e18224fa-54a4-470b-a869-b29b391cd266", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633596508, "uuid": "3ce4f0bf-d1ec-4dee-8a74-f4d632a0fa50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596508, "uuid": "4ba172ae-45da-4e78-9874-61ea2c205e07", "value": "6b3106498b7a96f2c81226e9f8b641db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3a0d804-277b-11ec-843c-42010a9c0014", "comment": "Malware payload (QuasarRAT)", "timestamp": 1633617332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633617332, "uuid": "450349d3-1e0a-4073-b540-b963fc95cf50", "comment": "Malware payload (QuasarRAT)", "value": "cec69c842416bdcbbf393b2dd2fd01e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633617332, "uuid": "a88cc70c-2116-4a14-999f-85ac00dc22d0", "comment": "Malware payload (QuasarRAT)", "value": "9a498a01595504b0d2afc00ce9ebf2c3e7ce6d557fef89cf9d99759ee032d921", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633617332, "uuid": "061f792d-a0a7-4d79-a1c0-19264218d153", "comment": "Malware payload (QuasarRAT)", "value": "909949c9519ed7d2e284709b9992a4d92a1a44ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633617332, "uuid": "1e16d28e-0d52-4682-9398-8b3b3b21a17b", "comment": "Malware payload (QuasarRAT)", "value": "8a343435a520c792544b57e8f1612d97933e44d832fecec57b4254ff4e3fdfbefb190925451be06fb753026bacd36a1b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633617332, "uuid": "2522f48c-27e6-428b-a821-dc6d8f89a5bf", "value": "T10DD57B1577F84E2BE06ED7B2E5B0101657F1F85AF3A3EB4B6181A6391C53B405C822BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633617332, "uuid": "fb266e4a-6914-4558-8b12-2be87c8c4982", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633617332, "uuid": "9f7e63bc-9945-4f83-9c6f-777fa9b81a57", "value": "49152:90CxOidcA4LQnmA+cfjm+OIJC54GhyTVXKU25Sza32ehyfTYm:90EOidcA4LWZ+cfjm+OIJC54GhyTv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633617332, "uuid": "541fc6d1-e2c3-4ce0-af96-a6174baeae8c", "value": 2898944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633617332, "uuid": "075b54c6-21e4-473a-828a-a531d1d56d82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633617332, "uuid": "7a9ea561-88d9-4e41-8c54-062a985e0e5f", "value": "Passwords.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe3a37e-2724-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633579899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579899, "uuid": "78930a9f-94a6-4b58-97b6-c3286c0050cf", "comment": "Malware payload (Gafgyt)", "value": "c8e5f5e0773015281567790b1b495706", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579899, "uuid": "48fc7c87-4bb7-46b1-a51a-8551d8cce0a7", "comment": "Malware payload (Gafgyt)", "value": "9a530ecf82e9062c3b03bea10eec59599c9b96d6528821fe7f2b0a4c87696daa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579899, "uuid": "ca922716-f7a5-4155-9195-c2c17a8d91f2", "comment": "Malware payload (Gafgyt)", "value": "5723c3904f52d3dee9fbcb02b4d366ff1e521a0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579899, "uuid": "e4175d15-802f-49f2-8abf-5f389de2248a", "comment": "Malware payload (Gafgyt)", "value": "d9eed6da1b2a7f936de75c38e0b6ba51c04e2a74c9e7bc969ed9f3ca4a0adf698ce15312e182d6abca89fcd34eb1a46e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633579899, "uuid": "3dad2c9e-06e9-45c0-ab00-35a0e9a55ff2", "value": "T15B733A02E742CAB3C8830BB606979B6A4631FC6A5E2B8F59F31D7DF4AB124C87117355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633579899, "uuid": "525426e8-684f-47db-8835-395e2cdbabe1", "value": "1536:Ugj8a3m8qeWicipWl6MwakvA5BucG8ayLmLI2VOCjXUfJRk:D86bKVWWl65Dv0uCmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633579899, "uuid": "15d16884-8ded-4a41-b34b-686981aea0d5", "value": 73448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633579899, "uuid": "77e83f4d-0156-4471-951d-f6a008f284e4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633579899, "uuid": "234d67ec-695b-4fd1-a924-2e6822ba344a", "value": "c8e5f5e0773015281567790b1b495706", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d828a8a-2740-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633591794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591794, "uuid": "18700e24-fb9c-4e49-a832-1e78a0e2b1a2", "comment": "Malware payload (Loki)", "value": "c7839832a713396f2b16a32e316582e4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591794, "uuid": "8da53b0d-30a9-4688-bbd4-5f33bca294d1", "comment": "Malware payload (Loki)", "value": "9ab23ff77926dba329bedf017c321c2d680dcc0e8b2e3f4ad958d18208800867", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591794, "uuid": "333e1e20-f407-43f2-8f70-ba1a6a0e5997", "comment": "Malware payload (Loki)", "value": "197042c2095e34bb5fac3feef40c8e57c90a0956", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591794, "uuid": "4e578145-40bc-4543-af9c-c3817a4dc292", "comment": "Malware payload (Loki)", "value": "308276aa7b64153f0709efe7c1373c29d585125fa8414198d4171c435d453e7c8e628b3735507faa1d008f04f922a5a2", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591794, "uuid": "224eb315-6086-48d2-bfac-d72120816d05", "value": "T139841290FDF68737DD238570AA016212F5F2DCA85728C261F46A3DDBC9B8353D860B5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591794, "uuid": "936c2d8c-23f2-47ac-b4f8-43483bd88788", "value": "6144:78KS+HtbVx8aSUhqTtaFJk5YuJiUFxIYHdgiyO4/BBj06KN5TPHLjviVs6Q9:tBHtbnZg5Yh85dXKBBLadviGv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591794, "uuid": "db598935-4838-4fad-a0eb-069ca08fb45e", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591794, "uuid": "cae998f3-ee3f-4b9e-bec0-8819e9171010", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591794, "uuid": "3a500cae-3812-4464-a0eb-cd049a2b0eac", "value": "lod2.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2c873b-274b-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633596466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596466, "uuid": "fbe538ef-d8c0-4605-b928-75fefb4075f4", "comment": "Malware payload (Loki)", "value": "82af8f593f29f946095923c4c4b43130", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596466, "uuid": "5ac2883d-4bf8-4046-8ed0-d9bdbe7b1a2f", "comment": "Malware payload (Loki)", "value": "9bc104c639ac638fcb86080c375b1a376ff1804473d5010779d416ae905fac29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596466, "uuid": "58392fcb-d934-4b0f-a04c-354baca79587", "comment": "Malware payload (Loki)", "value": "4a81bf2340215093f0b5540281449abcf9fbf39f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596466, "uuid": "29f2e72b-a5f0-4ae6-ad82-d2dd4f9f8894", "comment": "Malware payload (Loki)", "value": "c8107f469906d26f2322db2fa4c301ee5f05e71e98bfeee59dd4daa4d23dab6cadafefc4c0cc5ae51434bf2e4ffe4333", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596466, "uuid": "c190cb22-1583-4933-b552-4b48f60d8110", "value": "T124B3021433D4A162EC6CC176514393C41939D60A4DCFEE2FE8C9C8DEBA5B687C782975", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596466, "uuid": "e53d84a1-a6ad-4795-bd02-4ae8b19e2a0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596466, "uuid": "0f48b172-913d-44d4-a0a9-a9b65f6b4c19", "value": "3072:tQRTAgu39b530cfopEaig94nd44I7pvm:mksEaIn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633596466, "uuid": "8cff9899-c678-492b-9238-6aef684166f3", "value": 110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633596466, "uuid": "5f68ba54-21c6-48ca-9572-80b4e070f457", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596466, "uuid": "5920cd17-b2c8-4756-af99-d1cf55b2455f", "value": "82af8f593f29f946095923c4c4b43130.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a374d754-2740-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633591911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591911, "uuid": "108af652-7641-4468-92e5-10b974673b6e", "comment": "Malware payload (Formbook)", "value": "3e2c93ae3e92f6ec07f921fca79b5f7f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591911, "uuid": "fbe414c9-f274-428b-ade6-4df1ea6cb9cb", "comment": "Malware payload (Formbook)", "value": "9c794c341dfa219c0bd37e8df6cfe9400eebd9f293eee5ef97617ec2973752ff", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591911, "uuid": "9b0e6f17-9d79-43f6-a11f-55042dc98843", "comment": "Malware payload (Formbook)", "value": "8f1096989185e3e95518de3c4837b2e2b9491f6f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591911, "uuid": "7dc13fc9-f626-4b70-ac12-be4d807010e5", "comment": "Malware payload (Formbook)", "value": "9d64f65cf6babfb44bdd24ea865203dc5e7af8a5407cf5bbb4efdc6792e8a7e3a7c3cbdc2681df926bf036051487c5d5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591911, "uuid": "d1668216-e69f-4aef-b170-392ce7d9ea4b", "value": "T16D8423063B2DD7ABC27348BE51A8AEBCA281FE664761460960DFB79B93F77442C04135", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591911, "uuid": "a6486c6b-81db-454f-8d6d-e71c82385ad1", "value": "6144:47veiBf5eYn5VR1arFWAAoBreTgmeouNk74zJefjmptSAoeTyaH2URggjx5IWh:7i7ee0rMho+MZwKpwAoeTya9jxWWh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591911, "uuid": "2565780f-b550-44f1-9379-f44438d031cb", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591911, "uuid": "527e16e6-42ab-4b7f-9630-b75c050fb5a6", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591911, "uuid": "1ac67a50-f6c1-44cc-8118-933294123d29", "value": "po_0074.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d91128-274b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633596695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596695, "uuid": "16b3e6f5-3b69-4e6a-aed0-84c44a864be5", "comment": "Malware payload (AgentTesla)", "value": "e5ac559e4de8c3183205ced1ed184d55", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596695, "uuid": "7ef75f3a-32a1-415c-9e2d-cbf702cc9855", "comment": "Malware payload (AgentTesla)", "value": "9d640e68c41537494c927d0828cde421d3e55ea21b5a2d449e646d931c7614eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596695, "uuid": "15f31c8d-069c-40a3-82cd-b590a1da2f80", "comment": "Malware payload (AgentTesla)", "value": "6432db62ef33b12525cd8270408a8479c7427997", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596695, "uuid": "287a3bc2-76b9-42ec-888f-4a64d50a6b3d", "comment": "Malware payload (AgentTesla)", "value": "fd049ad71073ca818177599dd007caae6e013a56401071e5a8edf7105830b0a7abebb4410feb3ad9b087a4cb9ce2b71c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596695, "uuid": "0288e272-2496-4798-b6ea-1af87e192b94", "value": "T14AA4F13E7267C904DE3142B6DD5EE09107B8A812315BCB393E9E72AE3812BF54DD45CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596695, "uuid": "5d7d1ed0-ce80-41a4-9d37-d9fb291911b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596695, "uuid": "9cebe356-3e8a-4e59-a25d-996d4397ad3c", "value": "6144:tNsIpcQ+3HwO7Ne1/YDkc7+A1Eqxl+HUXRxrv52W7iAt0hoJ15+qhNjSGVHOurAX:Dto7Ne1/kkINEqx/X1Oe15+qhNjSMT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633596695, "uuid": "95c920b8-17c8-4217-8508-c476d2d687e0", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633596695, "uuid": "40647946-2810-4f04-9871-861b66b416bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596695, "uuid": "01f3b32d-07d9-4c56-86f5-a5af1ed6cc1e", "value": "CI+PL+AD+OWNERSHIP TRANSFER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ae31e7-27ae-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633639270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633639270, "uuid": "f0924fe7-d27c-4499-8d51-7e10cbd1d36c", "comment": "Malware payload (RedLineStealer)", "value": "ab985c6f7c1a9f9159db544cdaa0278c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633639270, "uuid": "d2b783ec-c8c2-4437-a5fc-16cb86a50fef", "comment": "Malware payload (RedLineStealer)", "value": "9e3dffa7e605e588d50dc9a3cb7b72edacd73c4d85c0ab63a20929098d5ffbc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633639270, "uuid": "d227db2d-297a-4905-8270-fd223afdee3d", "comment": "Malware payload (RedLineStealer)", "value": "642373143ea199591b8849d23834b62992668584", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633639270, "uuid": "1bde9897-4b87-4d71-9686-0d093dbc3a88", "comment": "Malware payload (RedLineStealer)", "value": "1348c546ad14e34b3f402bd23849d68c4bbaa5b4220b4fe2c9481858cd500b0890578a6742352a1cff0681642be99c7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633639270, "uuid": "8323c573-04f4-4df5-acab-4b3c0f085e94", "value": "T1868459395118A72BF63AD3B85158035AE3F49AE3B0C9DA27FCC360C6857276526C472F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633639270, "uuid": "d30c51d1-733d-4552-b1b7-964042c82440", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633639270, "uuid": "3f071d2e-c392-4be5-8a13-25bfb482a702", "value": "6144:pHUCw6pgqhXhmrX6WM8EDDneSgr33RnI/dhAaZre8R4XcB70DLNcBcYTpDRC:3w6pgqhXhmrX6WM8qaRqnReuINcBcYTz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633639270, "uuid": "63336702-5611-467b-9403-1300ee1a9412", "value": 392192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633639270, "uuid": "47f2335f-c631-4f18-8014-683f53891e96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633639270, "uuid": "dd5da1ea-ce2d-4630-8c5f-253272760d39", "value": "9E3DFFA7E605E588D50DC9A3CB7B72EDACD73C4D85C0A.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53dce3f-2725-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633580452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580452, "uuid": "b8b32f0c-8d06-4ecd-a09b-757f2ce615c0", "comment": "Malware payload (Gafgyt)", "value": "b245d8869bf53275e8dbbe90495d6514", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580452, "uuid": "82e1714e-6a83-4942-a86c-3ae42b848cd7", "comment": "Malware payload (Gafgyt)", "value": "9e7e2a3b2351722f3270ad15b859072c8688aa1f439779bbd0a732cc988267c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580452, "uuid": "a22de7c3-960f-4e25-8b60-11aada178edf", "comment": "Malware payload (Gafgyt)", "value": "d92bb450ca30e9f1c4e8744e9c225bd7ccaa9f51", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580452, "uuid": "1686011b-e10c-4bb0-85a9-734ecc0c691d", "comment": "Malware payload (Gafgyt)", "value": "c63ab88882b067eee8d21e97f76e489dc29b7f13ce12d47e8726dc88aacebf4db3cf5b94c4b914370c27284b3fb8d19b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580452, "uuid": "fd7e6bba-4185-4755-8778-64cb0ada29f3", "value": "T1A2D3B66A3E11AFFEE268863007F75F70939525A32AA19741F26CDB085F7128D1C5F7A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580452, "uuid": "a3a61274-c387-4b87-bc0d-219c886f716e", "value": "3072:RfKkoxmgkFiPDxxmYA+bRyO76oQV/GCZ2QqWzikC7MK+emuH5hGR6r3FdU+F3xeD:QQO4KDXH5hGR67U+F3xemqY1fuBmvm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633580452, "uuid": "11742fe8-0f70-4d12-a614-a555ccbbff84", "value": 137917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633580452, "uuid": "9cdb274d-5733-44f7-a3a2-7ba1b3b20cba", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580452, "uuid": "6f77cfb9-714a-42b4-91f3-02dcc535f867", "value": "b245d8869bf53275e8dbbe90495d6514", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c11bb656-2779-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633616442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616442, "uuid": "0e337a1f-09dd-4d03-96b1-37d2edd87868", "comment": "Malware payload (RaccoonStealer)", "value": "cf19ddf02826d902bfc287338d77ad5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616442, "uuid": "8ffaffc1-a2ea-40d3-905f-d60b18eb56db", "comment": "Malware payload (RaccoonStealer)", "value": "9e8023fed30083e6c58d07a72e4282ba98403d000df83ec9430bc4c5bb6db595", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616442, "uuid": "d16e72b3-dd32-48f9-a6dd-46e3797842e6", "comment": "Malware payload (RaccoonStealer)", "value": "56336a38403efd8b1f9ce3715fc4d44df6abaa49", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616442, "uuid": "3c075957-a752-4b63-a7e0-e573564fb09a", "comment": "Malware payload (RaccoonStealer)", "value": "69464b90126d25dccd93a5d198ebbf3d2138a74c791d468d1e6a335355496945cfba1525fb7d77ade0cf014aeb096601", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616442, "uuid": "9db116a0-fd51-44d3-8841-b37e734d2583", "value": "T1CAB4F110FBE0C035F1B752B9497A93B9A52C79B06B35D0CF12D526EA1A346E4EC3136B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616442, "uuid": "108711b3-2320-466a-8e95-6d032b802bd1", "value": "c1d211268d6c769cc59ffca0e56e63c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616442, "uuid": "d3c02c77-3a97-49cf-9185-f9cbc62cc5f9", "value": "12288:I1zpMxmzLzpWjUyj8fWJqDtfXnoDTUjMtFlqzfIIt5JE:I1/LzxyjnqZfXosAtEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633616442, "uuid": "fac36096-2704-45b7-901d-56afd26eff02", "value": 495104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633616442, "uuid": "05941fa2-1dc1-4013-9b0a-5259e79cd4aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616442, "uuid": "ad0edaec-42ef-4394-aa1f-36022e19bf4c", "value": "cf19ddf02826d902bfc287338d77ad5f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d8a9e6d-274e-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633597699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597699, "uuid": "059e690b-ef47-47be-8551-cc440b2b9d97", "comment": "Malware payload (GuLoader)", "value": "d53b5fa49804ec991df980cb9797676f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597699, "uuid": "6732f0b3-b85c-404b-8008-0ba12b1d59ed", "comment": "Malware payload (GuLoader)", "value": "9f3ad0d8c4550adde82264b58d458a065870e1171cfc31856605ea3f4c7ddf4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597699, "uuid": "5af3c76c-1abb-4d05-8a85-e0ad95a21bd4", "comment": "Malware payload (GuLoader)", "value": "c4915d492b34ab68e62062666de4b6dec1613a8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597699, "uuid": "4ac64ec6-e0aa-4d5d-a4f1-8b7bd2fb6bf8", "comment": "Malware payload (GuLoader)", "value": "c0c3f3bf332ff258d999908232bcb49bd1ffd7c6a65af57b8a4c451aa91f757d1ff3cfcdfb96ae8f2c111507b0141f95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597699, "uuid": "534cb2d4-3d07-47e4-abca-4a538c1db04b", "value": "T145C3491ABCC0FE73D288D4316C2D8EAD66579C624F006E63319CB62F68F654D2C3A795", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597699, "uuid": "62c8edcd-6374-4773-8ccb-990a4e8dfeb8", "value": "cd6cada764d740d8782222f9ccbeed47", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597699, "uuid": "ba017879-4495-458c-9543-d58cbd73e852", "value": "1536:PJnYAZYVHclJ5yIevgonlxeA572cgkzNST4Q/ypDvo4xSKD3:P1RxJ5yIQnyA572WzNSv/+7rsKL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597699, "uuid": "5aa14343-8d24-4006-b2e0-81f51ca4a344", "value": 118784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597699, "uuid": "adbd6cad-9e1c-407d-bd09-a893cae3ab2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597699, "uuid": "295efe07-771c-46f8-8ff8-418ac124b6e2", "value": "d53b5fa49804ec991df980cb9797676f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e799c7db-274e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633598038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598038, "uuid": "117f969e-19f4-4d91-b295-72b6fe23daf8", "comment": "Malware payload (Formbook)", "value": "ea7b66c47877294f9390eb621963295b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598038, "uuid": "db5011ee-bd8d-4e8d-82b5-0e403f166679", "comment": "Malware payload (Formbook)", "value": "9fd253b8d45e4204580e7277bb43bdf115b796a722ecc7afc20cad8c75dc3d60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598038, "uuid": "b90e97e0-d5db-446c-b362-3383490a4a47", "comment": "Malware payload (Formbook)", "value": "c74112369935b1b254fed401d450c3532889fc94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598038, "uuid": "9389e757-942f-4481-aefb-02f00d244a13", "comment": "Malware payload (Formbook)", "value": "62efd8dc6331ebe978d105bac118b9c3cf5f4319d4ff7cce2c883236b954d25bdfbae4a1c1008bdb3038dc04bf0f64a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598038, "uuid": "f4784482-2563-4cc5-87b5-6b7881105285", "value": "T1EC94F198A36B8B0DDC3983F62400A5521FF6546B256AD7385EC5A0FE3862FB41FD0D93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598038, "uuid": "34d7fe52-24a2-43b6-b2b5-9abec915f046", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598038, "uuid": "3a620024-327d-45b6-855e-456cf2e6c5d5", "value": "6144:kkf0kQ+3HwOlfK1F3EeGhtt/j1njGSNRiMvzZMSCmDk5wCZQ/7mIsVjikK6cNOI:ColsF01t/hjGIerbZQ/qIs67", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598038, "uuid": "09775661-011d-45ce-bc6c-281818c54e25", "value": 413696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598038, "uuid": "80e8a50a-4f4c-4813-90d0-9c2b9b4d5765", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598038, "uuid": "62f0f786-460c-4128-90d3-f9e0463341b2", "value": "ea7b66c47877294f9390eb621963295b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e03dd3-274e-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633598027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598027, "uuid": "5e58bd14-b148-440f-bb5b-ef95b1518cb9", "comment": "Malware payload (Loki)", "value": "9ab5e8528c6928c400ec8f72d8f5bbd6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598027, "uuid": "cfcfe848-f28e-4dcf-b42c-943a3f42970d", "comment": "Malware payload (Loki)", "value": "9fd3ea298e67c87b5da5cf7806e597556d3a113c5b64f1a98041f2a8b303e81a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598027, "uuid": "1f827465-898e-4c6f-bcbc-f9928f0559e9", "comment": "Malware payload (Loki)", "value": "7c1426b4a2a76e1e12a7dd2a2a5b6d417170af6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598027, "uuid": "4b8631a3-6644-4da2-ac5b-f0c26e4b1962", "comment": "Malware payload (Loki)", "value": "259a7e2f4323b87034c82e81f9131d1eefc12df11c9e31a9b3931b55f1cc43401a46bfef30efa4756481aaf113e3b1f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598027, "uuid": "d1f0096a-b8a5-49dc-bed0-7f970fec93bd", "value": "T16264231412D1DDD3D2A26638CEB2E756F31AD78C519ADE075370ADBE3A224EEC503386", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598027, "uuid": "7cf59a4b-a1cc-4f93-af5b-80a6ecd16d29", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598027, "uuid": "785794ad-9393-46ab-8609-d1447e3fe610", "value": "6144:F8LxBs1yt4/pHm0DJDaV8Zt0EPDEU1g8inO49wVJRGxmDFNvbpeS:/1yt4xH3VIsgQiO/s8Pb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598027, "uuid": "4b2a9994-351b-4cbc-aac9-09aaf966f948", "value": 311752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598027, "uuid": "7c1267fd-3a9a-4c47-bc92-b2a64bc66c68", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598027, "uuid": "bc038694-2acd-4e8d-96b6-e39e98205d7a", "value": "9ab5e8528c6928c400ec8f72d8f5bbd6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f987fc-27a7-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633636209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636209, "uuid": "d2ab1d4b-cdf2-4eb4-a0c5-2da116da139e", "comment": "Malware payload (ArkeiStealer)", "value": "c3479b32e1960dbdc34819a32039bd81", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636209, "uuid": "63352635-364a-4736-a0f5-55b3d4a77646", "comment": "Malware payload (ArkeiStealer)", "value": "a0ea94a132d9396551ab1d3ce1316de57332e9861c9ca0f1c5acee38b5d6ba8a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636209, "uuid": "e51d5912-6fbf-4ef9-8c2a-a939159fcb15", "comment": "Malware payload (ArkeiStealer)", "value": "71ab31a791a3027e32315daf551e9ce6d68157ad", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636209, "uuid": "f09f47de-2c70-480f-9bae-44cfe120dde9", "comment": "Malware payload (ArkeiStealer)", "value": "05927ddf897f2494679c5519ecd014139955fc663150813f19426bec5289fc4e3b61725a2614c96d93767e1d79b3d79a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636209, "uuid": "954047e0-da64-4adc-b530-44ea0385d62a", "value": "T12FF4F10067A1C039F4B252F449BAC3A5B93F7DA1AB7481CB33C126EA2A356D4EC71757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636209, "uuid": "8f57ccc8-2d55-4ba4-a0f9-7948cce9cd78", "value": "0d61443d5aeb8f94dcb0465acbd1f25d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636209, "uuid": "82bf5295-88b8-4443-8a7a-1c4636b84b82", "value": "12288:AkjfXKwtqjFbgMmZXfrXuUSepYG/WxXEyqyj6Tw6sqQ:vfBysxXq0YwWxXEy76M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633636209, "uuid": "9c2e94b9-6a80-4cc5-bf97-8dec7caf5972", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633636209, "uuid": "f3b443c9-768a-49e0-8f0d-498a9a52f8e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636209, "uuid": "66cb73b8-dc1e-4d84-b237-69cb78310305", "value": "c3479b32e1960dbdc34819a32039bd81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d673b12-273e-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1633590935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590935, "uuid": "ec2efa71-23d8-4f0a-95f2-3de0ee22b1a0", "comment": "Malware payload (CoinMiner)", "value": "5bca3c8ad06d5375ed5a1f8e5e6a77d2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590935, "uuid": "cb07f8c7-f7cc-41b8-b53c-78b2dea5e927", "comment": "Malware payload (CoinMiner)", "value": "a1891a1f7227c10aa8e6d51667baacdecfe9e070e5f1c212f02ba20610267b21", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590935, "uuid": "8c0eec3e-d561-41ff-89d1-95473b4b1c8d", "comment": "Malware payload (CoinMiner)", "value": "0c0beed83527d6a1e90ed92b4ecc1b50a3c6fdd9", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590935, "uuid": "31ff67a4-894a-4ac5-98b0-a7403f852317", "comment": "Malware payload (CoinMiner)", "value": "cebcd6121166c1b76f9c83d57206eab5e4c1773c6e32030c9fdcc27f58a1a72f93a325627deaec36e9a2fe50a0fd97ba", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590935, "uuid": "b07adfc0-ccca-48fb-9411-c862cdbd3b76", "value": "T1F0348E10A7E0C035F0B716F9497593B9A92EBDB15B34A0CF62D42AEA5A347E4EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590935, "uuid": "240226a5-6f09-4dd8-b2e6-fad4a22bdc2c", "value": "654aff1ee1bc89531bd3b96ebe76ae67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590935, "uuid": "5138c36c-6b98-43e3-8d78-7f4e0de2bf3e", "value": "3072:8QJsxc9YpQ3EBVXKQdo4dAfitw0/gOUybQkrxLTdgjIGuqwYmBwLi5:8QJsWWBln6RfitHTmIFqwYmBw0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633590935, "uuid": "9e7651cb-8f55-4756-8cf2-0aa781620b37", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633590935, "uuid": "f828d7be-8fdf-4e58-a41a-e93a8134fa13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590935, "uuid": "82640139-42dd-4ec3-a8db-ac64f61ef06b", "value": "5bca3c8ad06d5375ed5a1f8e5e6a77d2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e4d438-272a-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1633582579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633582579, "uuid": "21d572f0-d784-45c7-8b0c-f8ecaa7e060d", "comment": "Malware payload (AveMariaRAT)", "value": "393057b6f48539e0e740349a43b13a6a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633582579, "uuid": "309449dd-053c-4aa1-9907-78ca0733bcf3", "comment": "Malware payload (AveMariaRAT)", "value": "a219440a18c85fe668a060a26192f359b7b881bae02e6871baadd89b7019da9c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633582579, "uuid": "4e340b12-4b81-4498-a8d9-95e7272fb277", "comment": "Malware payload (AveMariaRAT)", "value": "96824dcbce0bcd6ae3298b1eeb425381f93267a7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633582579, "uuid": "12110573-0a95-4948-8fcc-f9b5fbf3941c", "comment": "Malware payload (AveMariaRAT)", "value": "af6f6f5f3e6761957eda56f5ecb28eb696812b17f638ef8ac698f43a513c330ef96f084f920f3ae8aee39ac298828929", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633582579, "uuid": "1cc68b31-1586-4b13-a1ad-8032ccce45bd", "value": "T14674D07E3263C904CE7042B6ED8DD26517B8EC12316ACB393AAE616D78127F50CD46CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633582579, "uuid": "3aa49d24-d1ff-4080-b447-6b7e58f773ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633582579, "uuid": "3c874f06-9353-4d3b-9498-d302f9e1fc13", "value": "6144:mjvkAAYUyyyy7y3dQ+3HwOOu2uXVFSHD1Xp8yAi23rwz/+RpflkBg96adzGl5he:mhWoOuXep8Df3sD4bb6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633582579, "uuid": "17262ba4-f955-4a77-a4f1-6d736c40c16d", "value": 357888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633582579, "uuid": "07171ac1-7395-49f4-ab34-255e0244f81e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633582579, "uuid": "176d9c34-392c-4545-86da-902abf040853", "value": "Scan-2021-10-06-89388399008827829020287278299276678292026368298.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a3e65b-278a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633623535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623535, "uuid": "46cb3619-5ee9-4a2c-8b28-2a872ae4bae6", "comment": "Malware payload (Mirai)", "value": "9e21c84bd4fc1457b1d509531b9e7722", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623535, "uuid": "83efbf5f-ca1d-4902-9eed-968bb7482a26", "comment": "Malware payload (Mirai)", "value": "a2b9c520f6fa6b8a16344770126e14b08fe986d068fce9c85cad3316d3d32638", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623535, "uuid": "bf48aa36-dacb-4547-96ce-59b206da1e60", "comment": "Malware payload (Mirai)", "value": "24af465b1ca7e9627ddbfe5da8d63f411c934ca2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623535, "uuid": "72eb20da-06fe-4f0a-8890-f5015f948e69", "comment": "Malware payload (Mirai)", "value": "797f0a5ea5d87d5c419403958f1afd273fa278b03212add050dd284068e2982e5c4a60296791d341933b716907f1ad13", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623535, "uuid": "4e593e62-c07c-4da9-a7b1-e12b9f9fb900", "value": "T10593E746BC918A16C5D813FAF92E108D332267F8E2DEB212DD105F3477CA92F0D67A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623535, "uuid": "93dae0f7-79e4-46b8-828d-083cc8ae2c5d", "value": "1536:HtnSIUht7zwWtdzUvr9CtbcV4naAJq0REmWVvNt9jtXXtu3YcP3I5iDtFbuYQd4q:II8fwWrzGrEtoV4nvJqTj9pXXETtFbuD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633623535, "uuid": "5a21c19d-3bb1-4844-86e3-ddb336ee1780", "value": 95536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633623535, "uuid": "07ec96b1-e1e1-4d6b-b19e-ac8614ae4935", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623535, "uuid": "63a97f6f-d4ce-4dac-ac0c-eec9bffa4e50", "value": "arm6-20211007-1618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7437d424-2797-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633629198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633629198, "uuid": "05ed0182-93dc-4ba9-a243-bdceb5b471ee", "comment": "Malware payload (Quakbot)", "value": "bdc8c033b244b1b66c9103d0e0dd1f78", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633629198, "uuid": "2ccce87f-424f-461e-96bd-79e8ac1a0ae6", "comment": "Malware payload (Quakbot)", "value": "a2dfb729e78735c2de10503e1ead8039ec0e0538482fde7eb3fb81e6ef5fefd2", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633629198, "uuid": "6772fb35-02ad-4840-849d-cbf6dd45693a", "comment": "Malware payload (Quakbot)", "value": "82d88e42c59bc2e8c790327d94b2dff33553a616", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633629198, "uuid": "b0e7f7d5-74c8-4d3b-850a-a623d423e074", "comment": "Malware payload (Quakbot)", "value": "9d3fc7bb1092bdad6de146d0366393af2f8cbb984797742c0c036b266543c7c031442df9ef2359b0614c2f6064aaa322", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633629198, "uuid": "78f571d3-d0a0-41b7-a2d9-37b1019e4e10", "value": "T172D39C463797CA5BE58803398ED3C79B3B72FC21DE72470336463B0E5E7A6A18C16652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633629198, "uuid": "c4e71d68-98b6-4e5e-8551-4e2f20fd59e5", "value": "3072:jk3hOdsylKlgxopeiBNhZFGzE+cL2kdAFc6YehWfG0tUHKGDbpmsiit42ti+RLCY:jk3hOdsylKlgxopeiBNhZF+E+W2kdAF3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633629198, "uuid": "d0fcc5e0-a0c4-4509-b55d-87d92066daf7", "value": 137216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633629198, "uuid": "f9a5b196-f24f-4e37-820e-30b5fb629502", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633629198, "uuid": "27096a28-b331-437b-833a-e9a80524af3a", "value": "AMLRPT_948025740.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df968a0-2777-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1633615444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633615444, "uuid": "b1fb6ad9-4961-4ac2-9676-5ce0787da137", "comment": "Malware payload (Gozi)", "value": "0cc6d274cd84b593210168f51fcd38cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633615444, "uuid": "e2a3638b-ed68-4c15-8a62-0c4743d8236b", "comment": "Malware payload (Gozi)", "value": "a3bdb9880bf419f2023e4015545c6c72835dbc5c68cd14fd81d35220bf9449fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633615444, "uuid": "2196b21e-4103-4e1c-ad28-391fc50f5af4", "comment": "Malware payload (Gozi)", "value": "666fc3963609f4aff528b9a32f7516feebaa6ddf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633615444, "uuid": "183188e1-8354-4ecf-bd2b-8517848a6b78", "comment": "Malware payload (Gozi)", "value": "3171e6e7e657b9f34aa4f4b411c60694ea4c518ce66f00bf12986ab85a337b25dd95786c69a619a9dbb8ff34bf45873a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633615444, "uuid": "dd6b68a8-3ca4-491a-97fe-c862faa5cd7c", "value": "T1E0048D1171D2C432D5AB5A7548F5C6B8163BFCB65B3505CB6B842B2E8EF32E18A35B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633615444, "uuid": "694d9d85-5e6a-4235-8c79-baa0fb450774", "value": "08b3bdf9cc3930ac93565a943e8ad0e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633615444, "uuid": "ba82e264-c879-4e17-a94c-497e0a0e11c1", "value": "3072:fgUV+UgG7cL89xoF+bhyExjSaftm34X/ifmA0XHDI5C4:YG+Y7cL89x/bUExPf437ul8I4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633615444, "uuid": "f21089d0-8085-4ced-8ef0-bae13de11425", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633615444, "uuid": "72ca49c2-7e52-4238-b270-f65e61daa7f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633615444, "uuid": "8120a502-6840-4fc5-98c6-f898e65dada2", "value": "a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b50231-27a7-11ec-843c-42010a9c0014", "comment": "Malware payload (MirrorBlast)", "timestamp": 1633636093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636093, "uuid": "7162e4a5-f4d0-4f4e-9632-4144171db735", "comment": "Malware payload (MirrorBlast)", "value": "361d382c2ce70390224f9c7415d82a69", "object_relation": "md5", "Tag": [ { "name": "MirrorBlast", "colour": "#08A768", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636093, "uuid": "bfc50370-21d2-42bb-b368-764a9f0c6893", "comment": "Malware payload (MirrorBlast)", "value": "a403eae5b12b909f4075e855f58d1742308d5e0d3450e79b60162fa9fb7caad7", "object_relation": "sha256", "Tag": [ { "name": "MirrorBlast", "colour": "#08A768", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636093, "uuid": "44fa6a4a-0cc1-449a-8db3-d5ac91d9484e", "comment": "Malware payload (MirrorBlast)", "value": "09850fe30b5cf7881706bb837dc76096ceeffa6c", "object_relation": "sha1", "Tag": [ { "name": "MirrorBlast", "colour": "#08A768", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636093, "uuid": "86f97890-cf45-4223-9837-73c02ea86526", "comment": "Malware payload (MirrorBlast)", "value": "3d0d4f678ec240c485d1dfec5492dabdd07e40eceeb17ab0423fb67a26eb08ce2ea41d618ee85acf948ddd9cf4c724b2", "object_relation": "sha3-384", "Tag": [ { "name": "MirrorBlast", "colour": "#08A768", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636093, "uuid": "bb041d75-fd1c-474c-aa33-cd17e68ba0fd", "value": "T1F304024BB2B5E232C642477A091FD3B19F75AD1C8A8B11362AE3F74D16329947233AD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636093, "uuid": "9dcd4f0e-4194-464b-90ec-f6e60087c80a", "value": "3072:UVSVCptqjWJ+aSNlPgflxH04HvGwb46iwtvZ3vdeF8ORTVXPdrjBS5Nxa9DPGe:decjTaSNyzU4u8H1vs8cpXFJGNxadL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633636093, "uuid": "2a59ac81-9ce9-4631-bde7-3bc015d2b3a7", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633636093, "uuid": "23ed8d35-9d60-45b7-9171-50ce6f82858f", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636093, "uuid": "0b90c056-3960-4205-a977-9a88213c5856", "value": "361d382c2ce70390224f9c7415d82a69.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c660f9-2786-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633622082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622082, "uuid": "d5e6423f-92f4-49eb-a9e9-f0e522ede467", "comment": "Malware payload (Formbook)", "value": "8cad21a8377f81f6647fac069ff6222d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622082, "uuid": "d6882962-8559-4127-a15f-ad9e2e0a70a5", "comment": "Malware payload (Formbook)", "value": "a4bf92333fa0839d92c30859f87f08f91f988c35dd30227c2b4fe60e7188a4a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622082, "uuid": "8acfca32-4a63-4d42-8844-cc4bad5a2d0d", "comment": "Malware payload (Formbook)", "value": "c06845f662d64492d4c4df1a6c506d20bebda40d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622082, "uuid": "f3ff0aab-2dcd-41d1-af67-263caf336ae9", "comment": "Malware payload (Formbook)", "value": "1abd122c4b582ad1fe087b3e4c05bba5e88ad25cae56f6337efc5e54240721163af463f96b9f96b6534cb6ab5df002b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622082, "uuid": "1fa589c0-b063-41f1-9371-73a4193e2dd0", "value": "T1FA157D22F3D10E3AC23F39386C2B61E825276E617D4C24EA36FE2D487A785507639757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622082, "uuid": "1d08bc41-9832-41f7-affe-c2e784da37f9", "value": "a75c37244e3bdfe1f2052f7c93d03b4e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622082, "uuid": "35d4bbb6-2f18-480e-a589-ef7f24511f22", "value": "24576:nWv+QwSKgQ0qgQDKqOTLDE4bZJlzNgojDGBav:WmWKgNxLQ4DRNRG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633622082, "uuid": "b3f27f06-4df1-47eb-a942-75a02cd80296", "value": 961024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633622082, "uuid": "e532f35c-7813-45b9-8a4b-7d77abf36ec5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622082, "uuid": "4a09402f-03c2-465a-9b57-8f41559e0bc8", "value": "Untitled attachment 00075.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f404477-273c-11ec-843c-42010a9c0014", "comment": "Malware payload (OskiStealer)", "timestamp": 1633590052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590052, "uuid": "289c87e7-1f01-42cc-a9b8-d7783253b55f", "comment": "Malware payload (OskiStealer)", "value": "ec76b636ac2d1e2208015f6397a168ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590052, "uuid": "436f6c4e-0c3c-4873-9403-fbae3dd671f3", "comment": "Malware payload (OskiStealer)", "value": "a54ecc8d83199ee37e9af81592b4b3dbc037aaa14eba989f6dc0504a570bcc9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590052, "uuid": "14948457-467f-444e-9b59-e6e9a2da43c0", "comment": "Malware payload (OskiStealer)", "value": "766b1b420ef93bdec52fc62bef319eba62838a12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590052, "uuid": "8e412b5c-bb41-4a68-852b-6e9935d0d988", "comment": "Malware payload (OskiStealer)", "value": "11782f08c399e09b146e6b6015d1e7e2ac5295dd470c1e1328068a9395a8ffd9cbf38b767a727aee7a88ffeff9f07ebd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590052, "uuid": "a46a0f37-0659-4cbe-b99b-8550885eb6c5", "value": "T1AA74F162F2808DEBE6661671087ADF3135AFBD5D90B4150E929ABD2907731E3107EE0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590052, "uuid": "e7c6041c-8617-40ac-b59d-a388ac9d9610", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590052, "uuid": "ebeeb296-232e-408c-86dc-bd417d80d414", "value": "6144:n8LxBoEGD0G1JVp7LJ2XHLUYIvnQW3Bs+m0JWqw020KSQnrlNkGfvKCmS7HhoGl:5hpp712IYKP3m+m0Qqw0EvlWGXzJLh5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633590052, "uuid": "cb6e51f2-abe6-4e45-8b4e-5f8e39817487", "value": 364431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633590052, "uuid": "f2845cfa-d7a2-4e81-a3eb-7ac730f46342", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590052, "uuid": "618265ba-56f0-4826-9f01-7b454b7c5e10", "value": "Leyton 277190638.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300d4c90-277f-11ec-843c-42010a9c0014", "comment": "Malware payload (MirrorBlast)", "timestamp": 1633618776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618776, "uuid": "143894ea-7255-4dad-ac29-167cea81bbc6", "comment": "Malware payload (MirrorBlast)", "value": "065e70c3b1e6841074a25aafa95e20bd", "object_relation": "md5", "Tag": [ { "name": "MirrorBlast", "colour": "#08A768", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "REBOL", "colour": "#9BCF68", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618776, "uuid": "0bfd0a19-0c8a-4f86-8406-12e5c2f0f4a6", "comment": "Malware payload (MirrorBlast)", "value": "a69d27abd043cc676095f71300bf6b2368167536fcd4fe5342cf79a7e94fc2fe", "object_relation": "sha256", "Tag": [ { "name": "MirrorBlast", "colour": "#08A768", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "REBOL", "colour": "#9BCF68", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618776, "uuid": "86e9a7e4-c71e-464f-afe2-c4f2df6610ac", "comment": "Malware payload (MirrorBlast)", "value": "0a230bdb9e7baf228a63deefa489e2263e879eaa", "object_relation": "sha1", "Tag": [ { "name": "MirrorBlast", "colour": "#08A768", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "REBOL", "colour": "#9BCF68", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618776, "uuid": "9fa205b3-7ba3-44a8-b417-48b33ff823b5", "comment": "Malware payload (MirrorBlast)", "value": "f3c05d12ef748ad9801b0a927e5b88ed8c2cc92fdcbf28b703520a6e42bf1142ab4b8cd057f1057695bd855e7100a712", "object_relation": "sha3-384", "Tag": [ { "name": "MirrorBlast", "colour": "#08A768", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "REBOL", "colour": "#9BCF68", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618776, "uuid": "3f3eba7c-7b7c-4850-bcad-9f48dc48f043", "value": "T12FC42347730A2335CE66437286EB87D28B343C416E988A166A53765E9F332C4F6773C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618776, "uuid": "28d02f55-df26-4380-9bda-a680ec878dae", "value": "12288:oC3LUk7ftIXeWc5ie52YOqhPS+KP/w1pZGGgCs5xu8Z:ofaFAeWceYHPS3PIoA4xu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633618776, "uuid": "278ffb10-4aff-45d8-a38d-5804a1a5475a", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633618776, "uuid": "2587b428-e41d-4392-93a0-e1dbd19cb56c", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618776, "uuid": "4b7bbe48-be82-4941-97a0-d98127c71824", "value": "trehjugdr4et6u.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc26531-274e-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633597703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597703, "uuid": "20d8fa4e-245d-4ee6-a74e-9cc8d0117cb6", "comment": "Malware payload (Loki)", "value": "78d40cece2b1c2ab6e5fea04199a624f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597703, "uuid": "5de85f02-acd6-4719-a781-e6c5103d025b", "comment": "Malware payload (Loki)", "value": "a8414251412eeeb6df0c08ac3f2310e9bca5cd673918eed8b230a0c4304d9fd4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597703, "uuid": "ca809303-a01f-4e75-8411-ed7847474eba", "comment": "Malware payload (Loki)", "value": "ec7e5c3dba89d12249b32a522a1b539963155ec9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597703, "uuid": "0b30d151-6214-408d-893c-e1f6ba4454e4", "comment": "Malware payload (Loki)", "value": "ae71a8a8908d15ca9e0051110891574ba6a7faa0e429909d1219fcdc9ae1ea0ffb0db628b913c6c997bd881add29bea8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597703, "uuid": "43cdfdaf-f53d-4b78-a8e5-a02129a825e6", "value": "T19C74CF3D32A3C904DE7153B6DDCDD14107B9A81371AACB396E9EB2AC78227F50D805DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597703, "uuid": "add5368c-424a-4098-85a9-9b238649b657", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597703, "uuid": "b50335fb-16c3-466d-9a73-1fd2e1f5ebd9", "value": "6144:XLN9uFznzIQ+3HwOF65R8f8ACcMSVkd4ddytRHjF+CbAiRJA7JWnczt:7GhzhoF65Ro8ACcMYk8ITx+l7JWns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597703, "uuid": "c3d63e3d-de2d-4faa-8d20-87ed3d214d6c", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597703, "uuid": "38bfe629-29bc-442f-82b8-a55c55241354", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597703, "uuid": "f0ee5022-9a0d-49cb-a46b-b9d0bfc8ad68", "value": "78d40cece2b1c2ab6e5fea04199a624f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f17131d5-2782-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633620389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620389, "uuid": "d7ebe69a-1625-4404-8477-70d61fc0efea", "comment": "Malware payload (RaccoonStealer)", "value": "fa16014afd0dc2479ef82a7ec81cf5ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620389, "uuid": "21e88e66-287e-4509-abc0-5078aca7ce96", "comment": "Malware payload (RaccoonStealer)", "value": "aa91fc9cbcf0c8f03593dc8801dfbc24b35e6ac0317c11c36b93e17fc915a44b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620389, "uuid": "99dc7315-4445-4ce2-ad34-db71e0bc0838", "comment": "Malware payload (RaccoonStealer)", "value": "ba125a506a097b25377b7a9b19d1e5213c1c77f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620389, "uuid": "9e43dbf3-41ad-4138-b220-2b0e04766641", "comment": "Malware payload (RaccoonStealer)", "value": "9c64c1e3c622007ea7e6b2cdc6e6cd79a19183ce68233c6e880fb73f8350377a8cbd92317be749f9dfc008ceeaafd769", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620389, "uuid": "5e7c6667-c18d-4d76-a445-5c7064b348a3", "value": "T1CEB4D000BBB0C039F5B752F4597682ACB83A7DA0A73495CB62C566EA1774BE0EC70747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620389, "uuid": "201bdee1-c304-4c3a-b2ba-cb580174fab2", "value": "c1d211268d6c769cc59ffca0e56e63c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620389, "uuid": "cbe71504-a734-4811-84ba-a3e47ffe1c41", "value": "12288:mzjVtVohGhW52ZhyvwxqauRX2evDqFcuuFFyu6m3SLalJejc:8j9YXQyjl24qFLuFFyAtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633620389, "uuid": "34b3f4b7-80ba-4c0e-a751-ef015683e4e0", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633620389, "uuid": "8a258de1-3a41-44b6-8fa8-b05f4152d116", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620389, "uuid": "836b828c-01f9-4fc0-bfc7-2b06f481e4ad", "value": "fa16014afd0dc2479ef82a7ec81cf5ed.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27c30833-2791-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633626493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626493, "uuid": "f2550343-d535-4a04-aa7a-8426ebbc26af", "comment": "Malware payload (Gafgyt)", "value": "efdfa9235223bbbdbd36977a18222fe5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626493, "uuid": "7c9e80f4-1547-4c4d-95f7-690828b6300a", "comment": "Malware payload (Gafgyt)", "value": "aad81b732d3e7e4e906823ef75a252e9ed941060076b2c4a60a3671ebd65ee78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626493, "uuid": "7d0d9092-8354-4b66-be8a-b8dc2ee363f4", "comment": "Malware payload (Gafgyt)", "value": "aeabf64a7117d4fa8e5f31233372905558619a53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626493, "uuid": "d36edfbf-7070-4fee-93c0-b2dfeb15fcd2", "comment": "Malware payload (Gafgyt)", "value": "0331f579b616ee0d8413a821e07f1f4420651bb3910d0063d7b151e3c313723c6a1c9a3c8b128bbf2a6742b0d367d6c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626493, "uuid": "feb7618d-f034-479c-85be-c1a1a4207f98", "value": "T1A0E32A09EA408B57C1E2277AF7CB424933339B64A7DB33095528ABF43FC279D5E22515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626493, "uuid": "feec7ce9-9f85-436c-9255-688aa5acfd85", "value": "3072:fuNaNpF4uVN++dkhnxMQennF4M/9OD4bNWkE1kmpwfvRQfZn:mNaNpF4+NChnOQennCM/9ekmpwfvafZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633626493, "uuid": "edba6670-beb1-40be-97ef-1ffac71861f6", "value": 150385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633626493, "uuid": "b290a346-e110-4ad6-9ecf-fdda375c9891", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626493, "uuid": "ecbc3cd0-d100-435a-b34a-8db06b216270", "value": "efdfa9235223bbbdbd36977a18222fe5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66abdd79-2740-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633591809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591809, "uuid": "86b7cf73-dc54-4851-a5ef-18b3cb8a786f", "comment": "Malware payload (Loki)", "value": "f2ef67959454731aaa7d29a733f933b1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591809, "uuid": "52a48062-0a79-4bb6-ab42-6a6bd8bae141", "comment": "Malware payload (Loki)", "value": "abc8ee518c109d2c4c0275490990d7f7441dc75deeae02b7d1e682acef07c67a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591809, "uuid": "572d69ee-66bf-468f-885e-f9250cb2b715", "comment": "Malware payload (Loki)", "value": "77715de77b204e64306c3401485ec04a38d2f978", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591809, "uuid": "7c3b76e0-2c84-4ec9-861c-3f098821f534", "comment": "Malware payload (Loki)", "value": "ef5bf3e144e3a82a682ddb2a8ea519ca18f118af832356896cbd3db630511e83ce6ed865e1cbcf7cd9e4b44e6ee16a5e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591809, "uuid": "0d821154-c88b-4fc9-8de0-109befeac155", "value": "T191F3018261CFD716F721FC7F231195A24A09FC38918E9536F778322CBA79A23202D59D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591809, "uuid": "bf0aa04f-b464-4127-b660-3fbefe610381", "value": "3072:IzT2WHGqntO1t5BNj+zmtCpIOu8JXK5L4aZL2+zAk5RZD9xszlgzvb:IzT5HDtO1xxfmIH8QN4aZL5AkZIyvb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591809, "uuid": "56595804-0e3d-41a2-ae25-3e8dac143a49", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591809, "uuid": "31e8cf6b-4674-47d5-b645-12c868d2f85e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591809, "uuid": "a88e683e-503a-4b4b-9d4d-73abda25235b", "value": "_00541_Purchase Order_.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eda4937-2759-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633602560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602560, "uuid": "8717f935-0ffa-44ce-9851-091e0aaede0a", "comment": "Malware payload (AgentTesla)", "value": "3fbf74a91ee46de4ae2f99b28505de6a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602560, "uuid": "1a9b00b5-9cc7-417a-a570-828eb48cce7f", "comment": "Malware payload (AgentTesla)", "value": "abda73763ad36ac411097107443056d1df717f139c8bc7492aec3d6ef33a3242", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602560, "uuid": "3782bba5-2f50-4cb9-aff7-6492f9cb43c2", "comment": "Malware payload (AgentTesla)", "value": "c7bac9331787f6b221d4153088eec0c9ba2d7405", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602560, "uuid": "110166bc-a6c8-44b0-8e6a-01eee53cde2c", "comment": "Malware payload (AgentTesla)", "value": "5816f55d4ee20f4f3ee08c06bdfd16e73a5c56903de0e4f4fe99a72db1b209e6542164350a7c1e0c07c7d339855e45cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602560, "uuid": "22039037-c626-4d83-9cd2-4a72888b1758", "value": "T10A15229363AC8DD4C06392B4DFD1C4BA6C19D9EE451A53B4AB02AB14FB5FD030E6A473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602560, "uuid": "63f20865-e43e-4106-8a40-d21413ee11f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602560, "uuid": "2ded3848-c083-4974-a746-854fea0dfa9c", "value": "12288:Q/UpxG9gwFIUV6Vxls3CwPt5gAtYY6LuOVyr877YOCdAA:qUpxGiwFXVcUcAtxy77YFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633602560, "uuid": "df71e26b-47b7-4595-bcd5-0e86ae780a84", "value": 950784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633602560, "uuid": "d624fb21-9b00-4fe7-aeb3-54df66ea4937", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602560, "uuid": "dd84aa29-0e20-4b94-95ee-d01dc924753f", "value": "new price quote inquiry FOB sgz67889 dfx46667.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a54cedb3-2765-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633607806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607806, "uuid": "bb7c72cf-3364-4ddd-93b1-c22a44d5c2b3", "comment": "Malware payload (AgentTesla)", "value": "cef53ea40229fa5da9993cd4566903b9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607806, "uuid": "a6286243-76de-42b4-b8d9-fe57f0890372", "comment": "Malware payload (AgentTesla)", "value": "abdaf4a53afa53c8e19f41c04e55b34334e96331d1453c3c82a69ecc43fceccc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607806, "uuid": "5b20b14a-1a4b-413f-881e-1556587fb42c", "comment": "Malware payload (AgentTesla)", "value": "8d86168a586182fc3bdec3ecd00c8c1b58838665", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607806, "uuid": "7ef83fd3-77f3-4ae0-bf6a-1e8ac7021b84", "comment": "Malware payload (AgentTesla)", "value": "a4ad4673d70933631495db47e5af711326e02b6b78a0d83669b34533cd45a387c9dd7b4a93380369d4ee601fabdb04b1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607806, "uuid": "ac307023-63f3-4920-8a70-5e6095aaf7eb", "value": "T16DA4F13A32A3CD05EE7547B6EC9DD05007B8E853612ACB3E6E8E71AC78127F54D805DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607806, "uuid": "a07ddf3a-c73c-4e4d-a03c-becb2d22be9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607806, "uuid": "bb904d9f-87a0-44c7-ada7-04e5a9052ed6", "value": "12288:uqh9oCY/DRjChwiGmYQAxEWIp/LE/VGQazGHYkAD/xx5:vh95zhyHojENGQazkYkGxx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633607806, "uuid": "c2af48fc-8e0e-4177-8318-6f60dadfeb4e", "value": 472576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633607806, "uuid": "696615a8-1ba2-43be-99b3-727fd9e3ee00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607806, "uuid": "8d26b693-db4a-4a7a-8faf-ec840bb4e8ee", "value": "BARI MEDI ORDER INQUIRY 3756653_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11921022-271c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633576204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576204, "uuid": "77c60db9-5360-4e0d-b719-e2d174f39ce3", "comment": "Malware payload (Mirai)", "value": "ef3eb0bbf460e923f3ace108f9027401", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576204, "uuid": "52c4e7be-ff44-48cd-a40f-e9d7764809c3", "comment": "Malware payload (Mirai)", "value": "ac0b74a708552063c48e3f72b1e3e6da97ff9801762a475ff6cec903e767510b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576204, "uuid": "7f90ee1e-b30c-4128-aeb8-dddfc8a65174", "comment": "Malware payload (Mirai)", "value": "a61838a223b74193b554644a61f0c37e71ea2486", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576204, "uuid": "e31661cd-4ba9-40d6-a3f7-76cd25553c06", "comment": "Malware payload (Mirai)", "value": "8b9c9e4517959948d011208a9411bf0981696c102ff0a10ed943780e4b515cc78d8e3841b739389cb6098e6c96e99140", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576204, "uuid": "cd4632de-fb6d-4bfc-88dc-4830507b17de", "value": "T1D5A30944E560971AC3E333BAFB59418E32231FA8A3DB30259934FFA423F6BE61535525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576204, "uuid": "d759a826-fdc8-4310-a933-1923899caa9d", "value": "1536:5gnn1WTef9i6qHcJBNlBaHuVCEdZ7ifDEI3gfHOaO5jBY2CW7YecFq:rrvHUDBaWkEI3gfHDORoIoFq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633576204, "uuid": "498092da-38a7-47f8-a323-4677a6c1984a", "value": 103244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633576204, "uuid": "6af24d03-c598-4d28-8d53-9de63d7fa873", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576204, "uuid": "cedb0e13-1879-4213-b94a-c71e474ac81a", "value": "ef3eb0bbf460e923f3ace108f9027401", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b7d72a5-273f-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633591253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591253, "uuid": "55ea1801-d4be-40a5-8439-ecfbc052ed5a", "comment": "Malware payload (RaccoonStealer)", "value": "defe2e93fec346d7bf76f6067da2b8eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591253, "uuid": "6cee75aa-3166-4212-ac8a-79d4273d2182", "comment": "Malware payload (RaccoonStealer)", "value": "acc263aaa282b35a74e824dace95d82404a48516fb2eddbd9fa15353d9aad9f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591253, "uuid": "ed9f7968-fba0-475c-a215-1c27dfa51e69", "comment": "Malware payload (RaccoonStealer)", "value": "042f949ce134d885fe815513f4b4c63822436537", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591253, "uuid": "1afc3f2a-6e18-4b42-bfc1-2614af671339", "comment": "Malware payload (RaccoonStealer)", "value": "0ede2bbf37cfeab4ab4bef527f7005a6102b78e5912a3f3729ce807e045748fdd7ccd1b8a8e93b38593a825e76e36922", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591253, "uuid": "1c597406-8cb3-4d55-9176-29163589be24", "value": "T137349E10ABF0C035F5B752FA4A7A83F8A52D79B05F3580CB62D916FA5A346E4AC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591253, "uuid": "be1e390c-249e-48fa-9225-70b743399503", "value": "dfddb4935ecfeccd8e67f98d0f98b8e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591253, "uuid": "b0bd7d94-9a89-470a-93dc-f0a6c91d3a52", "value": "3072:eF0XNfmnLfEK3gH6yVDhikOAu0bO0SX37yg1/J08zF0UJVM8gYLCqISTUO1hQyYV:eF09gsK3gHfDLOA70JXKUJVFJf3xY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591253, "uuid": "c90d0104-0040-4f19-86d3-14ff49297c49", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591253, "uuid": "4a823b9b-6d0b-4774-9e22-1dc9f8f8b2a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591253, "uuid": "0f583731-57b5-4d6c-99de-81a024c2f054", "value": "defe2e93fec346d7bf76f6067da2b8eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33bd1c95-2764-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633607185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607185, "uuid": "4a0e5ccc-9809-4591-ae62-76ff9329859c", "comment": "Malware payload (Quakbot)", "value": "650393a4720518176d8bc503cf686cf6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607185, "uuid": "b8865a43-9d9d-4d51-9d56-fca619079188", "comment": "Malware payload (Quakbot)", "value": "acc31f97c3124a317f2939944777e103311f4b0c51788d2e562c24a08e2afe27", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607185, "uuid": "2e8ef70f-57d9-4b77-b9ea-67fb22124625", "comment": "Malware payload (Quakbot)", "value": "ea2a8f0aab617f00a532a68a91ee96be427ce372", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607185, "uuid": "182b4a33-94eb-465a-8fec-b45a16071f28", "comment": "Malware payload (Quakbot)", "value": "46faf8f72ecd1caedaf59dcde705937c3f7e22ecf1271ff39f5e4816504d5560e9f809d4d02020b2dfe209e56b8d3441", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607185, "uuid": "b449ff95-378c-4efb-a7d3-b8596c7a9cd7", "value": "T182D49F23A2B04837D163667DAD5F53AC9C36BE103E24FC472BE41E4D5F39281792A297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607185, "uuid": "9420a8c2-705f-4903-ad3d-551558651324", "value": "a459dd59d01d4afc63f7a4c99f159af5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607185, "uuid": "eb4aa153-5d00-4423-9c08-24873c7e0642", "value": "12288:u6DCqRM4uT1+XaW1EgWQDoOY2ueCdAFmnIeFtJPrGYidZKCRw9u:VeAqXMEgEfILctFyYiPw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633607185, "uuid": "fb2541ba-3883-4a14-b05b-d23680038bb1", "value": 626232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633607185, "uuid": "2e77b974-56d2-4e20-b148-760c5e5ed8f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607185, "uuid": "d1f15bdd-1473-4f2c-a5f5-379f7fb55146", "value": "test1.test", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c33480-2775-11ec-843c-42010a9c0014", "comment": "Malware payload (a310Logger)", "timestamp": 1633614490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614490, "uuid": "a0847517-da5d-4766-8fd1-8a6860587422", "comment": "Malware payload (a310Logger)", "value": "fc1ac30e0bd33f65402eee320f49f829", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614490, "uuid": "bb25be06-acfe-4bed-b3c0-b96b1e268150", "comment": "Malware payload (a310Logger)", "value": "ae025c9c90faa47f899e3154fde3917187f1332962729da17e29353e0afe50f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614490, "uuid": "5be2d3f5-6dbd-4216-9e0e-fe0ca3a68283", "comment": "Malware payload (a310Logger)", "value": "0b11787a0b26dbc145a4fd2922ce94ca0bfbb460", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614490, "uuid": "269b2f7e-7b3f-47fa-93e2-bf77f85d721b", "comment": "Malware payload (a310Logger)", "value": "39ef61ab2c38222edd0f56522e0afcfea494395c4c3aecf57c560b28848b9a2056d4417ad3ae1b208de8204ca94af69d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614490, "uuid": "7be43ee2-3bb6-4397-a90d-5e1d10a23aba", "value": "T1C1B2D811E695C921D0777A3A4C9A82F80A78FD1BBD53975BA8CC3F1E7DF23040752A20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614490, "uuid": "791292b2-e0af-4fc3-92fe-7ce837a98b95", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614490, "uuid": "fde55032-f463-4dff-a44e-7c74d91fe1ce", "value": "192:ZqP2Yh/XA6Ut7TyhzmxJfNj+guYcKb5QIUypW:UuK/wrTyR6JFy1YDQgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633614490, "uuid": "1bb85e08-11bb-434b-ac6e-53e5c85f3b6a", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633614490, "uuid": "774d63e7-84ad-468c-9e31-cc6a9c2517d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614490, "uuid": "a0a86e54-688f-418e-9672-208bc8b3d1e4", "value": "fc1ac30e0bd33f65402eee320f49f829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "869e85c4-2762-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633606466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633606466, "uuid": "f18e5710-0199-46af-8356-4179453f7f1b", "comment": "Malware payload", "value": "3bb9fab5db7a39bb92fea50b1e5847e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633606466, "uuid": "126ec28e-ea3d-414f-9735-b2a10bfc89e1", "comment": "Malware payload", "value": "ae636de9b33c5f5d977ad9bb9fb24e83b077fc68eeb0297456792da762a08d41", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633606466, "uuid": "143158d5-f73d-4626-be1a-c0933e431e82", "comment": "Malware payload", "value": "0c77af1d4fabfba73faf990d7d2384e7f96c61b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633606466, "uuid": "72c296e5-f501-4a00-933c-e9f011e9fb5e", "comment": "Malware payload", "value": "e2ce79591483d3b51b93b25fccc43039014cd19d43b815319565dae4db5020e89f2b8e97652709197b345ef89d066e8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633606466, "uuid": "8b25aec7-0224-4fa5-a890-bdf980914e5c", "value": "T1AC961854BE90EA31D159AB3509CBCF793A31BDA58B538617B3F47B3F29322046B16C18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633606466, "uuid": "2cc25dc3-f590-4bdb-828d-d8ff07f0c513", "value": "49152:Zkzay9/hYEJaJCU2PwpTvM94dI+xVanpXQcY6B9fHnrVz2ob3m7Obw8h8CXG7Q00:Z+ywaw+9Vanqcxhz3rjx3S1v9c8Ch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633606466, "uuid": "ea4d795d-ab52-4ecb-b53f-f1df28dad102", "value": 8945664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633606466, "uuid": "633283cd-a9c8-4acb-a8ad-8fcacd39c79d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633606466, "uuid": "3670f47c-03fc-4cd0-88d8-dca7161d4006", "value": "WAXE8BB.tmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f50acd-2782-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633620071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620071, "uuid": "d6eb516a-c898-4f5e-8e47-9640eaf2af4a", "comment": "Malware payload (Quakbot)", "value": "a7c1b5dffb6211aac48fdc05b17b3c57", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620071, "uuid": "7b6a91a9-5bad-4aff-8c4d-a71462fdd8c1", "comment": "Malware payload (Quakbot)", "value": "ae795e7d999ef0276dc6887f909ab9ff32f0a32b4bbdbe15cae4a1e666f239bc", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620071, "uuid": "20e9354d-bb28-48bd-8252-6e64ad4169dd", "comment": "Malware payload (Quakbot)", "value": "c7a88700d52a61f3014e1c6aee22fa209d5e14f6", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620071, "uuid": "4ce8efac-a989-4bff-97a1-9a59dfbf44d9", "comment": "Malware payload (Quakbot)", "value": "af018218ea5c8be873158b8f79fa285f2d99f04ae46a2740f8a47fbfdb02b56eefcc9e120428c52871543fdbefdda843", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620071, "uuid": "642b701b-b791-4662-b109-ab59573ada6a", "value": "T15CD39C463797CA5BE58803398ED3C79B3B72FC21DE72470336463B0E5E7A6A18C16652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620071, "uuid": "306665b4-3358-48d5-b8c1-6befc769f4bc", "value": "3072:jk3hOdsylKlgxopeiBNhZFGzE+cL2kdAFc6YehWfG0tUHKGDbpmsiiT42ti+RLCY:jk3hOdsylKlgxopeiBNhZF+E+W2kdAF5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633620071, "uuid": "725667b5-bf36-4746-a385-629dacbd5771", "value": 137216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633620071, "uuid": "fe3a1a37-bb62-443d-8c9d-0ec6b6863b1b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620071, "uuid": "4c006b63-faea-4e16-ad32-03107ab2becc", "value": "AMLRPT_1428592311.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09016fba-271c-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633576190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576190, "uuid": "7de2b534-6f40-4291-8b8f-c381c54b41ff", "comment": "Malware payload (Gafgyt)", "value": "1bac3f7dbd61e788e5edd52d1f821ce4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576190, "uuid": "e46e77d5-53ac-4251-b6ea-4766daf90f9e", "comment": "Malware payload (Gafgyt)", "value": "af256cce1c8253a9e868cd3deaeae173ddce494a4c8376eec93e02417bf8bf29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576190, "uuid": "20eff11a-b35d-4c7f-94f1-3700ab89e3bf", "comment": "Malware payload (Gafgyt)", "value": "00bcb01075902c603f47ec974888c956adef279e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576190, "uuid": "0f4ebbff-58ea-4bcf-9a47-a7ae64a4838b", "comment": "Malware payload (Gafgyt)", "value": "c6713cad8caaf65be12d1845487fd7e7c08106ef7042e27bc6c06f9d998a3a16c47110f5cdf8bbf4e1d2b8a174613e2c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576190, "uuid": "e100820a-8b83-4c97-93e3-efc09c928be1", "value": "T10293E784FD55971BC3D372FAE759028D763A1FA8A7EB30269934BE9023F5BD02536120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576190, "uuid": "a1b73286-92b3-4fd8-bf46-5ebf01a6945b", "value": "1536:dmjnaOU7w+N62KBfISGHFxBpqRP/1yoQt/NeOCOlCvV41b:7OR+N62w5GHFERPcFNerK1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633576190, "uuid": "3ed9bfac-0785-47b1-95e3-30f2096eb6d0", "value": 90612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633576190, "uuid": "8c85cb14-3d65-48d3-9399-ea4f3e2ca5ee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576190, "uuid": "018fa339-dc7e-4e7b-8198-5a74eb9631da", "value": "1bac3f7dbd61e788e5edd52d1f821ce4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14f73d9-2743-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633593196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593196, "uuid": "3f1c6a5d-b64f-453e-85c7-ca0fee67e1c7", "comment": "Malware payload", "value": "4c69f8ad3c4fbbdda71eb956c4c074ad", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593196, "uuid": "be485bb0-8641-4ac5-97f6-7904851205e2", "comment": "Malware payload", "value": "af5a9fec99a175269a162e9fa02c77ce1a4b4344f1674f165759a122e2e3d807", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593196, "uuid": "be526480-e7ea-4e04-aa00-2a54568b2126", "comment": "Malware payload", "value": "b2a52cee96cbb0df1528ed0349d8068bf46f6220", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593196, "uuid": "c08fbbca-d73b-4cbf-bd26-068eb0548ac5", "comment": "Malware payload", "value": "358121d51e6d3d5853a67171253348df98dc460dba404625d70140f754769b493b023c19f42167ce48dd91ca312c3b51", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593196, "uuid": "da6343a7-0465-44f6-9593-5caa4177a0fb", "value": "T13B01B1261C1FC0BA9B0F43D52665B5DC8101549860B6F844E644DE1D8204ABA2708C9F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593196, "uuid": "1f9e0ffd-7973-4848-bca3-8fd1ae35215b", "value": "24:CHr+ndJhH+H7GqL/R9X2ndcu/R9N39ovb:CHrgHg99XHi9N3qj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593196, "uuid": "58c7faab-8961-461f-9fcb-f3ef4ec28e0f", "value": 815, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593196, "uuid": "ff107ad2-23fb-44dd-838a-982ee4394add", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593196, "uuid": "2f521949-bc18-4ba8-a000-ec1747f474ab", "value": "Draft copy_invoice_payment.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48ff07f-272a-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633582544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633582544, "uuid": "1e0c2d66-b18f-4e0b-8e11-201e1d2d1e3c", "comment": "Malware payload (RaccoonStealer)", "value": "381da453730b74982fe75892c5edb502", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633582544, "uuid": "a893c52b-90f4-4bc6-8577-6ce5ea736751", "comment": "Malware payload (RaccoonStealer)", "value": "aff400bc5e8f7b77f6ea3a1f5b759a44e6a409a661c5694f0d7069baad8b1f6e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633582544, "uuid": "7c5ba61d-cb04-4b59-be90-20afa45c85de", "comment": "Malware payload (RaccoonStealer)", "value": "ab2ce9008dd34d9114c1619ee9be5a7a3a88d177", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633582544, "uuid": "bbd5f420-b4fe-4c88-9e47-5ee6a74abc99", "comment": "Malware payload (RaccoonStealer)", "value": "fdeb87b2e95c527df22c711f4019be46e015cb33d2dd8018f97f0fd7c48afe1ecd9f231b832c1a5375aa13367348710b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633582544, "uuid": "522059e5-0bcc-4089-8748-f53efa935369", "value": "T118148D2177D9C4B2F7A3197049B1C6B18A6BBC725871B58B3F90062EEE792D0CA25347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633582544, "uuid": "c1eb76a8-5230-465e-ba9a-a773240a1696", "value": "01c64e8a0bf942eae9e15adaebb52144", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633582544, "uuid": "dc5c27cf-02cf-439d-be7a-457ea8380fd2", "value": "3072:q6FlRK6BWmr2hdNWFpFNqN45WilP+4ZCngF0813YWCjAqBch:HFZ5rydNWTqN45WiA5e0WYWCj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633582544, "uuid": "dbbbdad3-49b6-4520-8ab1-b49561ed0178", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633582544, "uuid": "ed141cb0-fe7d-495e-9db4-e68301ed4eae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633582544, "uuid": "00381677-6c76-429f-8bde-4333bc4e9775", "value": "381da453730b74982fe75892c5edb502.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474d0143-2727-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633581019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633581019, "uuid": "71a4017d-8018-42b0-a834-4d2d36222334", "comment": "Malware payload (Gafgyt)", "value": "d43c678167a634a764b3740c8f671004", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633581019, "uuid": "b3f59a6e-3a5a-4227-a142-d311a192ffe2", "comment": "Malware payload (Gafgyt)", "value": "b056cb27c0e0a483b1040c6756117266b5a5b27eff4088b1b59f4c84fb072d3c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633581019, "uuid": "79c7e304-8404-4994-a241-fc5a87d1babe", "comment": "Malware payload (Gafgyt)", "value": "52a5702b381414e0d7a63f81d3d7440320bab915", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633581019, "uuid": "ac64ab86-a08c-4fa8-9e0f-bf6655bffecd", "comment": "Malware payload (Gafgyt)", "value": "561af4c45bf675fdd62b3e375ff22674cb28a24b7406c453a0b02eae4207da35fa2488cf23abd9f2ab0d1693b6ee9cb7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633581019, "uuid": "db4b8fcf-bc0e-4072-b1b4-8f56e432e70e", "value": "T19AA33A47671D0B53C24B5AF12DB737F0879EFA7116E22280A40EBFC01B72A746626F95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633581019, "uuid": "5473acdb-dee7-4a0e-ac99-5aa7e512bb84", "value": "3072:RV7qiiERyM/lYFg5hVI1FEkNUZ09DRDWQfgm:RVwERyMt2g5hVIokNUZ09DRDWQfgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633581019, "uuid": "6484f753-df18-4f6e-b878-3edf77f5df72", "value": 104108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633581019, "uuid": "7278c8e6-78da-4d95-a5ce-5db37b87f8d9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633581019, "uuid": "1d7624e0-166e-42f3-b9a9-422ecb5200c8", "value": "d43c678167a634a764b3740c8f671004", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "374c017b-2799-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633629955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633629955, "uuid": "df0b0e83-d8a5-4b24-b096-4e8ea888634f", "comment": "Malware payload (RaccoonStealer)", "value": "1689e97b01f8d9271316191a34b49bdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633629955, "uuid": "7d2770a9-a47f-43af-bad2-bbb574e38ecf", "comment": "Malware payload (RaccoonStealer)", "value": "b23bfb360da32c889bc926a4057e1fa1d284e8ecfdde9d04bd70e7590b30cd25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633629955, "uuid": "d598530f-5c61-4443-b406-322fa8b143f3", "comment": "Malware payload (RaccoonStealer)", "value": "ab7a176314aa4e06ec98649087fd5eb35d3f6aac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633629955, "uuid": "a9cc6af4-c4f0-43d7-bd34-e6be203ec5c5", "comment": "Malware payload (RaccoonStealer)", "value": "6425b16fb336a088538e484b3e92f59436215b5f0f2deb34fc0f4d3b24de1b7c58c6498b4db99282a51b8e71cc3f1f2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633629955, "uuid": "e27c9c68-d0ea-4a5c-930f-11d782e951e3", "value": "T11CC4E00076E0C039F5F756F8597A8378693E3AA16B3894CF62D126EE4A356E1EC70317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633629955, "uuid": "d311f386-b346-4fb5-b5a5-cda02f0785c0", "value": "5723d007fd3b79d5a0887de51ad72442", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633629955, "uuid": "69a5774a-0084-4146-9437-d65a0828549f", "value": "12288:JAfCQTWwBebPQizBcpXNXc+GChqMaG+4dFgKsgNd33A:JAfCQhiPpK7cN3MaG6gTA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633629955, "uuid": "ca488ab2-f4f8-4f52-8a25-f24992a88b48", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633629955, "uuid": "53d58262-0276-4ff6-939f-ba792bb1042d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633629955, "uuid": "8a4708ce-f50e-4acf-b986-cd83f6fdbec0", "value": "1689e97b01f8d9271316191a34b49bdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8d72ce-274c-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633596892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596892, "uuid": "8719ffd4-6b2a-41f3-b2d0-e8de0718f541", "comment": "Malware payload (Loki)", "value": "b20cb526e8691731581ef0aa0d912a01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596892, "uuid": "feacb9a7-91e5-419c-b075-c4f147d7528e", "comment": "Malware payload (Loki)", "value": "b2527c2b5ff50072d71885cf172014369ff357b0cbc57d711cdce75991153f94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596892, "uuid": "f5a32f9c-7c68-4039-9ce6-dfa39c8f9e9c", "comment": "Malware payload (Loki)", "value": "970c1400c8569441e252828a215c2811e31eb973", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596892, "uuid": "a9ccfc29-85ab-4d29-99cc-739c85af514b", "comment": "Malware payload (Loki)", "value": "cd26e0b3f3bc2e9090ca90bf1fccc55f6355af6b94aaafdae03e5704e8eb08ae9a70d84f8f91b01ed9996493a3543a65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596892, "uuid": "754d618c-48b7-4dbd-9aca-bc12642cf59f", "value": "T1CD642202AAE1DC77F31A17B109B5E3B5F5AFC5E8152208575F004D7A32F88AF91129BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596892, "uuid": "838c5547-e6df-405f-95eb-14cec060b399", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596892, "uuid": "66ce2186-55f6-4065-8757-c29ee3f10304", "value": "6144:F8LxBsoz4+yYBsfSAPxeaxvK3BIjPk91NF/bywFlDUh0NXa:/WOYOnjxvfgjNxewF9UOha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633596892, "uuid": "aa41b7ba-47a3-4462-a771-62a58eadae06", "value": 310157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633596892, "uuid": "5ce444df-a61d-456a-8f92-85386b2f69f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596892, "uuid": "f1908b43-f4a6-4f4d-90ac-15b1cad01d83", "value": "b20cb526e8691731581ef0aa0d912a01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06da57ae-278c-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1633624290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624290, "uuid": "5f0f1dea-cd76-4680-86a8-d868d988b21c", "comment": "Malware payload (BitRAT)", "value": "23c8eb156f6124878f21cf5c98c18071", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624290, "uuid": "c93ddf47-4c60-4d2d-bba6-64d20cb26448", "comment": "Malware payload (BitRAT)", "value": "b2b44e75af97818567245e31eeb685c4e65632cab9115516aaaa30b43daa28b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624290, "uuid": "0b3f6cd2-0c7d-40de-b2c7-8ddf0ae64f46", "comment": "Malware payload (BitRAT)", "value": "37053a650427b01138085f77f5000d754104cd8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624290, "uuid": "d3c2cea7-dc84-4441-a48e-c345e778e121", "comment": "Malware payload (BitRAT)", "value": "90ffd2b01190674a6535a305bb08a3cc06f211ce0883fdb238054bc75c78621c436c0eb9ceb1d480e7a331e7c0b9d1a1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624290, "uuid": "89dfc11f-280d-4f32-a810-bc2ffcdf3af1", "value": "T182D4D37C256A5E48F3A494BCB6B58DFF27A0BC1F45A7B4F3900CB1D70AB9BD05502226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624290, "uuid": "f6575ca5-cd77-4cc2-ac85-de3bd9bedfc8", "value": "903119b637f155dd7ab6c6a49ae6012a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624290, "uuid": "b97dc19e-f901-4160-833b-6e8566e0b9c2", "value": "6144:pC4w8juap56y9dg4sIo9ZCf6YRZDYnDSb+Ox72aR914w6Fs2gVKiEgvaratgMZ:8napvg4sz9dYRZsDy+M70sdpEaar3MZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633624290, "uuid": "2e16f400-620c-4465-b534-4ebd9730ec6a", "value": 632206, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633624290, "uuid": "942373fe-09b6-4e41-b5a6-e2a208fe49b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624290, "uuid": "7e03b027-7686-4d72-bb7d-1e8468db6e45", "value": "23c8eb156f6124878f21cf5c98c18071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebb5011-2725-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633580441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580441, "uuid": "cc9f2f5c-f3cc-441f-9ccb-005045ff167b", "comment": "Malware payload (AgentTesla)", "value": "38d1c31b31b6fee492549b79c259ec19", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580441, "uuid": "c40cde65-ebbb-4a8b-8d0e-0a73cab6acae", "comment": "Malware payload (AgentTesla)", "value": "b3217f9acafd907a249c5e1323c5beea396a3cef3235a63c9f27b8c2c2932981", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580441, "uuid": "e5e947f1-51e7-4c86-93a2-5c6a2fdc51ac", "comment": "Malware payload (AgentTesla)", "value": "c4b88ebec64df40126bc7bcf9fc80185776be27a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580441, "uuid": "9f0e6594-541b-48f2-be15-58048f990a83", "comment": "Malware payload (AgentTesla)", "value": "abab9d23fca3da401f653a6e5e678eea060fe35e52f688d0ba139f745be7904e39c37b7f89297aa8a254a2cb1a5e48c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580441, "uuid": "89dfd04c-7b05-4579-bf93-ba2fa3ed1ec3", "value": "T1F3A4E17D36A3C900EE7183B6ED8DD140177CA416756ACB3A6E8E617CA8123F50DD86CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580441, "uuid": "cb260716-2310-4b1b-9f4e-40f768f0b3fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580441, "uuid": "e51b6a7d-c58b-4f4e-9846-474922e1a001", "value": "12288:BhGcOEeo5BjtYPZkVJw9RHSQrKcXD+iCRSEgH5ie:aEe0YsCzSQJuRk0e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633580441, "uuid": "64d27a3a-8241-4614-8d30-db173c03aa38", "value": 465920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633580441, "uuid": "1b0cd0c0-8ce8-4405-a21c-85f78b1403c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580441, "uuid": "a0c4d2c7-ca14-43c9-9e3a-b961c8d209ae", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2566cc5-273d-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633590674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590674, "uuid": "37ef0721-a5df-465a-a45d-70a0cb3c191a", "comment": "Malware payload (RemcosRAT)", "value": "0497faff25c24f11d0813f8da6b5c2d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590674, "uuid": "f42f3b8f-28b5-4034-b173-7f1b89384df2", "comment": "Malware payload (RemcosRAT)", "value": "b3e18d1026779e01b6bc834a8da488eeb669e5e366ef8d495c109c0f1424d3c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590674, "uuid": "172cff81-e4f2-4d6f-9333-80b5a9d3ef3a", "comment": "Malware payload (RemcosRAT)", "value": "c8be0daa4efdae6d1d7712f4e1e2a94e5608654f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590674, "uuid": "019108bf-e3aa-4f34-8a66-3c8722052575", "comment": "Malware payload (RemcosRAT)", "value": "dc5fc2a9bb3b8e360ee50575ba403c12cfa334f61f8e9dc5ce349e899a19ae7b50062cc594da70847e8f875ee127a022", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590674, "uuid": "8cc2aafa-3117-44cd-bf24-efcc8536bad3", "value": "T17255E1F103013DEADBB52938716136C4CEA16923D7C110BCAEEB07BBBBF6A41D661519", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590674, "uuid": "be5ec371-efe9-40e7-a1ad-d40cb9ba66cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590674, "uuid": "1dbf1f99-d987-4a17-9e1e-3361e778acda", "value": "24576:4wH20Pcntu9H8cXQOoklad/Ipy0kHnd81ERqQjNLBF9oOAlv7AVx0Y:4wH2fuyaC56yLBUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633590674, "uuid": "f5e8d7af-f562-4cf1-a8ad-9ac96e77e851", "value": 1402368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633590674, "uuid": "2a6a44b8-2354-4244-9999-761c23b57648", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590674, "uuid": "4a4b64c8-d4be-4dea-9c3c-5c6d639337d4", "value": "0497faff25c24f11d0813f8da6b5c2d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f316f1-2740-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633591724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591724, "uuid": "4336f29f-3955-4f0b-8d9a-4de102df405b", "comment": "Malware payload", "value": "a675a24b1108d82f1492a66999254dcb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591724, "uuid": "53b3dce7-d2d2-41e9-88b4-8256fdd1fe55", "comment": "Malware payload", "value": "b482840b846809478949904fd681df05fa68bd02510d7939ba10b6246cce9c1b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591724, "uuid": "2ea4cbf7-a923-416b-8fcc-72554d08133e", "comment": "Malware payload", "value": "8f57355828eb649190f03002e2c8960e3e6a149c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591724, "uuid": "d82f27b9-f1d5-45e3-9a07-ed8506a5680a", "comment": "Malware payload", "value": "b8e3db08a05f7ab8586711db751591ea640785e6eca79c08ea96b8bd061d8126f4f186c03bc32d43c6580160412037cf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Neshta", "colour": "#F5FD90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591724, "uuid": "a7a12348-5f24-47c6-b121-cbba7133a1b4", "value": "T140227E6CC406F81AC11148BCD45682F1F7AE50D7E611FD2D3094729E07A06CB57DEAEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591724, "uuid": "eb53296b-f4a9-4284-96b6-e76e8808bb6a", "value": "192:ScIMmtPp8G/btCX0iSOaFXamWBXfc3zE/J:SPXxrtCEiSOYo0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591724, "uuid": "f3d9302d-a519-4b55-a252-cafdc674563f", "value": 10343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591724, "uuid": "09331c6d-4559-4be1-966b-b8b435962fab", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591724, "uuid": "6a1c15bb-d1a2-425b-867b-7e202fe4ddc9", "value": "SWIFT COPY_MT103.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d6f6c6b-27a1-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1633633562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633633562, "uuid": "0fc3f1b9-0570-4acf-a6c1-75ca94a3ec64", "comment": "Malware payload (CoinMiner)", "value": "0308d3044eda0db671c58c2a97cb3c10", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633633562, "uuid": "e25fc431-3ec1-46bd-906a-e82549cf998f", "comment": "Malware payload (CoinMiner)", "value": "b52242da50ea2b3a05f6787dfa7197a0c99442e91d3bc78b71363c2ff3c4f072", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633633562, "uuid": "d3875746-5ef9-4b11-bb98-327cecabeb57", "comment": "Malware payload (CoinMiner)", "value": "1737ab616a61d35b0bde0aaad949d9894e14be9e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633633562, "uuid": "bdddc571-ab64-4b21-8d38-977d3ee5e71e", "comment": "Malware payload (CoinMiner)", "value": "49c321580d32107496c733582b54bc7211a9e5c68a5855dbbbdc7cb25f4a9bb26b4c7e309b1b32c7dfa537b928ab9d2a", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633633562, "uuid": "8a39cca7-6e52-441d-9823-0ae3061d98d1", "value": "T1C9563364D8E49556F47DF470131A28FA01881C0D34BF542E9A789BEDDEF7E4CAE2E602", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633633562, "uuid": "5c12c655-a03c-4461-adcf-773e490e2201", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633633562, "uuid": "83a481b0-c36f-445b-85b5-68966603a8a1", "value": "98304:JZj16+7KgW/7knn+sD+LGn2RLL0C8XUb8tUQBNmFLfRUAned7aKT3MYg7la+xZoL:JZj17K77k+sDsGneN8Xh1BY5U8waKT3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633633562, "uuid": "aaf0bbec-0e89-4f10-8169-3691521fee15", "value": 6193014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633633562, "uuid": "bd8d704e-edea-4147-8dc4-26e97322169c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633633562, "uuid": "57d4dc0c-45f0-4fd6-8dd4-206d6e587d17", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f158fb-2765-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633607906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607906, "uuid": "41543a0a-7423-4836-a841-56a62e29395d", "comment": "Malware payload (GuLoader)", "value": "608d5496256acbf5cfc93f4958333160", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607906, "uuid": "efdb0e15-23ac-44af-b628-55c74a9a2596", "comment": "Malware payload (GuLoader)", "value": "b54efef8396314c1f95d540ce7d0ca79f9c8c98e431c6dd177ecf037167957de", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607906, "uuid": "82087809-4950-4568-bd24-f98af51ba49e", "comment": "Malware payload (GuLoader)", "value": "5363b8b0e9bd91b5380f1d1f42f39f551d99aa2a", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607906, "uuid": "39c46562-09b7-4487-83ab-7eea67f4a539", "comment": "Malware payload (GuLoader)", "value": "4d52f0ce39b1e4bb76f7691704ad3a9db0260292d6bfeefa4f80a606f7a98096d5151d45f970ab7896172633441f3183", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607906, "uuid": "acd6ccfa-0d2e-403b-9ec0-d00133a90968", "value": "T13EE305D1B5CD8536C402E0BF2B7F9467AB1C7C3304406A93B28E2B85D7B12EA69F5356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607906, "uuid": "ba74e502-a1cb-4cec-928c-42e34ff7faea", "value": "d0ac0bdf3a5152bcac064d77eed21690", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607906, "uuid": "3addf3ae-50c4-433d-859f-7ffef4a8ee46", "value": "3072:tgs7G8QovC7K6oLGP18y1ug9DNBYenlTERzh/jrVB:th7jQovC7KbS98yJkLrVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633607906, "uuid": "c1494b1f-0f94-471f-8d70-5e8cb12f2c8a", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633607906, "uuid": "cf2e40cb-adc0-4b5c-9f91-a87b492544c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607906, "uuid": "08a75128-8790-4a68-9cc1-b495920c1a5e", "value": "pago de factura pendiente.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba8eae3-27b0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633639948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633639948, "uuid": "4d26d663-45d2-47b2-a1b1-d70c891219a0", "comment": "Malware payload", "value": "25039dc6e6d5e262b059005fe2bd0895", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReflectiveGnome", "colour": "#6FA41B", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633639948, "uuid": "a065ff99-f4e8-40be-b0e3-07bedefb906d", "comment": "Malware payload", "value": "b568614fe33d732014980f0bb083e9abf45641f2dc230571eb3d63d6bc7f10b0", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReflectiveGnome", "colour": "#6FA41B", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633639948, "uuid": "b8823150-0f66-4f1d-af94-f22be3285ff9", "comment": "Malware payload", "value": "521a9668dbcd2a7b4a9b41797d748c92ecb642f5", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReflectiveGnome", "colour": "#6FA41B", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633639948, "uuid": "71e5882d-3b1c-4880-9dc8-b02f17a8d7fa", "comment": "Malware payload", "value": "7c414a35a1f1112b1179d4e6276a86ffc8d3a67dfa391509c4b22fd6c43082b1d7b61ae0341fa8fc4861592f3dbdbf0f", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ReflectiveGnome", "colour": "#6FA41B", "exportable": true, "hide_tag": false }, { "name": "TA505", "colour": "#E688C5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633639948, "uuid": "45cc635b-21db-4b2f-8840-2973eb2f729d", "value": "T1A0B1C89FE1C587F1DA0F02B5886A9337B21D3100822B2FFF652968AC07C1F96A53A711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633639948, "uuid": "4209aa01-91b6-43a9-8680-72dbe213df1b", "value": "33e7eb4125ea460b06315196da9e0749", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633639948, "uuid": "240f5b2d-bb30-44d7-a0a0-94f4839d905f", "value": "48:SGe7DZn3/AOvRG8bRqbgVmPyhSsBry+A6gvi75BDKhhSJRuqS:+JnBpGURqbg1yEuSTx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633639948, "uuid": "196f8f1b-aa01-4fa8-803c-c37424563359", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633639948, "uuid": "6d46bfe8-7dd8-4c2a-9af0-fe3ec80e4435", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633639948, "uuid": "8f2691af-f540-4bd7-8e98-e7f650558524", "value": "dwm-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13658f1d-2782-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633620016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620016, "uuid": "2b1d7c5b-add2-4966-9a26-75b8feb38c64", "comment": "Malware payload (AgentTesla)", "value": "1609f291d7b33baf48a1e2a02f0c046b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620016, "uuid": "47257107-2727-4322-8e41-b7d96ed505a0", "comment": "Malware payload (AgentTesla)", "value": "b5ca0ffeec2a4b6e9b5b4f2473991cf707fd2fded928c340309bcb1bc2ea7fe5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620016, "uuid": "72c2d005-38fa-451e-99b4-571f844f57b6", "comment": "Malware payload (AgentTesla)", "value": "18a5d757860b85685d132a08ce37082cdc185d46", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620016, "uuid": "75e16c8d-8ba4-43b6-8df6-b1bfb1f7b0d7", "comment": "Malware payload (AgentTesla)", "value": "710cb58a857e7a911b62f70074adcfd3f74699243bbd274b70dc6b24f7372da71d2e3298bf5a2049a4e9792d33de0c3a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620016, "uuid": "8ebb28cb-4830-4347-95d4-291ac4aa1eb9", "value": "T1F525E4103661CA17C56671F1C811CAF097A1AD15EA6AC2C72DF1BEEF79B9B43CE0109E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620016, "uuid": "30ea7b65-bfcc-4f8a-ab92-6eacb782d274", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620016, "uuid": "548e72c4-b0d0-4f30-9fed-fd14a0b02cea", "value": "12288:Bj+EyrqdJG7xS1jtKvk8hSEup4JVKkw9icdM41cDyL9pD3p:x+1rqdASB8jMNp4Dx+L7D5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633620016, "uuid": "3557dc66-1a73-47d8-8cfb-2b2378736d8b", "value": 1042432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633620016, "uuid": "664e0a29-f7eb-43cb-ac5e-79a176dbecc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620016, "uuid": "04c75717-8ee1-4a08-90f4-bb4b8933e7e1", "value": "comprobante.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adca3baa-274c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633597082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597082, "uuid": "fe89d793-6aa0-447e-b3c0-c20386f4a25b", "comment": "Malware payload (Formbook)", "value": "18fb21f1b0857a1e0716a721645865be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597082, "uuid": "2ca0b48f-b08c-494c-9be0-debc297cfdd6", "comment": "Malware payload (Formbook)", "value": "b72a3f61b90975c1e753aa646d5027c57b47ecb107e956926288e90340aa0f36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597082, "uuid": "17cf721f-8012-4f1c-be58-cbfef6ed06c5", "comment": "Malware payload (Formbook)", "value": "982726c7a9cc57bea72250386070f6f2eb966a86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597082, "uuid": "be8bd5e2-d7f6-49ea-84a5-693c84f5e424", "comment": "Malware payload (Formbook)", "value": "328cf5d22ef8a875c2c216a16c4a0f116942c06c37b1224625c2f635dbda60253513990cde1f8378b830455d4276555b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597082, "uuid": "affa6b84-7b13-43fa-b699-ff14b366d15d", "value": "T15055B34823542A5BD03D22AE2230304D03F7E61336D5EEDA3DDD67F6EAD6A051F928D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597082, "uuid": "b5878f01-52c2-4fb5-97cb-8a9ce501b476", "value": "12288:rnpoKk7n+nc4x0GC6qQg59DOD3fMfebpez15Z86VCEfIw3XZ+mllmTgVuPQuc1zn:l3fMfeogzc6diOTcggjgW44LbX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597082, "uuid": "b801520e-e2c3-4e90-9805-2a345b48a02e", "value": 1405676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597082, "uuid": "7cb85596-7002-4c42-8074-437867b51ff3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597082, "uuid": "4201d42c-1ffb-42b1-96c7-8c73d03a5122", "value": "18fb21f1b0857a1e0716a721645865be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10890561-277f-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633618723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618723, "uuid": "240b8448-9fcf-4daf-bd90-935e756b8d30", "comment": "Malware payload (GuLoader)", "value": "ea59a20e38100ea7ca4575e79a0d87bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618723, "uuid": "b62b0bff-570d-4b8d-8083-5e3ffcab4d32", "comment": "Malware payload (GuLoader)", "value": "b7949bfaf6abe4941e0e398499e8e4b020cdc6208d9fe40bcff9a02ed9367eff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618723, "uuid": "4cf8ab30-91a5-4537-b1bf-e0563f998476", "comment": "Malware payload (GuLoader)", "value": "88161b1bf62c6be2fc27469716345523124688c4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618723, "uuid": "c8e48500-5f4d-48fe-9f7f-497ecdc94884", "comment": "Malware payload (GuLoader)", "value": "e0d4b9dec571b3f04ef15e6dc31cf71cbf130d292b45ef57d939db84bc8559e3f83581ff15839d8574ef8c5cd3053a99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618723, "uuid": "3f81ce18-825d-4f41-ae02-b17f5db1d1f0", "value": "T18EE307D6B9CD8536D402E03F2B3FC557AB0D7C330A406983724E6B8AD7B11EA69B5346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618723, "uuid": "d319e043-c694-4986-8bd9-74d3eae3f20f", "value": "d0ac0bdf3a5152bcac064d77eed21690", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618723, "uuid": "1721dfb0-8e3b-40f2-8809-2d788735d714", "value": "3072:tLUHZINPyzF/W9gUqOhevmHRF41T1TsDzh/jrVB:tLU5zzFdUqOTfLrVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633618723, "uuid": "c18b9bf0-8c7e-42eb-901e-7206f23e8655", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633618723, "uuid": "fb7737a0-890d-49db-a19e-00591ac8d6db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618723, "uuid": "fc5e499b-b7ec-480c-be56-aedc1f715525", "value": "F210855.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "343d09aa-276a-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633609763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633609763, "uuid": "fa7e7e20-1fab-4d4d-b3f6-ef39687308e0", "comment": "Malware payload (GuLoader)", "value": "cb97b75f734c3f810287d022984547b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633609763, "uuid": "4fdd628c-9cb1-4787-b1d1-797f266f4e15", "comment": "Malware payload (GuLoader)", "value": "b7ba8526dce23b4703eabd0b544b17efb4391943be96df96a76cf0434134a85b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633609763, "uuid": "340df9b7-49f5-42af-8128-177b519759d0", "comment": "Malware payload (GuLoader)", "value": "67b7902ea784047263424fa89ef5bb3f47b04ab4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633609763, "uuid": "80d2517a-c582-419e-9055-ae069dd90051", "comment": "Malware payload (GuLoader)", "value": "df4038c8fb822f022895f5c63f9f876c9e617765d0e914e3805701f0b9b59576101a9d079381870e636ab79849de36a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633609763, "uuid": "25ea6fd6-99d2-43b0-b2f7-8118d2a3aabc", "value": "T196E3F5E1B68D8831D402E17F6F7F8467AB1D7C3304412A83724E3B85C7B22DA69B534A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633609763, "uuid": "4866a8af-1d1a-406b-b45e-5d0848fef191", "value": "d0ac0bdf3a5152bcac064d77eed21690", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633609763, "uuid": "baf0870a-8dd0-4859-91d6-9542ec543f59", "value": "3072:tqFSrpXKuwGb9PaQgzKCauDUdTMnzh/jrVB:tAO1Kuwa9PTeLrVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633609763, "uuid": "d5540503-4351-4ddb-9a06-ef202c4ed7d7", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633609763, "uuid": "216d1203-aa47-44dc-9d06-4cb1e674abbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633609763, "uuid": "b553fa29-2205-4c25-bcd5-24119eadae32", "value": "FACTURA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73ee58ce-274f-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633598274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598274, "uuid": "8a0324ab-593c-4525-a94a-174ecdf893fa", "comment": "Malware payload (NanoCore)", "value": "fafe214c03f1e66da0aa8fbcf50cc6a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598274, "uuid": "e6c1ee42-cc9b-443e-bc18-e594c5c02992", "comment": "Malware payload (NanoCore)", "value": "b7f7d964c225db74579cb5e24ede29a6ea4af7efabc52985749d466a0dce0130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598274, "uuid": "f80b81f2-3185-4ec5-adfe-e4f64a0a3815", "comment": "Malware payload (NanoCore)", "value": "ce81e1e18808e3bfe89a9db2373f742492d11cfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598274, "uuid": "0f805d25-d972-41e6-a855-cb2b4fb6f2eb", "comment": "Malware payload (NanoCore)", "value": "d2c4ea5952bf0976107c363466748282aa8b574c3a4796321b14815ec2a04888ccce221d5688404b10dbac520d700a04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598274, "uuid": "23b17c8c-8f36-43a5-82e7-6fb5c53aeeaa", "value": "T1A9351302B3C188B2D5731D369B39AB156E7DBD302F29D65FA3D44C6DDA34580A234BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598274, "uuid": "db53a10f-1aeb-41ff-8163-592cb45e35ab", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598274, "uuid": "809dd079-bdbf-4b72-baf4-9e5f53caa506", "value": "24576:rAOcZEhXkrRCuDQawkkW2+xWTq6ai0bagi7vzJS:tNkrRCVko+sTq6d4a5vw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598274, "uuid": "c318a238-62ce-412e-abc7-149f9d8289cd", "value": 1136927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598274, "uuid": "46edbee5-beb1-40d5-8a4a-2064c9f5e73b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598274, "uuid": "23f186a5-2fed-4cda-95a6-fa8eeb03103f", "value": "fafe214c03f1e66da0aa8fbcf50cc6a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19f50ea-2779-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1633616497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616497, "uuid": "490378b2-7e74-4f11-98ef-667629acd5de", "comment": "Malware payload (Vjw0rm)", "value": "f4240a60fd1b7c4c476330a3028b3bb2", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616497, "uuid": "487d4811-46c0-4a1f-a88e-064e4bad786b", "comment": "Malware payload (Vjw0rm)", "value": "b81b577fa7c0e7ccfd46c6a8171e83ad9c2c4a1e4c852b8b8d2ace4b0062313d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616497, "uuid": "bd269020-b3a3-4ff6-8f7e-b59423b0ac9a", "comment": "Malware payload (Vjw0rm)", "value": "f9a8d6a45341071168590f704bdc678c81f32d2c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616497, "uuid": "8b7e1834-b42d-4cb2-9409-1c8625d5a95b", "comment": "Malware payload (Vjw0rm)", "value": "678d5a36b26c70cee24c6abdfb470fb33006212f9b6c59ab306fee5a09707b51dd76ee394b7489ba35f48310a8e58b8b", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616497, "uuid": "a32c9482-51a6-42af-bb19-e4e986b649ca", "value": "T19D42B0AF93DEA5A1394B43D5763F8A402EAC8E0E70039D7CB45AE787C519B77807600B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616497, "uuid": "cf9121b0-aefd-48b1-92b4-3920dc526a08", "value": "384:/M3y1KxxSbYruGFbWWgCRUPkBsMeC9G8SUiIl+qkeLmhAmvn7:i0SAbQZWWxKkKGkIl+fe6tv7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633616497, "uuid": "43444414-2946-44b8-8005-a5327631aff6", "value": 12813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633616497, "uuid": "17e0cade-aeed-4f3f-b23e-88dff7cedcc2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616497, "uuid": "26d3670d-48a8-44d9-9f23-ad85f94d0051", "value": "T00170MNA.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dea52f3-273d-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633590372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590372, "uuid": "2e568de9-07f2-4a8d-9fcf-e979108a749e", "comment": "Malware payload (Loki)", "value": "d1144597887066491e626d9ed67c6e66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590372, "uuid": "eed19ff5-6b06-4e11-bfc9-64299810110d", "comment": "Malware payload (Loki)", "value": "b855bd0cc50714a2024eb71976cc8967a209a4e883be2f0d569cea273fa173ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590372, "uuid": "3c94220b-0d12-4255-96b7-953715736840", "comment": "Malware payload (Loki)", "value": "47f61b27c2468fb9c531fbf3a70b4e6a3dbb2e7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590372, "uuid": "ef5e761a-200f-40cd-83ad-46f675455dc8", "comment": "Malware payload (Loki)", "value": "a9433a1a897c9ec561ac0bed478836b7bcb0b21cd6e33389036664683b24b05bb6495376231574e1862a82b74de0667c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590372, "uuid": "451df1c8-15c7-4ea3-98ec-1f226d7ad36c", "value": "T11974DF7E33A3C804EE7182B6EC9ED55107BDAC12316AC7392A8E72AC65137F54C945CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590372, "uuid": "16266b53-9715-4ea9-bf8f-e8c17b3f3978", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590372, "uuid": "b6862a5a-a023-4104-ba22-9dd3fec763e0", "value": "6144:/o8dV8cQ+3HwOdQ7ucYvzkfukFxCju0gnEH3y:/oEV8to+7iQw/nH3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633590372, "uuid": "ea757f73-ae3f-4a3e-b390-1ec08f60c770", "value": 349696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633590372, "uuid": "7105cbef-de21-4b9a-8d57-6f9f46f7306c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590372, "uuid": "89bf409e-528f-4440-97f2-ef972bbf5ebc", "value": "Bank Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d922bad-273c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633590022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590022, "uuid": "f1f45c41-0d80-4a22-a74a-e544f0091b3f", "comment": "Malware payload", "value": "740a0b7b476ac3131083e22d6ed09668", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590022, "uuid": "97908399-9012-493c-a8a9-132360486469", "comment": "Malware payload", "value": "b95870ca4d00f82239045b3d770322e17071fbed24644d5702be98f75b6bd4b5", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590022, "uuid": "9f313329-1f40-4ed0-8826-e49482d56249", "comment": "Malware payload", "value": "1cf4f161424c9b8a945458c36e12e16ff433966d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590022, "uuid": "e56db96d-99bb-4817-8790-43b37a650ca6", "comment": "Malware payload", "value": "011d82cb42f12ae66b39ee98d25644f4000154af06d29a0f9fa9930468a65f22bb7f0589d10e690e8dd805b5712d0e94", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590022, "uuid": "46646846-a3c0-4262-96e8-c8e6e90790da", "value": "T1C15402562033D638EC0F95BA57EB2E393B992F174456D327AB32E608EFF6B52C112141", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590022, "uuid": "1625a8c5-a630-4392-a625-59586d6c60ed", "value": "6144:VS+E7F0pqXXLU2kBvBbFrZvIy8BtqYraPFR6u3JUTMxOY9BcapVL:VQR0pOxkBJbJpIy8LSP36u5UToRL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633590022, "uuid": "e34b7469-24a9-4d4b-af70-2ff2132747e2", "value": 280629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633590022, "uuid": "ba75edfc-de68-443b-b6b0-6cad78636bd0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590022, "uuid": "2e008e39-d73a-488c-923f-293dfe6b16f8", "value": "VerificationXform.29201X20211006.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0668949f-27a8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633636315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636315, "uuid": "80e2480f-ac69-42fc-bece-3c87d0ab3f0f", "comment": "Malware payload (AgentTesla)", "value": "23f5c902019ccd9883a118e9453db6b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636315, "uuid": "6abc8fb4-6489-47fd-a8d1-3053f9f01bcd", "comment": "Malware payload (AgentTesla)", "value": "b96444a34c1d60e72a85f99ca30e1126927f6918627737e93cbbc60b2a57a6b4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636315, "uuid": "8bfa331a-8036-4d11-ae06-8c649f959d11", "comment": "Malware payload (AgentTesla)", "value": "d5398c4e904f8fbefa4945bb6a5add4a68b31506", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636315, "uuid": "f532d14e-9a32-4001-ab7a-4bdf489cfc63", "comment": "Malware payload (AgentTesla)", "value": "836679255ad17732a6ef23c7c648118528a0a535e53a2df60c0aff401bb66d2f5c696c92a25b2c6fd4a6ee71c79f3524", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636315, "uuid": "bca00df9-28d2-4973-85f4-e0aa413dc468", "value": "T13D35F6102295CA01D1B637F4D860CAF097656C55DA29C28B2DF1BEEF79B1B03CE11A9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636315, "uuid": "8a67df72-8a4a-4bf1-8732-8e2d1b3262c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636315, "uuid": "207bcbb0-c365-4602-880e-62ac7d30ec82", "value": "12288:Xj50DDyL9pD3n+0S9OUFLZMOWnkkv7gd+IaW2L5asFy:zK+L7D3+14UFLZMPne+BLQsFy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633636315, "uuid": "2438068c-ac4b-408c-a088-e185300155ee", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633636315, "uuid": "ef8af61b-c702-462e-89e6-478f55c252ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636315, "uuid": "7a0b8925-def3-4c35-a671-df84811f3f0a", "value": "COPIA DE PAGO BCP 07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75a01c8-273d-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633590710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590710, "uuid": "49b7969d-86fc-49f1-87d5-45c77176d2cc", "comment": "Malware payload (RemcosRAT)", "value": "ff8c3736ac246c6ec8cb08a3cef7e0cc", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590710, "uuid": "92a903d4-5962-4f3a-9ff3-813f1618b0d3", "comment": "Malware payload (RemcosRAT)", "value": "b9c5a6059ee5150b5837e446196c4349571d80336b438056f687d7044cd246b9", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590710, "uuid": "890b035f-d3ab-4f8b-90db-fbbb82ad75ba", "comment": "Malware payload (RemcosRAT)", "value": "386286d8ff06c6eff3951a2930cdd1d4b63ce570", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590710, "uuid": "5211e7ed-bf59-4931-bb73-7cda6e4d3560", "comment": "Malware payload (RemcosRAT)", "value": "f8d47deb5b2d0c76ec61847e489ed20b2ae2761bdd40f12883a5117ea160944c3e0ad00a23c050c972dc145c15f0dd7c", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590710, "uuid": "497a6c2a-12ca-450c-94a8-7a1d7bc35dad", "value": "T121D127E9CC4342689347DAB91F5E8CCCC916941B60EDB4AC48D1D7BEA826CD9B3DE431", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590710, "uuid": "c919b6f6-a5de-4f28-b46d-f1b2b381151c", "value": "48:FL+IbM6MAcB87BSBphplSpB9yL7YC8Zbm:1BwPAcB87BSB3plQB9g7YCMbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633590710, "uuid": "e1819952-f6a4-498b-aef7-603dd2c8f059", "value": 6350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633590710, "uuid": "8bdc0159-1db4-4a00-bf53-9d806ea3276b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590710, "uuid": "81e4786b-7894-4c1c-86a7-ca7b435f997d", "value": "Aviso de Pago del 07.10.2021,pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba38175-274f-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633598314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598314, "uuid": "9ea20ced-ee56-4a46-8a60-bd5cb8e08f55", "comment": "Malware payload (ArkeiStealer)", "value": "db903b64c0756e044814788d74576792", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598314, "uuid": "bc770fb0-b687-4b06-bd25-bfc4cb7ab43e", "comment": "Malware payload (ArkeiStealer)", "value": "b9d7a6b2cf9c35cd2aa3b75732e1f1f77e7fc8ed36a7c40a8cd3382b9232d08b", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598314, "uuid": "f8f92a56-13a0-42b6-9893-e99e3347bd40", "comment": "Malware payload (ArkeiStealer)", "value": "801f5c4e9dae52498be0e23d87f110729cbc0d9a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598314, "uuid": "30aa0f9a-8f92-40d5-95a2-6c4924b7f31a", "comment": "Malware payload (ArkeiStealer)", "value": "a5bf1026e5617467a8004518a6626e9eb5e26c266025ed01ccdc1508e00b1597da77b1f7e5b2541d18a54f2ed04ee80a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598314, "uuid": "ad413f4e-9489-41ce-8693-5e4f4a28c1dc", "value": "T168E40210B6F0C035F87312FA463B93A4692D7EB0AB2581CF62C52AFA5B647E46D31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598314, "uuid": "f2ec67da-20c2-4c4e-87aa-b6e35a8fe268", "value": "dfddb4935ecfeccd8e67f98d0f98b8e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598314, "uuid": "68f4e444-64a3-4d3e-935e-9fd34c3aab68", "value": "12288:DFQUvtn0KQLbIINTCLbiBH3GiA3KMLRC2nAmLkUNdCYNQ/MLb85yOzG:DFNQLZOLbiB23FBAk7dCxM0MOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598314, "uuid": "5e74bf90-e3a2-410f-a2dc-b8132f049327", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598314, "uuid": "a8e0e892-0e5f-4b62-82b6-9abf7a1ce108", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598314, "uuid": "fc6158fc-8693-42c9-afe9-ebf8070eb94f", "value": "db903b64c0756e044814788d74576792.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59adc330-2753-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633599948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633599948, "uuid": "c15b20b4-f6d4-4dd5-a560-278e5f880621", "comment": "Malware payload (RaccoonStealer)", "value": "e8ea3fd7c6aa3c9fe156bae1ed89d588", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633599948, "uuid": "46682d6f-bd5b-41d8-b04e-95870643b6f6", "comment": "Malware payload (RaccoonStealer)", "value": "b9edb0ccfa91cbc5f3d0586ccffdb460633b259e623c5f796311fe5675e9b70e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633599948, "uuid": "9bdd3fa2-8206-4aeb-a888-67aaca6a2671", "comment": "Malware payload (RaccoonStealer)", "value": "20bc43bd604db99464e9488b8e924f981e88a18b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633599948, "uuid": "5dcfc284-59b8-4840-9078-41e03f84c1b8", "comment": "Malware payload (RaccoonStealer)", "value": "3204b1093a31de13683fad786038c8170402f4ef26054c95a0958bcbe723f52c845ec3a75db0ef3c271f439f8848272b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633599948, "uuid": "7adb6570-bec1-4e99-a101-990aba4b17c2", "value": "T1C3B4F110A7F0C035F1B716BA5E7693B5A53DB9B16B7980CF52C52AEA5A306E0AC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633599948, "uuid": "c2d71238-9070-40a5-8a75-9a37cb5e7f60", "value": "104d9977f4378bb867ddadb6d1eb3d6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633599948, "uuid": "e0d40afc-e763-4cfa-adf9-95e50e62bbe7", "value": "12288:oBHaLWQWm3LWNY6+qYJyU9XCbcyUW7PH:oBRm3n6+gU9ybcDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633599948, "uuid": "43d1f411-3f6a-4da6-8184-bba0eabf14f5", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633599948, "uuid": "9a95fdc5-a498-468b-8c5b-c948e28b0c98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633599948, "uuid": "4d316b95-1332-43fb-990e-e7c03d6d9144", "value": "e8ea3fd7c6aa3c9fe156bae1ed89d588.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b27dc65-2724-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633579871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579871, "uuid": "f20621fe-eafb-4697-abf6-6940aadf7ed0", "comment": "Malware payload (Formbook)", "value": "fc87c6bdf9be5c6f4b44171a25bab661", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579871, "uuid": "f0a8ce69-c404-44df-a8c8-f3a8094eacce", "comment": "Malware payload (Formbook)", "value": "ba05a22eba596d11ea43c5d829c17669ffae3f7bfea203af173a47b904ccf966", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579871, "uuid": "809970f7-f97b-46cb-9301-b0973a955492", "comment": "Malware payload (Formbook)", "value": "f9308937e04ff38555577c58f55cb476a55d13ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579871, "uuid": "4069f5cf-7dcb-4c73-89b0-3df7b796f32e", "comment": "Malware payload (Formbook)", "value": "8797898ed20f817345e7101f80ea9f6a22013015faf6abe1918d10712ed4c1fa8f2b48cbf4772778cbf8d68f459f2f3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633579871, "uuid": "d55a4bfe-6d70-45c2-8a41-437ebfa2866a", "value": "T197F4692F3213DB35CD2C42BF9C49DCD0C765AD06B9E5B62E2689322D267F2B50973582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633579871, "uuid": "cb2db941-eee1-4e35-9889-a2577adb2179", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633579871, "uuid": "9c917bc6-8423-4d4e-a6c2-2cf3dfdf27cc", "value": "12288:8CoqA9AfA//I/ywD05qwpnjlZ91bdyuS1+13sf8irOhRxuX:8CXA9AciNhwp91bd1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633579871, "uuid": "aa2137ed-8515-4de3-8928-b3ebce99e6dd", "value": 794112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633579871, "uuid": "dd34bae8-7084-42c3-a6d1-5cbdef2e930b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633579871, "uuid": "2796cdf3-458c-4061-8060-5767b92ad384", "value": "PO#006599.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e48b66d-278d-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633624786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624786, "uuid": "1979c25e-3616-468f-8d2e-f2a19c5aa966", "comment": "Malware payload (ArkeiStealer)", "value": "8dd2dc2c39490f74d043bb69d751b8af", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624786, "uuid": "976d0bb2-f80d-41d7-b797-db56b5a1514e", "comment": "Malware payload (ArkeiStealer)", "value": "bc25dd6801d118c88dc693ee7be6bb2369e6127b5fdd3f20a0ae496f034c288c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624786, "uuid": "9007c892-3888-4627-a55b-40385548bd3d", "comment": "Malware payload (ArkeiStealer)", "value": "da48e14a65f1d0ca16cc9b8f0d83df4984907f0b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624786, "uuid": "f58fb820-c2d9-447c-a00a-7713d7b8f41b", "comment": "Malware payload (ArkeiStealer)", "value": "37ccb7833ced9c52d975be58c5561b3243ffc9d4aa60fe3113e885e6d4cc8957fe9e082a9f0183d3e0664b1b6d17768f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624786, "uuid": "fac048b9-5f47-430a-aeb6-0421fc180102", "value": "T110E4F11176B0C031F4B746B90E6992B4A939BDB1A774D0CBA2D15BEA9A346F4FC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624786, "uuid": "8b1c1446-77cf-4579-b692-db29c8d3d3f1", "value": "c1d211268d6c769cc59ffca0e56e63c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624786, "uuid": "2fa2ac0a-3a6d-404b-b647-053d9b754e5f", "value": "12288:E1GcoR1yvzGnaVyHuvgx6QiCT6/prF5uP3ww7cqB42NLaPJYnW5GF00:E1rvzb0dmF2PgjqK2NL2Jdku", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633624786, "uuid": "4d90814a-31df-4a74-9e6b-16a160956700", "value": 681984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633624786, "uuid": "d7c03ac8-43c0-45dc-8cc6-1c8776c149e2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624786, "uuid": "7c465935-6058-4645-85b1-79f0bec0a0e5", "value": "8dd2dc2c39490f74d043bb69d751b8af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf0a01f-278b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633624168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624168, "uuid": "7b8125a6-7562-4220-a223-0adcaaf7c253", "comment": "Malware payload", "value": "20999d5e9251f38e53d8ba61447bc044", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624168, "uuid": "fb929913-968b-445c-8ad4-8df30c998170", "comment": "Malware payload", "value": "bc91fdad85c2e503dd2b21466af613f1bb5ed56f385131c97f15de03e34de141", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624168, "uuid": "1331ef3a-e856-4c74-9a48-a9dc58ea1dc1", "comment": "Malware payload", "value": "d54659f04d8a6f365f99e625a2f153e8b2e07241", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624168, "uuid": "fe002109-7f77-41b0-86ce-69399e40a72d", "comment": "Malware payload", "value": "ea7d5d62bece04d6e0a64fc55c70a114a6af42f12d7e3156e27f037170cbe1c4c49dff2ed6563b3995018cecf5ae5572", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624168, "uuid": "f3a7cf19-637e-4589-9c30-3b68c467a55e", "value": "T194D5332076E85572C769E5FB181B7C2153F222C2D431E99F129326B99180F70879FEAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624168, "uuid": "9a81e79f-c196-4fe4-a22e-4e2dade3e0aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624168, "uuid": "34cf6c51-4732-486c-ae23-f0f87d3b4294", "value": "49152:xsmhnqAs9pJc0dnKh+Q0N1rs+vIUSg+6+8ohnRh1Na1OKM6nYAKhFQpSH3Oh5gxr:nqXpy05Q0N1rsYSZ6BoXh1kkypSH3Ohs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633624168, "uuid": "6fa5a35e-3d4e-43a4-ba99-0602081fa4e9", "value": 2978304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633624168, "uuid": "d5007069-6dd2-4e34-87e6-ea8a83101535", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624168, "uuid": "2adc9176-2999-40b9-9eff-544768b8c8ee", "value": "test.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7080a4eb-278d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633624897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624897, "uuid": "a6d07d72-f3c3-4a47-ba79-593a6efc9837", "comment": "Malware payload", "value": "76fa8a270063eb9810cb2fde5d80944f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624897, "uuid": "1c30865a-44b6-40ba-af62-718f5e31390d", "comment": "Malware payload", "value": "bce1cfbca7748bc0ff26b042668feddb6f4db2f44e10637b781cfe2394ff6414", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624897, "uuid": "079ff902-468a-441e-9327-e1ed2c704521", "comment": "Malware payload", "value": "766388e6afd78272334fa10286013947b8c07825", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624897, "uuid": "7f22f94c-f485-4c49-b83f-26b76ca328bd", "comment": "Malware payload", "value": "ab8e1d4a4d0afa544cd31153010a9710b1896d23456c2a06a9da50a7114726f8f5cd7175556b066cddf06845dce1a435", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624897, "uuid": "269b4437-2a47-4517-ac85-1a72b0705836", "value": "T1BDF37C9C762072DFC85BC876DEA96C74EA6074BB531B8203A01316ED9A0D99BCF151F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624897, "uuid": "af1051e5-4c7c-4308-b1a3-5d631532f9f7", "value": "3072:AOw+AKJv0pS9i3g7JzsUC9ENpqkKwawXWzWgKiQkWU2Ki/ptcpo:H9AKhjug7JzsQpGF/2D/ptcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633624897, "uuid": "1166445c-7f33-4b11-b20e-f5e25d7574ee", "value": 172544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633624897, "uuid": "6e673279-3105-4ab6-872e-06d7729d0185", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624897, "uuid": "bbab92a9-701a-4e1c-bba8-f1d63fb52ab0", "value": "76fa8a270063eb9810cb2fde5d80944f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e078919b-2783-11ec-843c-42010a9c0014", "comment": "Malware payload (a310Logger)", "timestamp": 1633620790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620790, "uuid": "5ad9e0c9-6e48-42cb-bc1d-31c8170c4daf", "comment": "Malware payload (a310Logger)", "value": "8788f11b9bfb489ab520f7bbb16a0ae5", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620790, "uuid": "944ac126-5661-4fe9-ac2a-5a012bfe2e90", "comment": "Malware payload (a310Logger)", "value": "bce90a7e2c725cf35eb9bea064dd047588eb3fc41224be362e876e1b399cbe80", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620790, "uuid": "b7fba7e0-027c-4741-87dc-0493c6084ba7", "comment": "Malware payload (a310Logger)", "value": "6700f43d20e33b6fbe76383a5314300abfa14fd1", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620790, "uuid": "c3bbbed2-1649-4a4b-a631-364416a84ce5", "comment": "Malware payload (a310Logger)", "value": "d855ff2f2f51313b91f50df07830897b246d9a62c6ed0b091000b83494ff7b52d62b14576a5e046a11a31e2dcc12fd44", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620790, "uuid": "3f07ab3c-8272-49f4-a1d4-0ae92ea8a441", "value": "T1FBB20A11E284C921D4B77A3A5C6582B80529FE6BF863D71F25DC3F1E7DF23450392924", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620790, "uuid": "9ac105f3-21fc-44b9-83b6-faf218a9e560", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620790, "uuid": "6dc281fa-02b4-4bed-8944-a17abbf6318d", "value": "96:KDWhoppa1J9thNd2+14jT8CQcjKHIrwZWAQb17MOE0S0pXsUkTDLotU5GLL1WzNt:KLpSJ9thSX3VQcMIMZgbhMdU/QI/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633620790, "uuid": "d136afc7-c925-4245-9142-3d8c65df76c0", "value": 25088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633620790, "uuid": "78afe734-c0c7-4ac9-a3d0-20f38e842174", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620790, "uuid": "0c27ae75-2afc-42ef-849a-fb2108f2a75a", "value": "IMG_002023400762.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6abbf7d-2743-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633593339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593339, "uuid": "98999e5d-d0ad-444c-ad51-22ff889e99f9", "comment": "Malware payload (AsyncRAT)", "value": "a629ea381b1ea8cc981aa69f464e7f4e", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593339, "uuid": "b3e4bf02-f343-4a15-88be-3ac612f6b3a9", "comment": "Malware payload (AsyncRAT)", "value": "bd621c64ff9650a6c920c96d232bc0a8803f9cbfa98d7054e6e798b67b076d34", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593339, "uuid": "dcda5278-f974-4c98-bd63-af2f07116112", "comment": "Malware payload (AsyncRAT)", "value": "a26570fcdf88db2e2e95a1bf60c1dab6229d8924", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593339, "uuid": "fab59f66-343e-463f-aff0-89b0c1e30c62", "comment": "Malware payload (AsyncRAT)", "value": "b0b3deab39191ca8cfc702385a7827bad9a501ee2d20a8811f9c5ca9ccd1ff0db847914320905d1ed3ccf80a5b755d45", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593339, "uuid": "0f6f7c24-4176-4629-8d2f-9dfb5a4a2d8a", "value": "T176919F75C00994C73945F2BA0B9589A581B8F3F5E9D884D17248BEDF1DBD41029BDB24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593339, "uuid": "c4676074-885c-4f8b-8de2-32986e78013b", "value": "48:yTTTTTTTTTjQWSgJ1oeSMsNTTTTTTTTTjQWSgJ1oeSMsO:iFSY1oeSfFSY1oeSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593339, "uuid": "dbf7291b-73ab-4403-a6f1-5b9082eedf6e", "value": 4317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593339, "uuid": "598d1377-b331-4a69-9fa8-9dcebd2e007e", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593339, "uuid": "af78645d-1a07-40ba-824e-1220b11a92ec", "value": "(10.06.2021)NEOS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52d777eb-2735-11ec-843c-42010a9c0014", "comment": "Malware payload (a310Logger)", "timestamp": 1633587051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633587051, "uuid": "f6d80eef-96e9-449b-b8d2-755cf2508c9e", "comment": "Malware payload (a310Logger)", "value": "50c18d7297ed9ad867a6c54c42fcaf87", "object_relation": "md5", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633587051, "uuid": "63912271-00da-4327-be3a-bf256c1eea29", "comment": "Malware payload (a310Logger)", "value": "bd6387e217bb54683a5300b0bcbb88e346f2f4b7a8cbfae9f95ae6bb8b3a798a", "object_relation": "sha256", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633587051, "uuid": "8a308a6f-9d92-4106-be65-68e49e916992", "comment": "Malware payload (a310Logger)", "value": "5066ded5b953e0cae30e638e831471ecdeeb4a1a", "object_relation": "sha1", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633587051, "uuid": "17a2e2d6-6b3a-4a5c-a5b7-7462f145b272", "comment": "Malware payload (a310Logger)", "value": "784b53a366447e5660ac5389e6210a25acfe8fdd2fd8c66bee6cf5924415e8825ef960e8a45a99928c8370fa2b0d0d00", "object_relation": "sha3-384", "Tag": [ { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633587051, "uuid": "4848a782-ad74-47f4-a589-668eb8c1524a", "value": "T130B423FFEA51E8F3C0A2067443BAEA37FF26445402D86603F7561F27A7A451A1E35C49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633587051, "uuid": "9bb57350-6745-48aa-bca0-f410d88f4e9e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633587051, "uuid": "70e8302a-4204-4dc4-abb8-f3efe47243fc", "value": "12288:ysy7oGCynP+JatHkq67ZNyTkeAb7/Xx+On2:Py7o6PeIkd7ZNZLB+G2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633587051, "uuid": "0d16dba4-02e6-4ce1-8863-5cc262c923e4", "value": 529375, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633587051, "uuid": "1140d53c-dbcb-4854-ad91-483ecb4b2cd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633587051, "uuid": "dbac858d-5b4f-4e6c-8f30-ac2c7caec989", "value": "Scan3094-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a78dacc2-272f-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633584616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633584616, "uuid": "27cf38bf-98b0-443c-8b3d-258a5b0d1e3f", "comment": "Malware payload (AsyncRAT)", "value": "7ef5540fb8f6dfb735cc66938d678101", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633584616, "uuid": "2938b781-296f-4210-a0ae-04d4d54b97f1", "comment": "Malware payload (AsyncRAT)", "value": "bda692e1e48b9e44403b52b04830d2de3a7e68aa5dce3f3a1f4329c7007b385d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633584616, "uuid": "874c172a-5f3e-43ed-94ac-b08e41546a74", "comment": "Malware payload (AsyncRAT)", "value": "c0e26cc7465c4b142b5ad3e7ecc093819659e699", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633584616, "uuid": "56080cfb-1e1d-4511-ad84-647e97339a86", "comment": "Malware payload (AsyncRAT)", "value": "e4c12bc27957c87bf40b91c3c269a6d1aa510d8d689d41de7c82c6b7a88804f6c322d4fd2f15c5ea611b6dc630284947", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633584616, "uuid": "47abcf53-3069-48bc-b7e0-0ee823068d93", "value": "T121F4AA5363AC8ED4C06792B4DFC1C4B96C19D9EE421A53B4AB12AB60F75FC031E6A473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633584616, "uuid": "57acc040-a308-4a9e-891b-1a831614ee2a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633584616, "uuid": "ca1d0b53-a65c-4ad2-a51a-27b26c253a1e", "value": "6144:nM+c6UqA9/vJXpKXHUgGvtejWVhWV7iP1xEvyBV1bufAbM:nrU/7XBgwNVo7TyFMAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633584616, "uuid": "6560c3b1-8b95-4e45-b387-fd05c64b5c6e", "value": 754176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633584616, "uuid": "5a071ee3-29bf-4d5f-83e8-9fc0b98aa642", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633584616, "uuid": "df8a5ebd-fff4-41fe-96e3-99d185460fb4", "value": "Payment_Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498d3d6a-278a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633623543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623543, "uuid": "2b5a6380-c587-4d40-9647-df2551bff05d", "comment": "Malware payload (Mirai)", "value": "dfbd9e3232d205fb878a1616d4751082", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623543, "uuid": "33eab0b9-fc42-4511-81cf-c471676e1330", "comment": "Malware payload (Mirai)", "value": "bfba83bb472ef0e2153c4e10501816c9199321112ab2a9e1133a5536ad84d514", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623543, "uuid": "b92e3d4a-13de-4e1c-bbc0-26ca553bb85b", "comment": "Malware payload (Mirai)", "value": "e79273e1e55552453644bd9c39deaee5fd6c8ca6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623543, "uuid": "17d33687-e44f-45b7-aab5-38a9e4c158c0", "comment": "Malware payload (Mirai)", "value": "558480912423f6f521cfde8ecec0d6d3bade108b1aae2aa7c478cd25624dd194e5761d3cc5f4847974777b6f8e37e4b7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623543, "uuid": "9e9c2f24-e1f0-4104-8dc2-5dc3f78c91ff", "value": "T10D734AC4A957E8F8D81616702177EF369676F03E602AEB8BE79C6933DC52702D04329D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623543, "uuid": "fd9a4786-e8e2-4049-b5de-966c2271530d", "value": "1536:P2nh4JimT9jBs5gABrXbdJzdk6+iXHh/hCQaMlyelNnyjPuRZRGuk9f32C:s+imT9jBSBrXbPzdk6+4BJhDlyelQjPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633623543, "uuid": "455da687-d9f0-4b5c-be57-3619e1d79b42", "value": 78928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633623543, "uuid": "e7298b08-2d9a-4bf8-b594-bfd0111a8e21", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623543, "uuid": "34724d3c-1858-4989-9e64-3f4c2c403068", "value": "i586-20211007-1619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982b01cf-2710-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633571276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633571276, "uuid": "2232bca5-1ad4-44a6-9e45-e58430f4b13e", "comment": "Malware payload (AgentTesla)", "value": "7f56956d1c8af9db094dff9a82337fb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633571276, "uuid": "dfc8f0ed-7012-436f-abf1-ee2946da6adb", "comment": "Malware payload (AgentTesla)", "value": "c0585059351b60144ee6c5dc0a5f9cc119ba56eb7f817761db36158beb22df2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633571276, "uuid": "c265cfa6-00ea-43e5-b072-5c9392659689", "comment": "Malware payload (AgentTesla)", "value": "e276e3c13d0496dbd3978eef650f51bdcf1e96c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633571276, "uuid": "c901db88-10e1-4895-8b83-7e194113bbb4", "comment": "Malware payload (AgentTesla)", "value": "8001803ae570dd988bef95a29f12dae2286ec4278022dc6f2ec6dc98bc19088ba425e3d3c903d76b8fec3f51c0626558", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633571276, "uuid": "16741d82-bd65-4555-98b8-0cada3640a4e", "value": "T19794026913278214EEB5CBF4AC2CD9511778B416245EC3B84F99E0BD7B237388ED0A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633571276, "uuid": "be352bbe-53a3-4863-9102-bbe65f0aaf8d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633571276, "uuid": "47c3154b-a85c-459d-a496-1f70de25f42a", "value": "6144:rH4EXIvIDQ+3HwOxpjfbFtEWU/C5X/WjbLTsCDTJoUALXCJbXEJngpYsn2sMdYJF:T4Jgkonjfd4GsDXDTJ4CJbEngz2WHJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633571276, "uuid": "487dc53b-4949-45a9-bbd7-2ce5582a00f1", "value": 442880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633571276, "uuid": "a79b763c-865f-40c0-8018-d8aa208680f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633571276, "uuid": "8e965f02-aa62-4bcc-8a48-b2f6f2e06e12", "value": "7f56956d1c8af9db094dff9a82337fb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214e7ab2-2760-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633605437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633605437, "uuid": "d00127bb-3335-4b02-bbf7-a6bdc5c5a8b4", "comment": "Malware payload (AgentTesla)", "value": "8271dde0dc09b938b32d6f3852ea86a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633605437, "uuid": "a8c81c2d-642e-49c6-9282-4cbd61fa43c5", "comment": "Malware payload (AgentTesla)", "value": "c2dd046f6d7de195aeb2d358ad77cda35f05972887466c89ea8ef22a0a20bed8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633605437, "uuid": "6deb1e1f-c019-4db9-977e-40402e6734d4", "comment": "Malware payload (AgentTesla)", "value": "07c658659bfb1f59f7fdabc4928705dff6f4dd86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633605437, "uuid": "6f602a6e-2487-4388-bf68-b7be55713479", "comment": "Malware payload (AgentTesla)", "value": "f2ccea4781de706450bc213df8f1434ceb78e4ac678ef8f736fa78188c03edc4ffef899660fabac3ee189f22809f2e98", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633605437, "uuid": "fd8a949b-f9bc-4543-a2b4-e43b2d75046c", "value": "T13F8423E11149DDB1722C6F30D43EACDF6272B7A249B52E2E2C0F17965A8AF49CD63017", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633605437, "uuid": "a9a59e20-3c80-4d7e-a513-b7dcaad7d981", "value": "6144:hl+ovLd5xkoXZ83uwmqeCvKGD1TtkexotYnZS2tOgAEmsVjf4T6OiQcoeqSHJ7GI:Bd5xkoXZ83uhUhD1TCoowvOgJmshf4T+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633605437, "uuid": "f2d73b77-524e-47e5-8899-c4cd0d3e2874", "value": 382055, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633605437, "uuid": "7f275d6e-0066-4881-b9a0-c8c208486a5c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633605437, "uuid": "346531dd-a4b6-4de4-bdb2-91511502466c", "value": "Purchase order.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61db3ef9-274c-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633596955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596955, "uuid": "cf1afb9d-7645-4db9-8c30-dc7203250d31", "comment": "Malware payload (ArkeiStealer)", "value": "658ff0f31f45e8b23232385f45350926", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596955, "uuid": "e54a6468-9e41-468f-83b6-318f1be38724", "comment": "Malware payload (ArkeiStealer)", "value": "c3bf9d72a7f69b7cb76260ef4de9f0033593e7756b8eb1e4e8ed166aa84a7cf9", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596955, "uuid": "ae7ae998-3bc8-42d2-bf1a-f94372313515", "comment": "Malware payload (ArkeiStealer)", "value": "f6b4cf0098cc748f652efe9819760f7847b066a0", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596955, "uuid": "93e7b7ab-124f-44be-a33c-d4c681e3dd18", "comment": "Malware payload (ArkeiStealer)", "value": "1352966667acd3098ba719986404304deff80cee5bfd2ac7005326c0ba64ffe5d3a98d78e880b98f8f4fbbbcae91d3fc", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596955, "uuid": "aa70ee23-7412-446f-a2b7-049aa20a5778", "value": "T1D5E40200A7F0C035F4B706B64E7693B4A62DBA706B24D2CB63D616EA5B706E4BC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596955, "uuid": "5a8a28e5-10ec-4036-bf88-7963e3cfcd8a", "value": "558186eb4208ff26294240429e60d1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596955, "uuid": "34bbbe1e-dfc7-4449-8941-2e25a940c38b", "value": "12288:kFy+0BMDIBL0wHSdM7O/JxnUqoGktww48HWQV+iV2uG/2HHBS:kFWBLgdM7AfnUqo9tw6WQjV2H+HHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633596955, "uuid": "d07336cc-7f3c-4093-bc37-7965cb618dc2", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633596955, "uuid": "05563d96-facb-44b3-92af-502fe45bcc2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596955, "uuid": "be271ea4-6629-4f9b-ab75-07ad382cfb8c", "value": "658ff0f31f45e8b23232385f45350926.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c247adee-2779-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633616444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616444, "uuid": "16e32560-7c24-48b7-a138-5f6bc2e1a0f0", "comment": "Malware payload (RaccoonStealer)", "value": "97a3e25844c4541b1e682a19a9dae831", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616444, "uuid": "29ca4c57-2764-4443-bb1f-ff12971ec408", "comment": "Malware payload (RaccoonStealer)", "value": "c52d24dc24c1cafd05297ae27e27dda206583220b0b5c5e518317043a3f4042d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616444, "uuid": "855731e0-7287-4dde-99a9-d214a641288a", "comment": "Malware payload (RaccoonStealer)", "value": "918e44b68c5adb924addbbeea6ea1e09d6da6a2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616444, "uuid": "f7c8f4a7-0f2f-46e5-a9d2-9f4c99133097", "comment": "Malware payload (RaccoonStealer)", "value": "50ae238b6f979878bebfdc396c7630aba77e0c762d1d9cfac6ccb7e1023da4a2e7564c6183067b64b8387d95075fd20e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616444, "uuid": "88caceea-3a5e-41ae-8a04-3540d12b6a0b", "value": "T167B4E110A7F0C031F1B762B64A7993A8693DBDB1AB3491CF63D516EB5A346E4AC30347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616444, "uuid": "06776e92-47fa-4c44-8b4d-32df8064e2de", "value": "104d9977f4378bb867ddadb6d1eb3d6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616444, "uuid": "f179374b-3d42-43c9-bba4-352bf6a4b6b9", "value": "12288:VBsq4nrQ2m3LWl3iXmyiaUqZhTQw7DZKCvMAplo7E42nN:VB6m3Y3iXmXafZhv/ZKCvnp8E4Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633616444, "uuid": "8774f128-bc50-48c6-ad78-fec44e1cbea3", "value": 495616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633616444, "uuid": "4614ecf3-026f-42f5-816d-bd0c361d96c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616444, "uuid": "7261b08e-bdcb-460e-9219-d830ac4271a3", "value": "97a3e25844c4541b1e682a19a9dae831.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f99700-273e-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633590942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590942, "uuid": "d727ac99-ccbc-41fc-8359-47f77af0fd68", "comment": "Malware payload (ArkeiStealer)", "value": "54f1655dee82cfacb6fc5182e0f0dd01", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590942, "uuid": "773c07f8-2773-4a6c-a05d-3f7889933dad", "comment": "Malware payload (ArkeiStealer)", "value": "c5a3d18a0bd8071a301dee8996a71293cf7d96ebdbdb15cc780e1b96f081eaf4", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590942, "uuid": "24922ad2-650b-46c0-833a-25ed90afda39", "comment": "Malware payload (ArkeiStealer)", "value": "96a22c7b5b8a7bb7012b29e3455a2ea0d49a4fe1", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590942, "uuid": "13ebfc4e-f9fa-4472-b325-62e017ff125a", "comment": "Malware payload (ArkeiStealer)", "value": "35962d835707d159b56e9f3b25d69f4a012aaf44a19849313a393ac11b8c5e0934b0498a12bc1e5d004cb863888e0a22", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590942, "uuid": "4df65e78-bce8-4a8e-aaa3-250b93d265b1", "value": "T1BD348D10ABE0C038F1B716F94979D3A8A93EBDB16B2490CF52C526EA56747E4EC70353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590942, "uuid": "a51de265-0849-4ae3-8cb9-d4fbfd7bfdf1", "value": "654aff1ee1bc89531bd3b96ebe76ae67", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590942, "uuid": "c4aba2f8-9058-4e83-aa77-7c9e2fc11478", "value": "6144:UQ5hWbBln6ofioGGtxSzM7ZF58+ad5rwpBxlw0:UQ50bBoofigt954HGBc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633590942, "uuid": "7bd5606a-5f6f-4061-979b-644c9dbcabfb", "value": 239616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633590942, "uuid": "9995ac8b-46f9-4324-91b4-747a45be15c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590942, "uuid": "72c51e41-397b-4ecd-896f-416ce0b26daf", "value": "54f1655dee82cfacb6fc5182e0f0dd01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78f29c7f-27ab-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1633637796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633637796, "uuid": "d7d44b50-8960-494e-bf24-ba72c109ddd0", "comment": "Malware payload (BitRAT)", "value": "c9453f8b5af95e6bcd98f2fcdc608983", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633637796, "uuid": "5dbdd8b6-eaf3-44ab-b518-3d18604441fd", "comment": "Malware payload (BitRAT)", "value": "c64277c8498973bf34a69cc49e24c771f20e39f8fda41ba2f48b7a0649b4cccd", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633637796, "uuid": "4a6711e3-9724-44ef-a3e0-1ebc8d567a3f", "comment": "Malware payload (BitRAT)", "value": "fc09119ee987a3a93df0c0cd62771e140f01d9f0", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633637796, "uuid": "15838de8-f52f-4d43-ae4c-3cdc048f3ffa", "comment": "Malware payload (BitRAT)", "value": "6d12505f443d12f12904c3c22e8b0d0746c72a4e568936f51585e089ccc6b6ce9f781fac3245674e245f5b4f1ea3297f", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633637796, "uuid": "0312519d-31c5-4715-93cb-946a582b02b3", "value": "T170059FA3E1E34033C07B197C8837563D84166E28F965B4927DE80F5ADF3A5163E2E25E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633637796, "uuid": "0bfdb17b-95e9-4838-8031-d6c42b4d32c7", "value": "63d793c7bfed8139488cc1a5c45be64f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633637796, "uuid": "15b81818-8fb0-46b7-8674-98e002947cd6", "value": "24576:lawOWWJ7S8YsUkkY7CE5L0S4PMGdMWEjI:llcJ1rj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633637796, "uuid": "b9dfbdf2-cc89-4113-acee-e9ec429ef2c3", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633637796, "uuid": "4dace71d-d700-491e-b335-5e95428a620a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633637796, "uuid": "a7bb83cf-09db-4d96-a965-e0b21834399f", "value": "Ipqluvevqqbngnzereppsbtmvdwtmguxja.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b414b75-2709-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633568141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633568141, "uuid": "3666c41c-52cc-4071-ba9b-37ad7a573a11", "comment": "Malware payload (AsyncRAT)", "value": "86e480a7a6bb028334079c5355dc2c24", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633568141, "uuid": "96e901d9-d29a-4bd9-81df-23581db935d7", "comment": "Malware payload (AsyncRAT)", "value": "c7cfd6eb7f84680ea18209845e54a70e7ab07accdf94a9ef5b7399a9181af92f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633568141, "uuid": "e7014bbd-bc09-4163-b711-89997f35555e", "comment": "Malware payload (AsyncRAT)", "value": "5f131596c600fe3999cdb71741e7d2fe76f71614", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633568141, "uuid": "f7ce7483-2d3d-4ddd-9426-f661e8e385b3", "comment": "Malware payload (AsyncRAT)", "value": "34437404a325a48eb5dbfa7162c62e3de08ce2d871ff621488479a34855a94187e3b4df7a37d6c2995a740a632f3fd88", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633568141, "uuid": "2d6a77ea-fc5e-4944-9530-72d3f5aec0c3", "value": "T15E95220636114207C5583A328BEBC5356736AECB3662D31E1EF07FAB397B79B865604C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633568141, "uuid": "f14079cf-1f9b-4e38-bf43-74cfa384b8d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633568141, "uuid": "b786c66c-8ce9-44fc-ac3f-9c159e306d88", "value": "49152:m8DMedQFSXPvm1e9zDhV48TBxZhAbywJH7cx/aZ:fjEH1e9z/4qBRAfJHUyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633568141, "uuid": "f1cbbfd4-4bb2-4ead-b911-7d13e30794da", "value": 1921536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633568141, "uuid": "d92b8ba2-fb10-43d1-8e98-8471f1c8bec4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633568141, "uuid": "d452236b-4c95-4ef9-bfee-65a0453c1173", "value": "86e480a7a6bb028334079c5355dc2c24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8f98bc8-2725-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633580431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580431, "uuid": "0dc78d40-8625-4373-8542-5120a01169fb", "comment": "Malware payload (Gafgyt)", "value": "9500d6fa3051769cf51b3596801176fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580431, "uuid": "f12dd191-5ec3-4be3-ad69-51f6d25a4236", "comment": "Malware payload (Gafgyt)", "value": "c7dd47b2c5ff406e1f249b73b19e1a311dc8d02f578215e5e5b80de2b57a048a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580431, "uuid": "38038c14-6ba6-4d31-aa4f-06eed7379120", "comment": "Malware payload (Gafgyt)", "value": "0510e5568cbe8a5937f6bddc2e2ccb466919a080", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580431, "uuid": "16c766a9-2fce-47c1-bcf4-d653f3728dd9", "comment": "Malware payload (Gafgyt)", "value": "68b190a0b0d930d922d1f10a0c5c0188b9043d6f39249dfe69b496d3e1c28c7836244deca4bec33bf7220fbffd855917", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580431, "uuid": "bb09f1fd-b6b7-437d-a9cf-186296c0b0c2", "value": "T179B3C517AB618FB7C85FCE3306AA450120CEE15A12E96B6FB274D96CE74B94F08D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580431, "uuid": "8a0dc077-6b84-4205-9ab2-ad560c2a7ed6", "value": "1536:yLeTsNZMo1HPM6vXfZscjIYzIIY4gyO29f0XIIFUmkiSFxfC7xbXe:yTPxvXfJtY4n6XIIFUmkiSFxfKxbXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633580431, "uuid": "aa63029a-3119-4841-b528-6e12ab271243", "value": 113275, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633580431, "uuid": "66cee882-f784-4702-a917-ad88f33ce34d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580431, "uuid": "10be09b8-a574-46e4-8748-d229cedf8e29", "value": "9500d6fa3051769cf51b3596801176fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f570da6-278f-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633625834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633625834, "uuid": "72b821b0-ef4c-4f8d-bcd9-c6e230e38339", "comment": "Malware payload (Gafgyt)", "value": "938fd49bd05e171c2d6a6cd77127c38c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633625834, "uuid": "72ad94f6-3967-4770-9918-5fef42463c76", "comment": "Malware payload (Gafgyt)", "value": "c810dea00f2c0d44813d8abb3ceae20e4766952c621befd9db42c59203536aa9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633625834, "uuid": "74c55cdb-b9b8-4445-a1d8-9a9f8bca06db", "comment": "Malware payload (Gafgyt)", "value": "37740be69514b27f614ad6d58dd7cf94396c372d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633625834, "uuid": "4f758702-d076-423d-b4ed-f07b6e9c932f", "comment": "Malware payload (Gafgyt)", "value": "dd7da8ebb3e92c8b95fcb4d0f7f88781481f24f612cf4f2cfb7255abb9b1823922f7e543a28666fd0a0102bcf90db30f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633625834, "uuid": "282b9601-84bf-45c9-8443-caf71fd902cc", "value": "T179B32801D5508B67C2D2277AB79F825D33332BA8979B33125A24BFB42BC27DD1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633625834, "uuid": "92e06646-fcef-4417-8428-d7cbbd5c89ca", "value": "3072:b6an17WtsWhdgYJJ0D6mbPbmTQOWsXAOn:Wan17WPJJ0D6ibmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633625834, "uuid": "9a06e6b9-52a2-4004-854a-83fd1fad3a42", "value": 111512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633625834, "uuid": "23ad784d-4d39-476e-a772-2a7a48df0479", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633625834, "uuid": "4160bd25-b967-4d05-9613-ceae969ba061", "value": "938fd49bd05e171c2d6a6cd77127c38c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6f80b8-2739-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633588651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633588651, "uuid": "1fdbbe2b-34bc-44b6-9c90-876e4e8d5208", "comment": "Malware payload (AgentTesla)", "value": "387120e11a76343f5c4724393effc717", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633588651, "uuid": "0f57c463-08b6-4763-80c3-8a9570cbb4eb", "comment": "Malware payload (AgentTesla)", "value": "c87bfef37ea4675415bab9f0a4f8019b9b9b468cf62ddb8575b4f5a9c2b9018d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633588651, "uuid": "5929cac8-e075-4c70-b88a-5acdd6dd42d0", "comment": "Malware payload (AgentTesla)", "value": "7f3d43f0fe2254a7c212e31d0f2091437f599f78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633588651, "uuid": "3e1a77b6-cb7a-440a-8982-456c6d8fbd31", "comment": "Malware payload (AgentTesla)", "value": "26db3d7332b5458ed7fecfba00efe782f754fbf4ebace4643c2bbfaf2efe47f1a542e6224d8d4c008ba94f3555903f29", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633588651, "uuid": "8a9c8875-06fc-4beb-a44f-3262b98c7bdc", "value": "T1A4A4E07A32A7CD01DE7242BAAC8DD15117BCB812216AC73E3E8E726C64127F94DD11DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633588651, "uuid": "99acbb6e-e7f0-4b99-a94b-4f55b1d4942d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633588651, "uuid": "af24fc92-eb8c-4bb5-8941-90905e25790d", "value": "6144:YsBkYiQ+3HwO/38h5bke30cSwGlGDcIFR+4rf2VEBTljLPpr2v2MF5cE7sxVkZc1:TDo/3I5r0cSwRQE5fAEBpjLMXwmsxVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633588651, "uuid": "8a11ecdf-88f6-4b4f-b021-2722dc87b7e7", "value": 468992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633588651, "uuid": "f55c0737-7677-4f83-b3ed-063e38bd47e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633588651, "uuid": "519d09a5-1873-4aaa-9964-1bd2c8081b3a", "value": "SWIFT MT760_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c7e70a8-276f-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1633612032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633612032, "uuid": "e303e76e-884d-4220-a138-d5bb7378ea40", "comment": "Malware payload (Gozi)", "value": "58f21c7dda3babf8bb6eeabb0949c496", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633612032, "uuid": "87ad099a-a376-4668-ae7c-f676f9b31863", "comment": "Malware payload (Gozi)", "value": "c88152c5a3a00f6bc9dbc4958659f7fb80b90c39a256fbc2e774a8c70affae1a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633612032, "uuid": "21f886e9-048e-40f9-9fbd-e68682346c37", "comment": "Malware payload (Gozi)", "value": "e967834ee1b6ae315d43ca8f640db4dba76e5a0f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633612032, "uuid": "05b6ce72-7b80-4ad7-b619-5e0d5c781177", "comment": "Malware payload (Gozi)", "value": "fe7feaacbdd59503eae5f939f0b2cbb4dca8b04b7054160c799b7c3ebaf0af760c8318633112d3d68ca1c0fc473dbdb2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633612032, "uuid": "88456aa9-ac4e-4eb7-91e0-2b5f0f3ca965", "value": "T13C338D4272D048B2C25645752540FBF6FEED877062B4E042D3234EE6ADA19A7EE7E10B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633612032, "uuid": "b566f886-51dd-4ac2-8062-fb5b0928f981", "value": "1536:WY/xJLCObwAbdZWdbkHbReQc1gMQBbyqlalXFPhLKW:WY/xHDbdWG8nX0byqlalVZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633612032, "uuid": "e3450e14-026d-4b3c-8296-a5b7b2e613e3", "value": 54784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633612032, "uuid": "4e4832c7-fc84-420f-849a-8cff05c8a810", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633612032, "uuid": "b31b1b5c-0fcf-49c3-95b1-96cbe642e6e9", "value": "50b0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d02631-2788-11ec-843c-42010a9c0014", "comment": "Malware payload (Lu0Bot)", "timestamp": 1633622765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622765, "uuid": "94932d7d-3b5b-4637-a361-43284554da2c", "comment": "Malware payload (Lu0Bot)", "value": "eabdbbed4f54eb08605adb641f11a959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622765, "uuid": "a8b53ca8-0aa5-4bae-bfe8-abc8057674b5", "comment": "Malware payload (Lu0Bot)", "value": "c88e27f257faa0a092652e42ac433892c445fc25dd445f3c25a4354283f6cdbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622765, "uuid": "e8fcbcb6-328e-47b3-b0eb-b8405cc62915", "comment": "Malware payload (Lu0Bot)", "value": "4ea99c58a7cb095244ae629cf03d378640a7f7ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622765, "uuid": "ede66741-3a7e-4c52-93f9-325a0560806f", "comment": "Malware payload (Lu0Bot)", "value": "84ec6a3717bfdeaac707699e7663a47fbd01de1b238f6ad5cbe9323954a405049b3ba3ae28d15be912a276a3e6ff4a56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622765, "uuid": "10c12270-9c27-4773-b277-b5e661d52f00", "value": "T16951DA9FD50C4C63D41D537A120A4188FB7E893287BA51797BB143AE8BF39B29D6C183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622765, "uuid": "cbce7fcb-80db-4a3f-b53c-896c9f42d19e", "value": "6545c6d8e3275d8af589e482d85068e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622765, "uuid": "5a151ff0-54ae-4a1b-9b89-0afa6606301b", "value": "48:6VsF1tO2BBMh2rsM91tO2wRCR9pCaGd4NrBS:JFL/IwsUL2CbQN4FA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633622765, "uuid": "3d65f14a-df47-4b28-8a7e-6805126b83db", "value": 2560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633622765, "uuid": "ae691f93-2d83-4e6d-8f3b-b45533b71b5b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622765, "uuid": "5e11951c-a6c2-4852-8aeb-91b2202868fb", "value": "eabdbbed4f54eb08605adb641f11a959.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1125eecd-2766-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633607986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607986, "uuid": "ae13ca5c-dcdc-4307-9a8c-ccd344e12377", "comment": "Malware payload (GuLoader)", "value": "9eb81ca2a4c102db45d988ee72685ead", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607986, "uuid": "20735a57-2db6-4984-b5d1-2a1e3265201c", "comment": "Malware payload (GuLoader)", "value": "c8f2ef8abbb849d937c356d6ee6055d5675ddebf8ce6d332eec8cc9249104784", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607986, "uuid": "b8a0f715-28ae-46ab-b26b-f29c024e6bbc", "comment": "Malware payload (GuLoader)", "value": "3c8e55b57cbe64ee123e524d9ec4248d6b4b43ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607986, "uuid": "ddc51af9-71a7-4e19-9739-096ad75b2443", "comment": "Malware payload (GuLoader)", "value": "07bf05b24f1b072765203641d3880ae616acfb3be44b5432d4e816d1e9256541184e476a7bbf1c3ce0e78312242aa1e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "SVK", "colour": "#3492BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607986, "uuid": "ca041b34-9e5a-4e03-aecd-205e5c23bca6", "value": "T16DE37D77B7518CA2E5A988350A97E822D08DFD12DA5E67B661C03E2D4E32DE5CC9070F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607986, "uuid": "ee4c172c-a3c7-46f6-98ba-cfad4d799275", "value": "7d08175a5c50907c8948c11ac22e7484", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607986, "uuid": "295318b7-fcf5-43c6-b555-a10b4f0abefc", "value": "1536:yvuMfB7mhCkwxs+to+zQMy33gaKBBeSiwRYh2cvieq2sS4NCkOD:/MJ7xHxhC+zTyn7KbYde2sXNC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633607986, "uuid": "bf602b77-e62b-4ed3-94f1-ffe47302a8e9", "value": 151552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633607986, "uuid": "188ee651-0b2c-45f6-aad6-01d963e2af6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607986, "uuid": "72be6d34-0766-433a-9e32-e2ba800da7a0", "value": "Zahteva za ponudbo 07-10-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4878df5e-278d-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633624830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624830, "uuid": "96b1746f-9f93-4e92-aa5a-2e2a336c7e80", "comment": "Malware payload (ArkeiStealer)", "value": "e058401b2b76d72d7f832400894f3a6a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624830, "uuid": "1a096bfe-f5e5-4f1c-94d0-6449982fb5b1", "comment": "Malware payload (ArkeiStealer)", "value": "c98d13466ad533382418bde81ca9699a8e066a1518bd65c101c7206e2b786855", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624830, "uuid": "b4ccccef-6612-4423-b129-abb72ca6f126", "comment": "Malware payload (ArkeiStealer)", "value": "48ff6d3fdfa3172f971a44292d12c83880b57242", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624830, "uuid": "bc54e811-b30f-4104-931e-4db0fc8f3472", "comment": "Malware payload (ArkeiStealer)", "value": "04a46bfa9e62900d567181b15e0e1f2251947c1319c1a49c0fbd00bd8c15ef3f9d0279fd110315fa7e24547980265f3a", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624830, "uuid": "cc2b5604-da81-4af9-93a3-d663876a61d9", "value": "T1DEF40100BBE0C035F9B656F44879C3A8B92FBDB0676894CB22C426EA56717E0ED71747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624830, "uuid": "f0e1e6c9-ed68-47f7-aa47-3c8461c4ceca", "value": "0d61443d5aeb8f94dcb0465acbd1f25d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624830, "uuid": "a2bbb428-bc73-4a39-9302-a2ba1a46b83a", "value": "12288:96zGFvzbvhf3uMdmtTF7cBzqdBu7xJss//xLGQvyuFCGaTK99qg:96zGFvzbB0tZ7IU0/DgQvyuj9/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633624830, "uuid": "7afe0dce-9c90-440f-8c60-1ac113ea379d", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633624830, "uuid": "7b0fb2b2-0965-4136-9fe5-5f1fd093093c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624830, "uuid": "e55eb3ce-a0fd-4ebb-a5d5-b4ef8d16a569", "value": "e058401b2b76d72d7f832400894f3a6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2bc035-273f-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633591258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591258, "uuid": "f742b5fb-0223-4e18-ae59-eaa78f578a1f", "comment": "Malware payload (RaccoonStealer)", "value": "fc0c12c2f0e2e457e25c88af6a714952", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591258, "uuid": "6779efcf-7110-4fe1-aed0-aab135531d19", "comment": "Malware payload (RaccoonStealer)", "value": "c9a0c77dce1e1f7e570b187e01a8a2e2c0a87e0c24d8b1345389775a42c9b35c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591258, "uuid": "7f822509-c4aa-483a-8fdd-f26671d1ba71", "comment": "Malware payload (RaccoonStealer)", "value": "1e212636c3fe395aa947bc4c1f4e5a25c86ba1c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591258, "uuid": "e82e9422-d924-4970-9d8d-6472b0e39f69", "comment": "Malware payload (RaccoonStealer)", "value": "b8dfdb3ad59f2109bbfc5d019649b7a592a16b2283ae37f16a8f75a30cb4bfe5b40335f6376a6b81a7c05cc229d172bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591258, "uuid": "23337870-e341-4ad6-a68e-b9ada4c42d7a", "value": "T1EEA4F1106BE0C031F4B712FA4A3693F4A52D79B26B2491CB629126FE9B746F4EC31753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591258, "uuid": "6d27127d-be3a-4028-a04d-118c9e39d35b", "value": "558186eb4208ff26294240429e60d1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591258, "uuid": "812e2229-5c6c-4153-a735-3188139be176", "value": "12288:iFguukFXayLx4iotC8HUhOWs7Ei++R/f1kxXAe4PCRwbW:iFwyLGCH5udDTfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591258, "uuid": "c9b235ec-1d3b-4be4-8a4c-6848621cf941", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591258, "uuid": "bf4cdca7-820d-4f8b-a7d3-5210b80c2b4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591258, "uuid": "3ca36dd6-c431-4801-9713-0f1c4357040a", "value": "fc0c12c2f0e2e457e25c88af6a714952.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b13ff53-2727-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633581025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633581025, "uuid": "3f4bf6d8-72ee-4f32-bce7-df5ee6269444", "comment": "Malware payload (Gafgyt)", "value": "06f04fdd4be62113b5799957405018fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633581025, "uuid": "dd396433-6aa8-46a0-a230-140ef1104073", "comment": "Malware payload (Gafgyt)", "value": "cb30dc1fe948574c7afbcaf911b2f7398d1d7fa4e803f7d4c51155edffab04a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633581025, "uuid": "808e5cb2-d660-4339-96a6-c20b7d04b52b", "comment": "Malware payload (Gafgyt)", "value": "0de05cf9fc691e2216f3c9f4dcce9a58d84f4cff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633581025, "uuid": "8ced80fe-163b-4ecd-aadb-3fac062f4f1a", "comment": "Malware payload (Gafgyt)", "value": "920e1840f7607b1a494e7d211c94613b22160f34ce718b0a37bc6306082e5b7708b189d90c8fc6f9eddb051305cc1154", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633581025, "uuid": "d11f2a4e-3e7b-4c9d-9e96-8548ba2c6f69", "value": "T18FE34A05E7408B57C1E2277AF7DB424A33339B54A3DB33099928ABF43FC27995E22516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633581025, "uuid": "f66f7967-0b57-4925-905a-9f453d4b1af2", "value": "3072:cNIka4IulYWH8Eat/3cRicno03M/98L1mpwfvRQfZn:cSkaLulYI8X3cccnoMM/98L1mpwfvaf9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633581025, "uuid": "db44391b-cb0e-46b1-bdcd-fa9be9f3df12", "value": 149793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633581025, "uuid": "aaeb2957-ee9c-4039-bb07-8779a7571735", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633581025, "uuid": "1b2d962f-0ec1-45cb-85d0-71b429aa4435", "value": "06f04fdd4be62113b5799957405018fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d7ce38-2741-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633592459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592459, "uuid": "2bc122f8-5d3c-436f-b156-cd3ed8c68856", "comment": "Malware payload (AgentTesla)", "value": "417878f397db00510d83b5ce823781d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592459, "uuid": "0b35271e-ebca-4a0a-9427-f5364430af16", "comment": "Malware payload (AgentTesla)", "value": "cb79e5ad8bedbc4a490059d2a155479269068404789335b852b5c4a244713168", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592459, "uuid": "6d6770ca-a25f-47eb-b990-d455ed69c7ba", "comment": "Malware payload (AgentTesla)", "value": "1e92c06c4b2dbac4ee9c89d78b98a0d7a58f6d14", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592459, "uuid": "b7374454-e74f-4996-bcb7-c59cbe7dc279", "comment": "Malware payload (AgentTesla)", "value": "c83cf5e1871e6a8e52cf4bf3efee70786481016ec3f2c31903bc54381b50466d40ee547f538afd6f99513c3c46e92f71", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592459, "uuid": "7b292860-2a61-452d-9ff4-3211cd65aa96", "value": "T1D684233BD42942884E79A3F476E25E3789881016A53DA3C36DAF66ED5D30C8DD3DB8C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592459, "uuid": "d08112fa-27f2-403e-85b8-f350b1b80e8b", "value": "6144:pq0SQxWwcBfax/uEZxLxDs7j70Diu6xcN65GRIs73HKzvilGu7f8aVYNnA7qFRf6:pq03+cx/uWxw7EDi9xcNveEqzvilfxKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633592459, "uuid": "d9a634c6-aaa0-4265-8c6a-5efb677d1e95", "value": 388056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633592459, "uuid": "11699641-70ba-4dc0-97ea-9b5c727da1de", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592459, "uuid": "f441fd3e-ad11-447e-9c4d-e1eefbf9d985", "value": "transfer.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435b9fab-275b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633603346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633603346, "uuid": "462a9f0b-edf9-4ddc-9a16-97c30474ab1c", "comment": "Malware payload", "value": "924daeaeb20c3bd422ef77950ab14948", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633603346, "uuid": "cd985203-4e12-4350-a154-232f5f4bb48a", "comment": "Malware payload", "value": "cbaaeed0df4f40e0ffeaa58c35dc0a42968b9a8c53491d459980375c58da268f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633603346, "uuid": "921f08b8-dbec-41de-bfe5-d23c6ff14fb6", "comment": "Malware payload", "value": "a0d81423af119a50840be5d1b7de55c6523173dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633603346, "uuid": "f1083518-910a-4c04-b9ea-91bcf570ed44", "comment": "Malware payload", "value": "f748cb347dc58cfda48332580dffd86e9fe5348ea8b94955929e2b66100afebba269f833c88ebb14a2478d03b24626c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633603346, "uuid": "dfacca2c-b850-484a-b63f-a54cd79338f8", "value": "T1AD636C861709EB66D17FEB3994B2554017FAF607D726FA1EBEC400EE06A3F414600EA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633603346, "uuid": "46574c46-052e-4d26-9a71-70502cf6f422", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633603346, "uuid": "ab3debfe-a97e-48eb-8220-e1b8719d63de", "value": "1536:BrTqToFNppdN3OmrgBmD4pt71NBx7Xx4tgwfiNPah07+l2pKXgkB2Y:BrTqFd7BpSSwfiNm07+l2pKXgnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633603346, "uuid": "b00f829c-46de-4f54-aebe-5965d282fedc", "value": 67512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633603346, "uuid": "97c600a7-a695-467a-80c8-7edf1654e878", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633603346, "uuid": "a1895f21-994b-49e9-9359-85aa7fc44c63", "value": "924daeaeb20c3bd422ef77950ab14948", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b998e7a-2766-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633608085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608085, "uuid": "d643cbbf-0d04-4902-8855-e0f0671c0e88", "comment": "Malware payload (AgentTesla)", "value": "9de9da17fa58ab6d0280f280d8140415", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608085, "uuid": "4970e2ca-279c-4077-973c-93ff8c0603f7", "comment": "Malware payload (AgentTesla)", "value": "cc4156391d24ec2164a96361858fdf6836cb26ef4c3f7fd38bf9e7ea1c7c3a43", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608085, "uuid": "536c3d77-ba4a-4706-bcba-f68c38d4f44e", "comment": "Malware payload (AgentTesla)", "value": "e8bc730b8ad6f61e26b0c79d54fcf4f3417ab928", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608085, "uuid": "71147ca1-2357-4917-b862-90e3c2a2cf48", "comment": "Malware payload (AgentTesla)", "value": "080d5e58bd686a7886cffa45db2143f07dde397e5ca8e595855c6c5b3d7c6c8c161fb13d107a6b06870c869089317b14", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608085, "uuid": "eefe363c-f01d-4edc-a2ad-c39636b21ea9", "value": "T150C46B9D325371DFCD27C9B28E982D64EA60647B530FC213A05321ADAE0D9ABDF541F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608085, "uuid": "fffd35ad-d140-4f47-a4fa-dc4bd6588245", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608085, "uuid": "bd3a69f0-3cbc-4b41-bdb7-8d272fcbec29", "value": "12288:BRLd6srzP7aBJVTiJXQcxOphiBtyhV8gxIBQZxG9cKH7l6CCU5/+aYo:Xhrz2BzTiaPpoBtyhZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633608085, "uuid": "af7efeb6-4114-4d77-9a9a-b885bd80a260", "value": 591872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633608085, "uuid": "08a0dd45-6663-442f-9767-9c4605578dc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608085, "uuid": "f5f6cc5d-aa59-46b3-abac-c1e0f47481c8", "value": "COMMERCIAL INVOICE SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed460ee-2744-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633593407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593407, "uuid": "621da9c3-b167-45bb-85d1-602390e6ea3d", "comment": "Malware payload (TrickBot)", "value": "24a582c40e3cc01a53c71d13a464a6ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593407, "uuid": "d99db5e4-e310-466a-90a1-38fd6376c617", "comment": "Malware payload (TrickBot)", "value": "cc70ac8b26533957b1e85c73a31e5a141b6cf7b73111a04e53a48ebf0e615415", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593407, "uuid": "a8a7aaf1-7f14-4a01-a113-fc2edb735e98", "comment": "Malware payload (TrickBot)", "value": "68613f1b07c90a0a1e948d3c6be75cd6dde0335c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593407, "uuid": "acb176ed-5ed0-4b88-a081-c44e3d956dc6", "comment": "Malware payload (TrickBot)", "value": "ad3317db777c32b15ce6ce8ced55beac6770b063d67e64e06e3be24667e6ed4725fd3ddb6926171f065255f4a7cd171b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593407, "uuid": "14a82c64-5ed2-4ec5-8ba8-e886ba73c44b", "value": "T192B4DF02B3C08836D66B227A49ABD71933B9FC204F65C38726C47E5F6E326D55E26352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593407, "uuid": "42da1881-cb95-40a6-acbd-0c18477ef17c", "value": "fd98f67a63ecc847a2028c66b8388afb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593407, "uuid": "ec8654db-e0fe-43c5-a7e9-cabea71ad637", "value": "6144:b3oOkxQXFDzaLtFD2aD3zAKit6lltqFpaI28VwPHK6+TDrAo0dThI9eq0NIaP:b3ExQ1DzM117qFp12iwPqvDr2VI9bZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593407, "uuid": "708e8426-7082-46d7-9bee-9dbb23c6f2ad", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593407, "uuid": "f135587b-9ef0-49a3-a280-c879ea39793d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593407, "uuid": "16360488-c2d2-4baa-b78d-79dcd9893c6e", "value": "24a582c40e3cc01a53c71d13a464a6ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428709c1-274d-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633597332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597332, "uuid": "b120fd82-fd00-4c6e-8da5-256032c7b098", "comment": "Malware payload", "value": "7c8518f835b3414b50fe1a90cbb8f6a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597332, "uuid": "2f59a766-2b67-4172-a1b1-224759066765", "comment": "Malware payload", "value": "ccbd4b60f3df31f3a7dc9bd1b1b9fba22be8ed3378b9c3ec7d4fc06fd0047e62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597332, "uuid": "b16f4194-4ef7-48cc-be7b-8f43981e6c0c", "comment": "Malware payload", "value": "d2b5b19e0ef3b473a2ca01a9711d49b71a7fb100", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597332, "uuid": "824f2231-508e-42fe-8b0e-305b44b4b395", "comment": "Malware payload", "value": "eb01fe1f9ec86e66bc12ed0c421e2d1845525cf336440466a7bd8419c2fc3059aef60caebf9b39eb6729bd6c3cfe7a16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597332, "uuid": "b7477cfe-2154-490a-b59d-ae03ee59890d", "value": "T15B63C5B7016295B6C5892334F4A11F0B367CD6341581F698F00FB2AEEC1D69E9AF83B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597332, "uuid": "539fad77-4e37-435c-8a64-e379f1d76208", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597332, "uuid": "d8fd9b72-dae1-452d-a487-0d5f36423e63", "value": "1536:ufOFM4/aN8PPLpU4n72/YrtgPTHMwGxU:UQl/aGPP32/YrqrHMn2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597332, "uuid": "ea4e22d4-1e3e-42c3-8f91-09a743557936", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597332, "uuid": "9adbf694-1b27-4c91-b33d-be5d3c529cc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597332, "uuid": "8194e135-dc7a-4aaa-8814-21eda08dc0a2", "value": "7c8518f835b3414b50fe1a90cbb8f6a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "426728f1-278a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633623531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623531, "uuid": "5fbb635b-7404-41e4-ad25-fcf2adce01dd", "comment": "Malware payload (Mirai)", "value": "5e727fc331b7f4b06cccb942d22c02fa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623531, "uuid": "17e9f913-d7b5-4070-9658-2fe36b9fcfa7", "comment": "Malware payload (Mirai)", "value": "cd119c76af6f7f1e83c70ae229da2f0a14efcb9705dbfd39046cb700a85b359a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623531, "uuid": "ae329cdc-0f9b-41f8-8f27-33019b4f8749", "comment": "Malware payload (Mirai)", "value": "9dcf83ae3807bf97a89d4ac86d02dfa10b764033", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623531, "uuid": "a11993b5-fb8a-495b-a1ab-5d83c22788fc", "comment": "Malware payload (Mirai)", "value": "6f7f25eaff75146133e113337f41ec5404a2f63fed40d56f81b593ae35b1ddeb995c437ae066e8f46e7d6f6003f60a08", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623531, "uuid": "69e97fa8-cff7-45bf-bd99-ebd8245f7c16", "value": "T134830641BC919A57C9D823BBFA2E018D372563F8D1DE3217DD125F20738A92E0DA77A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623531, "uuid": "3ba3856d-1aec-4e6c-bff0-60fbcf4fb7e9", "value": "1536:DKLCgAdazQfTZ70xQTY8xA0a2sfXGoWBTGxgGp2UV7Be0dZhd42+caV3:DKLCtvi8daZnOGKGpbe+Fy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633623531, "uuid": "ad66523d-cb15-46e5-a944-2d5f2df14ea6", "value": 87732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633623531, "uuid": "cdb7af5d-0ab7-476e-add3-68b30d075a9c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623531, "uuid": "29db0129-eabc-4c63-8d25-0f9d7833b832", "value": "arm-20211007-1618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff7fb66-2779-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633616225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616225, "uuid": "56603fe3-6c85-4af4-bb83-73e3d6141154", "comment": "Malware payload (AgentTesla)", "value": "7b5377c1c0344ee03d72343fa05c24a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616225, "uuid": "3104f02d-6ebf-4094-92b2-ab861f5cb455", "comment": "Malware payload (AgentTesla)", "value": "ce068647fe3bb9543ead5e3ddf985295d377e9266afe67c6458b86760bce41fe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616225, "uuid": "b181f0e5-9336-46d1-b395-6adfce6aa8d4", "comment": "Malware payload (AgentTesla)", "value": "8dcb06a50fc7d5ef75ebb4daac8b5102d0edaf8d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616225, "uuid": "2b58782b-fabc-4124-bb3a-61bdb6ece449", "comment": "Malware payload (AgentTesla)", "value": "9574fc316e447ad377eb26105374f0361da912cfb7937d983150124407024b7a968e70c7d9af72c7bd8212563eae6746", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616225, "uuid": "f7f4ad47-d3de-4ec2-b0ea-fa87e7c6f7ac", "value": "T1D1C47C9C725375DFCD27C9729E982D60EA60707A530FC213A02715ACAE4DAABDF540F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616225, "uuid": "c6864be7-6399-4be0-a522-9f11a3c50abb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616225, "uuid": "c0fbd397-609d-42d0-83b5-d30632c6d7d3", "value": "12288:SK6epOcelOrCQo/gRfKMA919MjUGoVHd9jm2zrB9q/F4BV4b0719kR84Eo:Zzeldyty9nMjUGODN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633616225, "uuid": "22aa83fd-87b9-45fd-930f-bcf3585ad3c6", "value": 590336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633616225, "uuid": "83a22a21-15ef-485a-ac8c-2ee91178260c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616225, "uuid": "df43f805-625f-4e2b-bdd9-19e05ca754ee", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fed4a4e-274b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633596549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596549, "uuid": "4ac127ae-4be7-4d0f-b0cf-dd59923e6c61", "comment": "Malware payload (AgentTesla)", "value": "1aaaaf20e7d6762466bb1368618c4ad3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596549, "uuid": "72c55807-f53b-4c8a-9977-c811bcf72a9e", "comment": "Malware payload (AgentTesla)", "value": "cee953d74f716ff3989605b8973d81e10521ef10206a60fc4ed1396fbd4f023e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596549, "uuid": "3af5b174-3a1a-40f5-a6c4-96e8959c9328", "comment": "Malware payload (AgentTesla)", "value": "fc17afb1c5017e9e7bbf600dd03dedb4cd821157", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596549, "uuid": "d8098c21-8241-4778-abf4-112d2c4a0c05", "comment": "Malware payload (AgentTesla)", "value": "1970d6769ac7c4c37962e2e48ddb708b46c5773027bf7e1cdb68b74732a7ddd6db62bc369f94c767f23be985ede4a0ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596549, "uuid": "7cd643f4-bdb9-4d16-9d10-381b89ea7f52", "value": "T1BC8423A2FDFAE89BCB0DD531B7EC232292E9C4516932CCF4C608D1E56253998C189DD7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596549, "uuid": "437db408-1062-431d-a2e9-dfbfd70fd6b4", "value": "6144:GvT9pUc06YkSqjKz47DTU0PD3cZlfAta9Ph/nQbXXakIpAJpPbY4daBN4B0h/R1G:GvTUF6AzaTU0PDs/oIIXkuJVE4gBNk0E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633596549, "uuid": "b2806a72-7e1e-4ae3-a587-d42be231c573", "value": 382666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633596549, "uuid": "afcc2be0-9580-476f-b5f8-afe6126853bc", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596549, "uuid": "cfb42e50-9a95-4a68-9fba-b80052f7a7fc", "value": "Purchase order.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14017af7-2743-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633592959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592959, "uuid": "0be579ef-5edc-464b-89e9-b8398112b34f", "comment": "Malware payload (Metamorfo)", "value": "33c066e7732e8a3a81abd74d03fe6834", "object_relation": "md5", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592959, "uuid": "01b8f8c9-5a5d-417d-9b03-783ab951fc3d", "comment": "Malware payload (Metamorfo)", "value": "cf4dfcf65913d0f26965461dd9fb4cdbc10fe592f73eb76414770b1868ce7b27", "object_relation": "sha256", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592959, "uuid": "09ed986f-8d24-4f12-a493-76b33083f327", "comment": "Malware payload (Metamorfo)", "value": "866727729781e38903fd1a225f9699fd1f297a85", "object_relation": "sha1", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592959, "uuid": "dd2a50d4-7e9d-417a-a545-58debea27b5b", "comment": "Malware payload (Metamorfo)", "value": "64c0d6d366790c56d5854260cfc674d51ecffe3a3b37d8ff4b136ffcd5f78c9f291fd3f4905131d31ca93e1c63d1a8a3", "object_relation": "sha3-384", "Tag": [ { "name": "BRA", "colour": "#74570A", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592959, "uuid": "fefd1501-003a-41a2-aedd-a9b2f8f5bd57", "value": "T1D531BE051EEB1729C3B7CE7A1077A2064A76FC51EE934F9D808497DA28A1050FC35E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592959, "uuid": "17003b2d-5eaf-450a-918d-762dc7fed887", "value": "24:8XJUHRlVo5kcbA+PAL+/P+l6z41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8XuH+M+oUiR1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633592959, "uuid": "277cc9dc-fcea-4d97-a27b-a2706904293d", "value": 1552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633592959, "uuid": "f5d5377d-c7be-4b58-84e3-b6690962e96d", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592959, "uuid": "8e55a1d5-5adf-43f2-9da4-0c00e48e1ab7", "value": "foto.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6e7de8e-2738-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633588561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633588561, "uuid": "3aafa434-737a-490a-a9b1-56fab7de8c6c", "comment": "Malware payload (Loki)", "value": "5e8caa7a1f4f84f3213b676bd7d405a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633588561, "uuid": "1cd9eea6-0ae7-4650-a8ef-e08d4f6e966a", "comment": "Malware payload (Loki)", "value": "d185732b8bb8690a03f8aaddad2a2222caeca398fa8d55dac47081ce4a184c19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633588561, "uuid": "f1ec5c56-5fdd-4e04-94df-3d1ce6fe4df4", "comment": "Malware payload (Loki)", "value": "1bbeac271076c5dfec23a8734da48d6a70763f92", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633588561, "uuid": "85a8b21d-ac15-45c2-af68-5737dc7a5f18", "comment": "Malware payload (Loki)", "value": "f1abddbe0731900bfb23ab20389755715e4faa1adbccb06efadadd5c2e0a7755651e0cb0d531a9337d7a61e69713dc39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633588561, "uuid": "826973dd-b60b-4468-87e7-42c7a8ccf53e", "value": "T1BAB4CFB67663CC44ED3453B2AC6E8C5107B6AC2A25B0DB3E259EB22D59733F204519CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633588561, "uuid": "494c3898-14b7-445a-8244-7950538f4264", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633588561, "uuid": "7afd9983-cc7e-4c04-9b67-46618566d3cc", "value": "6144:SQsf6BEQ+3HwO0RFvJwJj3E19hf722zhNJHI2BoIvogTQHunJh0k:SQm6BFo0RFvJ2j3E1ff7bzCjWviun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633588561, "uuid": "78f76f1c-5090-42ab-8e27-dae7fc7cbbf8", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633588561, "uuid": "3e64b9d4-6000-4a77-8cf6-6b939bc9ad50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633588561, "uuid": "203cb9e6-9775-4323-95f6-a2618b6a69e4", "value": "MV PLATINA TBN - VESSEL DETAIL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50ad35a9-2702-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633565143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633565143, "uuid": "cd9881a9-8601-4ed9-8d3b-0a5f94286f0a", "comment": "Malware payload (RaccoonStealer)", "value": "b667a738cbee285293f96b8932165eff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633565143, "uuid": "87254241-8192-429c-b114-5a89efc2b572", "comment": "Malware payload (RaccoonStealer)", "value": "d1b51a722c94b08f983caea11964e21e42bf1e6767fb1f64a669cd92c22766f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633565143, "uuid": "53ddd3ac-6d71-4f85-b895-c3784d07d66e", "comment": "Malware payload (RaccoonStealer)", "value": "cc9fcf60fb08a5fdeb6c68466e485836bbe5b9c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633565143, "uuid": "f1ddb345-a880-4aee-884c-d36126db7b21", "comment": "Malware payload (RaccoonStealer)", "value": "69d4eb2ae581d2e40649d78a64869f42d08df42a0476e0fc59ee3a08ca198091ff0f114ee5e49c2bf2e2ca12c9716ee3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633565143, "uuid": "447a5994-8980-4860-8f1f-488146293dce", "value": "T14E44BE2931C0CBF2D676C1706BA6C7F44F2DBC6D4E26564F3788276E2E383D5869124A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633565143, "uuid": "822645e3-1dee-473c-8674-45f44f065e7a", "value": "d33805713bf84c5172011e6ee58dcc60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633565143, "uuid": "d847dda3-d481-4fda-b18d-a94c26c48551", "value": "6144:k5FHzeL9bmAubu2KtvQsV0ROhxxpeTr/ekI:kF6hbmAuq2Kt4sVRzxp6L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633565143, "uuid": "20f8e1fb-cf1f-46e7-bf50-493d74f721e7", "value": 272384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633565143, "uuid": "e8111012-7c7b-4379-b17a-8690c67fe352", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633565143, "uuid": "965d57e1-76ad-444c-ad32-33cb3ecca824", "value": "b667a738cbee285293f96b8932165eff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52618634-2765-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633607666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607666, "uuid": "4224d94e-dde2-43c9-9db4-003ec6c5cc67", "comment": "Malware payload (SnakeKeylogger)", "value": "6d9d509b3d3d9fb742c86ac892a01c30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607666, "uuid": "52f38a0a-da00-49c5-87ba-eb7e839c3cee", "comment": "Malware payload (SnakeKeylogger)", "value": "d2798f7f25caa56c2a73c5810176ab9b012e9ac6c6f2397fce152933c5347be9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607666, "uuid": "57b7e46a-72c3-42c8-b018-955100e96966", "comment": "Malware payload (SnakeKeylogger)", "value": "8eb5dd24e2dd1d8f7f4189801f153a8e088b5d9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607666, "uuid": "cf8370e8-8233-4fde-901b-72e777cfceee", "comment": "Malware payload (SnakeKeylogger)", "value": "eab8f51b738dc2c58cea0f8f0361c8485e1e7e7ec2769bff4eca5b2bf242e56bb1b92feb36d3b69e0393fc746cd4b07d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607666, "uuid": "370107f3-af0c-4486-8b52-781fd9159392", "value": "T138B4025923674608CD3843F03C55AB602770E529286AD3785BD9F0FC7E627F98EE468B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607666, "uuid": "85a23ccd-7553-402d-810e-c298d481ea0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607666, "uuid": "ee9530b1-db9a-4792-952b-91b257d9c9ef", "value": "12288:VUtoIlJ6uW/eYFAXTDSSrhqqVqLjidS1qrz/4UL/D6tWj3:VUtwmYmhqDqdS8rz/TOtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633607666, "uuid": "41f55df0-aa3c-46c4-b80f-87e60273198b", "value": 505344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633607666, "uuid": "409fa094-3975-4e6e-b30c-de0fff22f314", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607666, "uuid": "3764aee6-d8c1-49a9-b013-551f2204c48d", "value": "23678876540200867.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "397146a8-2767-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633608484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608484, "uuid": "f34fa54f-5eb8-466c-ba46-70582fd9eb99", "comment": "Malware payload (NanoCore)", "value": "1d6c6ebc1c567d6c7e73a2fe7c04bdad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608484, "uuid": "aae03b92-cc27-4eef-885e-485e3b247c81", "comment": "Malware payload (NanoCore)", "value": "d2bab44593f0f81cd77f1cb289f8681f6f3fa334a1ce03c14e1c201012ca516d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608484, "uuid": "0e2d7f68-d86f-4097-ad71-6f7fc82685b9", "comment": "Malware payload (NanoCore)", "value": "ef794af7dc16273dc266c161871c78a49f409a83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608484, "uuid": "fcdbac34-6f5d-428c-8318-45674441a9b1", "comment": "Malware payload (NanoCore)", "value": "2efb0de325c0e3e7a2cc59663dfab32cd4762aef78ae892d82178631cbe9c97336fd3d869a5621a2d302e9d45d288a77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608484, "uuid": "f1d19e2f-1d21-4ea6-90ab-0761356ed41a", "value": "T19A3513027AC68472D57319325A397725BE7D7C202E38DB2FB3E0456D9B35191A238BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608484, "uuid": "0c40d77c-7505-4822-ac81-52c8eff8fb54", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608484, "uuid": "a0c90fb5-780b-4d8f-b41b-493c7ffaffa2", "value": "24576:rAOcZEhQ2+6cHuu73RgVZXDBlutXlQcmWTq6ai0bagi7vzJ9:tluL6VZDu9lBTq6d4a5vX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633608484, "uuid": "91262b18-3112-458b-94bc-21688a01a1ab", "value": 1077283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633608484, "uuid": "f52d7b36-5dde-4ea3-b8e9-3848b1ae1f51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608484, "uuid": "2dd7cab5-9a46-4ed2-b1b9-dc299e55364f", "value": "1d6c6ebc1c567d6c7e73a2fe7c04bdad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6666ada8-27ca-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633651079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633651079, "uuid": "40dd0c21-984e-4d37-b471-1c92095dd6a2", "comment": "Malware payload", "value": "742fc66a3efd92e5ff2ceb8b492806bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633651079, "uuid": "a71dfe28-faa7-4d16-9928-cdae3be68161", "comment": "Malware payload", "value": "d2c665be23d3672dff6f45b03fba09631461ed32abd9c285684c501f7b796be8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633651079, "uuid": "4f1bcfdd-5a97-4251-84f3-75e26491965b", "comment": "Malware payload", "value": "fcd6aefb7563ab2fe39d001fa12d6c6718733183", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633651079, "uuid": "94b54095-06b8-4c2f-9ee6-b89b4384a046", "comment": "Malware payload", "value": "7036b717c68c5b0767303500b3e3236d643b93bf258576febb9d0a1b6956ad87eae26af3fc1e18096b0cc0fb755141e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633651079, "uuid": "f4a3ef1c-c7d7-4eff-93ae-38cee886244e", "value": "T10AD402117276C03AE2BF56318E7963914BB37C659D3181CA1BB34BAE5E316A1DF21332", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633651079, "uuid": "baed81e3-00d9-47e7-a36e-f9596fdcf3a3", "value": "be06676f0b26f3557b735abbe8be48ec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633651079, "uuid": "31f52d91-e0fc-47ee-b9e8-4d670cf4f4bb", "value": "12288:GRtbJBYwqcXjAKyysvkzWbeqpWwwlBzgfeLgqJFEW:GRtAJgsuYBpWPW6gqrP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633651079, "uuid": "15c2d966-ad50-42d5-b69a-df024b10fed9", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633651079, "uuid": "bf56515c-c79a-4983-a9ab-55dc2a59043f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633651079, "uuid": "c4d421b7-e031-444e-8890-be7564e77727", "value": "742fc66a3efd92e5ff2ceb8b492806bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03438d6d-276c-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633610540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633610540, "uuid": "f293022a-386d-4640-9ebc-835cf82854a5", "comment": "Malware payload", "value": "98d19710e76791ac76e68a202de2a5b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633610540, "uuid": "849293a1-1b7c-4e4f-8c00-250758ad681c", "comment": "Malware payload", "value": "d3b2bf900c3386db36fc7918b16f2ed504a139efab724f3c7c219387be140b29", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633610540, "uuid": "6a3e357b-39aa-4f4c-93f4-cc922b99b7a9", "comment": "Malware payload", "value": "e342247b9a11cdac91e2980ae56624c0abe1334f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633610540, "uuid": "b65f85a3-39ea-45e5-9410-4b0682e4e156", "comment": "Malware payload", "value": "9a7506eaa9147d2510c0a98ff49d8c81061199cf7c078b04e99c143b7df32b4124bd480c6fc9cd203e7065e0a2b5a082", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633610540, "uuid": "d40fbeb7-4de1-43fc-bbb1-df84ebcba6bf", "value": "T14583C0A53B9982DEC1C3E8BAC85FD282CB646E191112C63B75723B447F1B797170BA06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633610540, "uuid": "437e1a43-83ad-40b5-85a3-f9eabb38535f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633610540, "uuid": "1c9d3869-2bbe-464b-a771-c9d0c2d7a035", "value": "1536:Dea+AJobV/Eerq1o1Gnvlyr+CwaMYONe+b3SFu1AFNGaX9ca:DegJobBcoQntK+C7VieM3SFZNt9ca", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633610540, "uuid": "8562b49b-f8bc-45c1-ac5f-de98d88d7842", "value": 82432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633610540, "uuid": "d5c22457-86f8-44c2-9639-b5510b784107", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633610540, "uuid": "24cdc339-94d4-4d8e-8555-c90f1886b17e", "value": "RFQ-467.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b3aace5-2775-11ec-843c-42010a9c0014", "comment": "Malware payload (a310Logger)", "timestamp": 1633614499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614499, "uuid": "79ffe4ed-b0e7-4f9d-a941-7816adff0790", "comment": "Malware payload (a310Logger)", "value": "ac6fda43023f6764756838ae94fd4582", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614499, "uuid": "75ccfac9-8613-4d43-a1dd-12ac990ea666", "comment": "Malware payload (a310Logger)", "value": "d3be6e0f0d5596c000d14f103f1c773002c934753bc21ebebdb1ee2a8882d323", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614499, "uuid": "b41437dc-76d9-4d71-9db0-ebd28ed03720", "comment": "Malware payload (a310Logger)", "value": "33a33252707d1b4f429113cb2fab9d2000923d5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614499, "uuid": "7cc10e1b-0a05-4578-8213-1af09d985574", "comment": "Malware payload (a310Logger)", "value": "46c8b6c4436bdd4888b0a53d09ddd69aef6307e1f17a7e26f0be7641d4a4acdd87e4e5e2c562d92a93c2df36161152e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614499, "uuid": "c51c4c80-c25b-4363-b64c-b0a94958c44c", "value": "T10FB21E12E298CA21C4B7763A5C6A86B80524FE4BFD539B5B24CC3F1F7EF23500752A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614499, "uuid": "7be2427c-4eef-4f59-98e3-0b827ff9478e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614499, "uuid": "2f54ee51-1908-4fb1-958c-902c0677a5a0", "value": "96:1a0iTMD0Gp0wShAnVN1t/VBJ8n9IRRZqP3bXeS7g6QKSTJf6/xoC0pfmUkTDLot6:UYrh/Vgn2RTqvKS7gfKSTw/xofNQIc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633614499, "uuid": "9350c5ea-b386-4bc7-b3fe-ed6ac8615f22", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633614499, "uuid": "825aba7c-3f80-4a01-b136-c2038aa19c03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614499, "uuid": "43ebede1-f1a9-44f8-b5b8-505f6602cbcc", "value": "ac6fda43023f6764756838ae94fd4582", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "436653be-27a2-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633633841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633633841, "uuid": "9c07d6f9-dfb2-4781-99a9-9464e84d3044", "comment": "Malware payload (RaccoonStealer)", "value": "9042b76e3ca96c0932163a5f1291ab94", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633633841, "uuid": "83940f59-92f3-40ee-94f4-743e038e1cb7", "comment": "Malware payload (RaccoonStealer)", "value": "d40c08e8f927017c98c6856c46c1d0c13184261ec34c4cfc3cad1cf91834897a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633633841, "uuid": "94108b56-9d0f-4ea0-a05a-cffa93d1bb87", "comment": "Malware payload (RaccoonStealer)", "value": "7e9763d7a2256d3a17a3feb1d8257731bf5cea14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633633841, "uuid": "9dea177e-5387-40f5-8e79-e6f6d30ac2ce", "comment": "Malware payload (RaccoonStealer)", "value": "5f7a4b1e59115f4fa422c618a8d7ea3e34d07582d4d9683ac12d6238d51b6818fc81aec5c4febd9f55a342696680021f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633633841, "uuid": "ea825ee5-5729-4e91-b148-482e5d1a3ff4", "value": "T13D1523714BC3D00CDA504F7A622AC74951CE0D60C9D6DD835F6ABAFFAD316C978885A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633633841, "uuid": "0f4972b7-4a4f-41f8-a981-0291a17a14ae", "value": "63ac7c2799723925dd310860701c20d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633633841, "uuid": "04aeec17-f1c6-4781-ab32-1681e4a6dd2a", "value": "12288:e0K8Ai7xx80P5S7/KFc8YFPx0YtuVTQGC6ayZq+LoaS0+w3/rB7uVPo5D7ZP74C:5hdSMcDVAV0GvOaQw3looXP74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633633841, "uuid": "6b423429-0d0a-4923-8c9a-b3dc9f81bdaf", "value": 916784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633633841, "uuid": "5025b3b4-1842-4101-a7f3-2bcde005e847", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633633841, "uuid": "1d3d67c9-97ed-4a0f-b4b9-62ed6cd6d40a", "value": "9042b76e3ca96c0932163a5f1291ab94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c48532d4-274f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633598409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598409, "uuid": "a7332671-2c8a-4c10-a65f-bf5713847ae0", "comment": "Malware payload (AgentTesla)", "value": "b10dd38a40cdb3c137e4717869226c2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598409, "uuid": "f9db90c7-a242-4a3b-97a9-490e3fbbd879", "comment": "Malware payload (AgentTesla)", "value": "d43f8c736bd68c607021e9867d0c2e942b94bb1e8a5c5dc9804f9109148b21e3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598409, "uuid": "e4db12a3-77b0-4557-82f1-e4e601e41082", "comment": "Malware payload (AgentTesla)", "value": "c2a13f2ac55d617f6e3fa6953affe9cdc2437e1b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598409, "uuid": "9db224a0-bc6a-4a2b-95bf-6fe9bf493a07", "comment": "Malware payload (AgentTesla)", "value": "11e4ca7284eec11fece281f848adcede91ac1381d7f90616480fcfe462bcd7944521410bc01beaba78899dc9645aecf6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598409, "uuid": "5e2af3f4-283e-495c-b2aa-17c7d8ac95a5", "value": "T146A4F16813734308DD7847F12958A7622775A526206ED3380BE9F4FD3E72BFA49E0297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598409, "uuid": "6f1ce268-8882-4372-8703-b0aa6e012060", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598409, "uuid": "1af4c461-73dc-4f38-96fc-a431619056ae", "value": "12288:TokoJBPXS6wW1wOguznRuEma9AZy1KSrTWeslZjv5ju:MkiDguTRvmpZy7Pxslnu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598409, "uuid": "02fda19c-0ddc-4240-ba09-57c59f59dbcf", "value": 453120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598409, "uuid": "609b1301-3f15-42ea-9b70-8572a7f2e369", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598409, "uuid": "b34f53a4-ea2d-4237-8658-8b65c0643bbe", "value": "b10dd38a40cdb3c137e4717869226c2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd89bbc6-2784-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633621187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621187, "uuid": "29b3238a-3af9-4884-aa3c-e120b47e832b", "comment": "Malware payload (SnakeKeylogger)", "value": "f3c0f62120af98975b3175ae32eadb8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621187, "uuid": "4a74c6df-9b99-4d27-9361-c37ec2369953", "comment": "Malware payload (SnakeKeylogger)", "value": "d47fa565c642f6be70942d8325035372f35f61d5f9056595672179d23498368b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621187, "uuid": "9a63114a-4c70-46e5-af59-4e6077ee6860", "comment": "Malware payload (SnakeKeylogger)", "value": "3ac8fc9cb9666b0eae4d6b76ac41dc27f72c8ef2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621187, "uuid": "044835de-c2de-4df0-8ae8-65802cd295d1", "comment": "Malware payload (SnakeKeylogger)", "value": "29c3fb2379110b347d1c4b0bee043b3a0546c5f432148cc7d387620129ac08204b07cfc8d7b656136fc0fd4e3299e02c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621187, "uuid": "54ed5eea-4a30-437a-b512-e848dbebf9e0", "value": "T1DA25E5002295C701D1B637F4D860CAF097656D15DA29C68B2DF1BEEB79B1B03CE11AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621187, "uuid": "a6cf1b28-5dd3-45e9-b4c8-473ebc0fd7d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621187, "uuid": "6cd93be1-922b-403f-bd0c-cf67337c2b7d", "value": "12288:zne0KRDyL9pD3n+0SanGjpiwE3ZPnFq8XJCHhpbO:TGR+L7D3+1aRwiFVkBV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633621187, "uuid": "d67c9211-6df1-411b-b361-14855f757b56", "value": 991232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633621187, "uuid": "43b0187d-e228-42db-a64c-c7f952c14cf5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621187, "uuid": "6d4a6271-8acb-4025-b4df-6c0cc1738f00", "value": "PO139527-2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b54bb79-2759-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633602420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602420, "uuid": "372cb83d-ee71-4cf6-9abf-8bbbd55efc6b", "comment": "Malware payload (AgentTesla)", "value": "2e6f34e12d7cc3459c549a675e4830ad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602420, "uuid": "4e59740e-52d2-4c97-8fae-725ddd6f2d27", "comment": "Malware payload (AgentTesla)", "value": "d504a9984da543a8ea1904d55aee911590b2635ea6da7e88d118acbf9aff2e79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602420, "uuid": "e3695772-93f4-4e4e-b5c9-0e0d16036be8", "comment": "Malware payload (AgentTesla)", "value": "3d3c302e894f399435dd5e466bbb6a7b122a33da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602420, "uuid": "dbe20985-7143-4dc9-9029-327494597f88", "comment": "Malware payload (AgentTesla)", "value": "e0243688d401930d5ea048bd400b4555672a9ab6e7b05d02f0e9887877db928a28abadc9bd21424300d5e9a4e5ef55b0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602420, "uuid": "f5fb3cc0-5abb-4c10-877f-9ad9b43145f4", "value": "T1149402B92327860BCD2486F53C20E78163F4449129A6E3B44CA6F1BD7ED6BFC9DD0196", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602420, "uuid": "957e45d4-fc38-4d44-87d1-2562c2383a97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602420, "uuid": "0607dc37-6b3d-4039-bdf2-0e8399415771", "value": "6144:HJyWdBRegQlEpICKhT7N8mNXQd/YDNftc+ozVhKJMs+rsDd/0ky/knE1jOkQ+3H6:HpZkT7N8oeYOBKkrsDrE1yop3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633602420, "uuid": "fcc34272-5b90-4b1c-9ba2-fe742d45e9c5", "value": 445440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633602420, "uuid": "af9cf3bd-100b-4e62-9487-deb19e7d0902", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602420, "uuid": "50d7e422-29be-449f-b7dd-a884ba0a8224", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daaaf199-2765-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633607895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607895, "uuid": "66b380cd-9e5d-4e75-bb5e-c8a56b37f124", "comment": "Malware payload (Formbook)", "value": "59ad493c574e19a8401ffe35ae5f09db", "object_relation": "md5", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607895, "uuid": "137f55f2-dfbf-4033-8d10-ee93eeb0fd4f", "comment": "Malware payload (Formbook)", "value": "d54e341578828a215bbe78db4f2dc64a5388d4ce3bc7d6488f7bafb8c6b02d1c", "object_relation": "sha256", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607895, "uuid": "ace9eae5-61bd-41e4-bac5-5cfdc92c7e3b", "comment": "Malware payload (Formbook)", "value": "2c6d484c97e9b16958a768aa0599ab1905eb809e", "object_relation": "sha1", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607895, "uuid": "aa06bc50-ae5f-49b3-8249-00b008657799", "comment": "Malware payload (Formbook)", "value": "97aaee422cc9a210afad47ca3d1aa2453d584f0b258e364db5e3f4e0731849a80b1735bbcad75fe944635439437dcc5e", "object_relation": "sha3-384", "Tag": [ { "name": "ESP", "colour": "#8CB8DD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607895, "uuid": "fe776716-7028-40e1-ab40-b56bcc2ee24a", "value": "T1739401882277874CCD7847F02825AB912736912250AEC3BC4BE8F0FD7D63BB599D9197", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607895, "uuid": "0a76f91a-f881-495a-a9a4-c3de5b1b00dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607895, "uuid": "5c9feee2-aa72-4e24-b8c2-4a83f6760b44", "value": "6144:cm9ZUDQ+3HwOZs8wyQAhwE0OkYkRI2Rdfq4DbBrEt77PeoGZbzbk6WhzL:SkocyQYLxTk1/f3bO9Kb/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633607895, "uuid": "40d419f3-46ed-42d2-a0e5-4f6c8f5fd71a", "value": 427520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633607895, "uuid": "4f0238a6-ce3b-4ba3-aec8-5c3c41224635", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607895, "uuid": "d9cd4c33-7d18-4625-887c-db1cc8d46207", "value": "detalles del pedido.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bbdd95-273a-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633589225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589225, "uuid": "2977e6ff-5ec0-48cd-8f63-9b34ebc810c0", "comment": "Malware payload (AgentTesla)", "value": "4d0defce8fe8f642fd223749f7bb7731", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589225, "uuid": "46ab6776-5d5a-4dda-9724-c7141f619964", "comment": "Malware payload (AgentTesla)", "value": "d55058cb53b44c6372ef7fb902fcdb305ab3778229f12a1e62b0c8d05bcc9791", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589225, "uuid": "63ab9e0c-8231-41b8-9cda-b65e193b6356", "comment": "Malware payload (AgentTesla)", "value": "4437c53d3d0f1697b910be1a07c63b56607e2da9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589225, "uuid": "efd1756b-3445-46b7-9491-f38beea803c7", "comment": "Malware payload (AgentTesla)", "value": "f7a93949cd3e93636b15640304d3dce95b109ea4e4770bd3787d892fe471249617b50b91ad85c4adb4b9a6075c6a8ac2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589225, "uuid": "a99007b4-2bd0-46b7-bdce-2189dcb92072", "value": "T16A35745363AC8DC4C06792B4DFC5C4B96C19D9EE421A53B4AB12AB60F79FD030E6A473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589225, "uuid": "d11e3ca5-09a5-43e3-9144-014df560cbc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589225, "uuid": "060dbde0-3527-4d4e-912f-596b0b359643", "value": "12288:4HUcJaCaxlUzfpezgydWv1d4i+PlmCeUhkvkJ5d1O:+UcMC6zgydqL4/lp1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633589225, "uuid": "e5085e99-8e35-423d-a05b-8814e5d0e325", "value": 1080320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633589225, "uuid": "6b8b8dee-749f-4bea-aa23-abb26656a069", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589225, "uuid": "541ad555-e2d3-47c7-b54d-c7ef88d4da92", "value": "TT copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097b24d3-274e-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633597666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597666, "uuid": "3385c9a5-c29a-4cda-b9e7-d56f4defdf91", "comment": "Malware payload (NanoCore)", "value": "d0306e1fbf67885a13a8bcfdd9de2873", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597666, "uuid": "fc64a63a-6706-4f31-afc1-17a60c7d982d", "comment": "Malware payload (NanoCore)", "value": "d5d407ae895a78d590246ab7fff43041c310601b443d4683a94365c9015bd0df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597666, "uuid": "7cb3e445-9971-47bf-b8c9-239db29ff6e5", "comment": "Malware payload (NanoCore)", "value": "9f67edebd14740fbbeca2ebcafed44185b153aaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597666, "uuid": "13224fea-2c7c-4942-a70e-e8c40009d9fd", "comment": "Malware payload (NanoCore)", "value": "09eea1459defabf4947a7f63f09d67a04f270f75ff1c20977ba9ca00cea6fa10f6062c735b570b69d84e5913fff3372a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597666, "uuid": "3eb5f3e7-99ee-49d7-81de-9fabcb6a7e5d", "value": "T1F8251202BAC58871D4731E365639AB256C797C202F249A6FA3D049BDDB391D1A338F73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597666, "uuid": "a9fc4122-3a2e-426d-9697-20602813f527", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597666, "uuid": "ac95f01b-f06b-4226-a168-816e7c4385b8", "value": "24576:rAOcZEhQ9m89IVfcYlaVGo/VK+j4ts11H4gnTq6ai0bagi7vJcn:t/8GVfTEVbdzfHRnTq6d4a5Sn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597666, "uuid": "8a23cd65-164e-4c2e-b305-c99cfe9daee0", "value": 1057104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597666, "uuid": "da35b76c-b986-4771-a3c3-ca252a869ff2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597666, "uuid": "2518a153-177b-4bf6-8cf4-10e13375b6b0", "value": "d0306e1fbf67885a13a8bcfdd9de2873.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b54ce6-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633597305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597305, "uuid": "4b043f8a-f864-4824-96e3-411060b883ee", "comment": "Malware payload (Smoke Loader)", "value": "de96962f34913e1367fd4e01652098f0", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597305, "uuid": "1913af21-9b13-4091-b072-4022dcaf8209", "comment": "Malware payload (Smoke Loader)", "value": "d5ed08706a154a3b7ad0ea8ea50e03b2b21ac8ce1ea699d5759c4220918a8b5a", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597305, "uuid": "2017c200-3f9b-4967-8f31-a55e65606b1b", "comment": "Malware payload (Smoke Loader)", "value": "ee8c6249a93e840acc3a0116d489f99173164537", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597305, "uuid": "7acca4b9-57a7-4b4a-9377-d4a7b5275d3b", "comment": "Malware payload (Smoke Loader)", "value": "d4398478449faea740a8b9aab68f1cc92941432fea84fbd8892e6f7e0dd26c1b501609d790fe69d4e7449a8d84257b0f", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597305, "uuid": "153bec32-2dce-4f9f-a1c3-d3fb2209f4a0", "value": "T11F149E9035E6D472E7A31E307971DBA14A2BBC627B31918F1F9C167B0E3C6E1866530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597305, "uuid": "4f71cdd8-4664-415a-9022-79e127c18b9c", "value": "51f224c09b57224d474ba4b21025bdd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597305, "uuid": "451c971e-368f-4671-8db9-2f2fb485a477", "value": "3072:0IYL+iGXfl+ErD442bLsPFXRvbtnQWBj7fmxpwoJpz:0IYctz442bLsPFXvRBj7opDJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597305, "uuid": "17de8e0b-0d28-4842-b919-3143e9653ae4", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597305, "uuid": "7cfa30e2-039c-43ab-b60e-93b579b0405e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597305, "uuid": "109174ad-aef9-4e44-a7b5-0e5e8b432b0c", "value": "de96962f34913e1367fd4e01652098f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a50a9f0b-277e-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633618542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618542, "uuid": "c205f1c0-83c7-4462-a04f-e38a6d2d1630", "comment": "Malware payload (RaccoonStealer)", "value": "9fdefabf1778528c61a86aaa8d7cec11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618542, "uuid": "1753c9cc-c79a-484e-8d3b-dcd8e141ea0b", "comment": "Malware payload (RaccoonStealer)", "value": "d64c1bdf012a8eef91a124ff9fb6dd72a73bd01a0a091b9a035dac1a732643bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618542, "uuid": "84f90236-de78-48ff-941e-e15cdfa8e317", "comment": "Malware payload (RaccoonStealer)", "value": "2af8a7eea3a070c3d4ffb88fc21ada738bf619f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633618542, "uuid": "968c2c1e-ca2d-4b0a-b6e5-a8bbe6da8571", "comment": "Malware payload (RaccoonStealer)", "value": "cc818020e531a7e184c2101a34ac5562e28166f69a3a11788111fa89c03dfd40aa4c72ff53da1da30db17bda559c717c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618542, "uuid": "ea2be9d7-c9b5-42ae-a41c-48f2127c1a78", "value": "T1BBB4E100BBA0C035F0BA56F849B9D3AC793E7DA16B3894CB62C516EA1B356D1ED70317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618542, "uuid": "7c839207-2ac0-4a57-96b2-a8c1c5b7a69a", "value": "c1d211268d6c769cc59ffca0e56e63c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618542, "uuid": "198e7911-2c87-40d8-91fe-31cf61f01de7", "value": "12288:Dg3nv+DzjoOK0HOpapRoyuCqyBLelFdj9k:83W8H0HOpSoysRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633618542, "uuid": "cd73fc9e-32d3-4cba-bece-d1718550daec", "value": 540160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633618542, "uuid": "b684c8da-bcb7-42f5-a78e-e1cea3b597ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633618542, "uuid": "6b300b9e-ab11-446e-8b10-d990210d252e", "value": "9fdefabf1778528c61a86aaa8d7cec11.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd87610-2765-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633607662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607662, "uuid": "cb9a9c3b-8f7c-4a83-8a24-f237561add18", "comment": "Malware payload", "value": "b6bb227909f47ba9e84dfd185761b494", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607662, "uuid": "dbfc68f7-71df-4142-bb01-e7ea4c3fa978", "comment": "Malware payload", "value": "d6bd9bd06afd6e3464c43547fe5c41de9702c44cc21b765cf8fb41eb365b37dd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607662, "uuid": "98b58e38-9daa-483b-91b1-d52f3c8ceb68", "comment": "Malware payload", "value": "c8a8a5b9399533320ee646e3ce1ca30ad1251fe6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607662, "uuid": "9b36d52c-9831-4c84-b2d6-e28839bfa6f3", "comment": "Malware payload", "value": "7e4a708b34c4541d6440e7e15b301259477860e7e9672cbac310a07ab4909c3388be9712ab4441e21a95aae90322fc71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607662, "uuid": "d2bdf919-0d22-4b17-aa7c-4e919f2ad77a", "value": "T1EE45F1386202BDBEC23BEE7C84545A5D0C944C0716B394DCBAC96AED9475634B8BCE3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607662, "uuid": "292899a7-87c1-440f-8958-435196102683", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607662, "uuid": "038f57e5-4f87-45be-a554-a927380ba92b", "value": "24576:CRM2M7UrvD+8HD32qXCcKHBf7zNbM6gCkA/J9P2L+huWwn:bQvy8HNgGH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633607662, "uuid": "25e76f50-a2fa-43a5-9ef2-3d03984c7d12", "value": 1270784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633607662, "uuid": "22262a82-feec-45fd-bd02-2f725ba6da23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607662, "uuid": "0efa6d65-8f2e-4054-9123-a172fca997f2", "value": "GT09876545678.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db33d557-2784-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633621210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621210, "uuid": "269c39ae-330e-4d04-8a47-6127e6f4f32f", "comment": "Malware payload (AgentTesla)", "value": "324187e720f471743b1a278859775dc5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621210, "uuid": "25d1b82b-5e35-463c-928b-478d5907a14a", "comment": "Malware payload (AgentTesla)", "value": "d6fd9901bf6d8129508caf3175421ed37533f76d904a931a4360e93fcd600f19", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621210, "uuid": "9fbeed67-5fae-433c-b7fa-70ec5f045615", "comment": "Malware payload (AgentTesla)", "value": "22b04e88d588acd02a00e3a95543318f946b366e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621210, "uuid": "5c5ada3b-9b66-4ae7-aa8b-6d83e256c52e", "comment": "Malware payload (AgentTesla)", "value": "f52393dc8225ea28e008c8a1e1547d7a8ccb19757861f76d8424976bcae348829fae966cf1e359fd530a2e5da9a03c2b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621210, "uuid": "abf59b30-427c-4157-9df0-14afc7472b4e", "value": "T18D642217B1062B53DE53FE3D3D8AA6C20B4EEE753F0909AB9503BA76063B3D35482524", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621210, "uuid": "817f9025-baf2-46f3-94d1-6f46fb6baf3b", "value": "6144:Lja2WIpNeGNuHxo/4oWDNKY5ptGYaaUyU3lvj5o++TxTR2ui7G0YAWIVwCWgj:ovGNsO3WDNKYvcBaVov9+ThEu+WgFW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633621210, "uuid": "c1a515db-fce9-42d6-82b7-b333dc72352a", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633621210, "uuid": "9aa6480a-9fd0-461c-9149-1a79f33a99ba", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621210, "uuid": "1ceff914-71fc-4e86-86fa-54f4902dba40", "value": "Purchase Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "290a9986-2755-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633600725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600725, "uuid": "491b8263-1188-49b9-afa2-465aed5ffcf0", "comment": "Malware payload (AgentTesla)", "value": "8a8e6ad5fc973531255865679ad826d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600725, "uuid": "305b4ca2-6aae-4434-b984-70cd87b77f82", "comment": "Malware payload (AgentTesla)", "value": "d70f9fd7b16c139c991c9f6c2337851e1f00399e1763b34f8bf34246fe88b860", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600725, "uuid": "75117480-6879-48b5-9d83-3d2d30017482", "comment": "Malware payload (AgentTesla)", "value": "4db9a9d0b935e221c520de300f8c6950ebf4aa9a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600725, "uuid": "5fc61a1d-76d3-4084-927b-dfabb05fc986", "comment": "Malware payload (AgentTesla)", "value": "4015c0ce5215ad738bca9cfdc8a4c83f632c959eb964955b3b785402bf5b6c5dcf90869249ddbaceba2b8ceea44a9e5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600725, "uuid": "613313fe-b2d1-4854-9c6b-f5046d0dae2b", "value": "T19E45F1A8632B5604CEB843F42D25A7911336E415616AC3383EEDA4FC7FA77B48AF0547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600725, "uuid": "3b4f3e98-9dda-4e8d-93ab-f4337f25af2f", "value": "6144:hM08gZXDQ+3HwO2Dtgt14RYbxuJxsT4LFNsofRnfkJGdVcD50mEcsoiYn3IUT9nj:lkoefRE0xsYFNL5sJAcN0mE/Kri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633600725, "uuid": "9521f61a-3d3d-4d05-be15-2f5eff19191c", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633600725, "uuid": "4f8b12b3-96a3-46e1-b9fd-91eb0370d853", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600725, "uuid": "8db09e33-4479-4576-a4d6-a2f1a203ec9d", "value": "Reconfirm Remittance Details.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8edef45a-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633597460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597460, "uuid": "48f0f485-2058-4da7-a152-9eba19509186", "comment": "Malware payload (GuLoader)", "value": "b020a022ff4657890058a0f2b70c4019", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597460, "uuid": "c9f00570-4f5d-4f08-a97d-9a1310104aee", "comment": "Malware payload (GuLoader)", "value": "d7465d6a86cfada92799826c698141f399668e641c8591225c47e7686ce28320", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597460, "uuid": "0eab0710-7540-481c-a7c2-a9e4d8e798d2", "comment": "Malware payload (GuLoader)", "value": "c43877ca54fe0a97b41bbe9a3e9e77090371987b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597460, "uuid": "dbfd0ca9-1977-4db7-b53a-ac1f6a728cd4", "comment": "Malware payload (GuLoader)", "value": "5f8eebf3b8059b202c29b501876e6503cfee65fea181cfff7bbf44d23f6fd8b28e2841645817bfb10428301a763aa0fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597460, "uuid": "6d2cac2c-22d7-4ed5-b34d-e2efb5c8e722", "value": "T14D743C936871C628D5BE8371F920D5F52612EC620475F91B65E8FE633B3A3DA0C48E4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597460, "uuid": "aa489967-3547-4442-a4bd-487f163f49dd", "value": "245400c685ff7f808270dbeca565e807", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597460, "uuid": "eacd2bfd-b47f-4aa7-a291-bec9dc1d11b3", "value": "6144:AG3NcAWqBIGGvF6GGLTudffBfEfBfBpZtCGGGGGGGGGGGGGGGGGGGGGGGGGGGGGZ:Z3nB762", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597460, "uuid": "cd85329a-79ae-49e6-a511-9816d943bc22", "value": 366014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597460, "uuid": "ef958165-9559-4e2d-9498-d3706ded05b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597460, "uuid": "0410e37f-d707-41c3-8fdd-5c5ba0308a6b", "value": "b020a022ff4657890058a0f2b70c4019.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce0c47b9-274c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633597136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597136, "uuid": "ba395637-c330-4953-865a-386a8b80154e", "comment": "Malware payload (RedLineStealer)", "value": "bdbe710ad7a14be139d1a51c1187f1d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597136, "uuid": "68756942-065f-47f1-9be6-6a2f2f23e4b1", "comment": "Malware payload (RedLineStealer)", "value": "d8422e68f6bc3b3564efac25e147168494be5cacfb3d1695945f9935fb1045a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597136, "uuid": "4c482f48-8096-4bc0-8adf-36c18ecb7119", "comment": "Malware payload (RedLineStealer)", "value": "c4f129b2829c1bf66df3a2b15dd999aadcc4abb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597136, "uuid": "9f5adbc6-f68c-4640-9889-e0df65afd3fd", "comment": "Malware payload (RedLineStealer)", "value": "c3a9e0cfcbf6ee513b307ddb4cf735576095f9eb8932365b68d1b4e4b74a6780cbd1cfba08bd82b0dfbbaf42d69aac74", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597136, "uuid": "0dd6ed0c-8457-4ea6-b609-9ad762bb5e16", "value": "T1BD54DF1131F0C531F7A75A3049368AA54A7B7CB69C70A58F2BE4266EDF722D29B24307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597136, "uuid": "41824fe2-3bec-4a88-8a81-af026d881641", "value": "01c64e8a0bf942eae9e15adaebb52144", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597136, "uuid": "54ee3848-1817-4137-ad4f-3a2044d95a0e", "value": "6144:/Ry7rQW58XN54l6TJsGK3pFCMP1oijNdEWCOY5z2Rr:pOrj58XN5HJspCwi6epOYZ2R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597136, "uuid": "4613f768-8698-4f0c-9f76-3d355641433d", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597136, "uuid": "cdcfa8c8-f113-442e-982b-860c9517c7b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597136, "uuid": "876538ff-b374-473c-9327-f4a395655b26", "value": "bdbe710ad7a14be139d1a51c1187f1d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a510e623-2781-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633619831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633619831, "uuid": "d02ba8c9-658d-430e-b11d-59c4b57e41d2", "comment": "Malware payload (AgentTesla)", "value": "0ac928b1a06e8d6599f934d425973507", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633619831, "uuid": "b5694aaf-6ffd-4324-8727-c6c593443a31", "comment": "Malware payload (AgentTesla)", "value": "d8dd45454431ec17082e488a9d83ed5ff24ae19a478c818e9855d1856f9d8f16", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633619831, "uuid": "cbb7c02a-b4d9-4b51-b4aa-42d0975a89a9", "comment": "Malware payload (AgentTesla)", "value": "0a0475536b53ea5e31d132ff6f19e90ee3db6da4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633619831, "uuid": "05b7a265-fb3c-49ad-b4c7-6b831338296c", "comment": "Malware payload (AgentTesla)", "value": "7d6a42e1e500ca8a7db48ffd403f451df4a4ee641561552d693fb31e4ad6ffbbf6585ee581902cb9527c20c36fd81d1d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633619831, "uuid": "c517696a-65d1-44aa-9844-2acd5e6cc6b5", "value": "T11B151E5363AC8ED4C06792B4DFC1C4B96C09D9EE421A53B4AB12AB64F75FC031E6A473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633619831, "uuid": "bff618d3-1e70-4261-a019-845766c4a58a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633619831, "uuid": "b16b92bf-f15e-459c-a2b0-872e284870ea", "value": "12288:hQUaqvcdmCInaLeguVtZBOSTPs6eZIqFLltHcanR:aUaqCwaubDOST01Iq9gan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633619831, "uuid": "030f6fe8-8458-4f3d-90b0-5a4f8706e957", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633619831, "uuid": "92930050-5c9f-461c-9223-8840299c8a98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633619831, "uuid": "2b241fc2-f310-4344-b6be-7fcfba2708b7", "value": "AdUVN2EbRstM5Pn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9391fe5-2724-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633579895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579895, "uuid": "fca6c951-3768-4e7c-801c-25063be2e709", "comment": "Malware payload (Gafgyt)", "value": "9df82c7304dd556743a895c6e23119fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579895, "uuid": "f195b975-f595-4909-8db7-83253956d078", "comment": "Malware payload (Gafgyt)", "value": "d98095aca24a854e83302b79f4ddb60eed245ccfd0c3ea514f1cb5290c90c1e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579895, "uuid": "d6870373-5aa2-47e7-b965-923b51fdc948", "comment": "Malware payload (Gafgyt)", "value": "f0d50766dcbe5ebfb92fca91054b1ea21648f165", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633579895, "uuid": "a0fbae74-297e-421d-b897-ff74a2ea60d4", "comment": "Malware payload (Gafgyt)", "value": "d2300e4ac4051d383ef7c4e8cafcd2281edd7b48706248f88befb0e576e9181f3c6738613b28ebace14d8714311ca90e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633579895, "uuid": "d8bf5a19-433b-477f-baa5-62f39ea4b595", "value": "T1F9B32801D5508B57C2D227BABBAF825D33332BA897DB33115A24BFB41BC279D1E39521", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633579895, "uuid": "1c928818-9eac-4bcd-b0d0-8d0e459541da", "value": "3072:7BtataD2temCIan67gDxYBt/4kbmTQOWsXAOn:nataD2m67gDSBykbmTQOWCAOn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633579895, "uuid": "7b12c798-3e38-48f0-b513-e2169f7fe0ca", "value": 111016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633579895, "uuid": "4b14e48d-4be0-475e-923a-202df1fbe9a8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633579895, "uuid": "17b861e5-8bde-4ff4-b56d-e8d78ec21237", "value": "9df82c7304dd556743a895c6e23119fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0850d0a0-2787-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633622145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622145, "uuid": "a553c447-88d7-4475-b23a-93e08013623e", "comment": "Malware payload (RaccoonStealer)", "value": "3fd2356c3fd2236e731d3360eb2e37e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622145, "uuid": "6f505444-7d5c-40c8-af1d-fcdb4bf06120", "comment": "Malware payload (RaccoonStealer)", "value": "da18feb770e9425cbcb44f0301051e55b9955c80b15eec5dd73bdd70ea9afcd2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622145, "uuid": "c7848dc8-2251-4fca-9f65-2cbc8d35d8d1", "comment": "Malware payload (RaccoonStealer)", "value": "65cd5d9469b02ee2f424d1f58a87f82d85d00745", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622145, "uuid": "ecec2392-a8b8-4b00-9f77-63ff310501a7", "comment": "Malware payload (RaccoonStealer)", "value": "0c3fe9e711b7c0dea2f042bb217717500ca31667820316c723ff50d7843d72490963b20643ce31342c3a0e3fd79a1117", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622145, "uuid": "a2375588-e548-43a0-ae1f-f00a363265f7", "value": "T174B4E000B7A0C034F6B657F8497A83A8653F7DA1673894CF72E056EA5674AE0EC7134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622145, "uuid": "4acf9585-3970-4349-9afd-cf67b4a206ab", "value": "c1d211268d6c769cc59ffca0e56e63c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622145, "uuid": "9633f9cc-ed34-451e-877a-486fe69c9d7a", "value": "12288:f0efEUA7dVnAEmKglIbO4r+IytRGirFoqKLE:Me8p4KglIiIysq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633622145, "uuid": "aa81b659-d806-4b1f-8517-82eca8342148", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633622145, "uuid": "ab5b34fa-48c3-4e21-ad27-4bbe7858f82f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622145, "uuid": "55f74854-fe33-4f1a-9ff7-8729ff859da0", "value": "3fd2356c3fd2236e731d3360eb2e37e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f4820d-274b-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633596499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596499, "uuid": "fa62674f-cd1e-4e19-b96f-a7095d283611", "comment": "Malware payload (Smoke Loader)", "value": "39a2a53312497f41dfe04b75e19a5e58", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596499, "uuid": "69155785-57fe-47bb-a0c1-901399421f0a", "comment": "Malware payload (Smoke Loader)", "value": "da34d81f2d973efd60e29141088b139868c210d26f2ca4715e5e27152443890e", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596499, "uuid": "60556c95-ad43-4cd3-9594-c55b0f9b4269", "comment": "Malware payload (Smoke Loader)", "value": "80d44d1b07ff289d510b175707b5ebfaddc82ca3", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633596499, "uuid": "166c44e5-f8a1-4a7c-af74-bc209718f792", "comment": "Malware payload (Smoke Loader)", "value": "aafbacd67425442d52ce551a779d20662560ff5dab6a93d7c02c816a9fe7eb6a7748c420e3b39c50fdbdc4d87aab1ff9", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596499, "uuid": "17d380ac-bfd2-4412-8bf3-47f17b306eae", "value": "T192349E1131DBCFF1E66306307A61D6E08B2ABD5E7A32714B3794261F1F3D9E18A66306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596499, "uuid": "49cb0c78-e9fa-4033-a65e-91de8ffbb880", "value": "e7a97aff935fd5f902aa97ce23e1da74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596499, "uuid": "8759f77d-0fb2-4bc0-89af-307cf3c202c5", "value": "6144:3hEnKjf42tIT7UjuKE1VBmq2Sn0zl19pDJf:+Kjf42+3KmPn0B19b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633596499, "uuid": "3e868f10-c8c6-4142-afd8-74b10370086a", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633596499, "uuid": "794e984f-e426-45fb-969e-2f07726aac51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633596499, "uuid": "d47997ec-4f70-4193-a7f5-9850cef055da", "value": "39a2a53312497f41dfe04b75e19a5e58.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e8a9dec-27a8-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633636329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636329, "uuid": "1a9a36da-9146-4956-ac49-3f69cbb2fda9", "comment": "Malware payload (RaccoonStealer)", "value": "2e728c9dfbd1d7cae89772ae87ff44b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636329, "uuid": "c3c219b2-61ab-4ec9-a481-0561f16b8245", "comment": "Malware payload (RaccoonStealer)", "value": "da8e8a3674bb74752cc61703310b75756db86196f957dcbb1efb64dec6f45280", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636329, "uuid": "63412056-6c4f-42a7-9594-95db31cadd95", "comment": "Malware payload (RaccoonStealer)", "value": "2ea59c738ee7ca82fecdb4b7ba945f35b862af65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636329, "uuid": "f9ecfb4d-7e07-4f6a-9542-8ed42d345abc", "comment": "Malware payload (RaccoonStealer)", "value": "08a762b7da83e1ecf740842af5fb145a61807efd0bea47dca5145b8161303abe676026d2ae4baa891437a10042eded0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636329, "uuid": "835b16fc-f8c9-4491-a77a-03966b2e1fa1", "value": "T1E0C4F100B7A0C035F5B726F84A75D3A8B93F79E1672894CF62D526EA56346E1EC30327", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636329, "uuid": "9c1e8660-2d0c-48ab-89f3-a53d13b27bdc", "value": "5723d007fd3b79d5a0887de51ad72442", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636329, "uuid": "58f38eeb-95e9-4d04-8215-e3c7fa0bd6e3", "value": "12288:72Bgf070DrP2ifCg5wuEEV5EyGAmUGmgZVFlGtqKbgBsqzZoS:72wTZf2BEV5ESmUwlGBqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633636329, "uuid": "e152e011-2241-404e-a0cf-dff595254e57", "value": 565248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633636329, "uuid": "3e013739-e440-419e-a069-3cbfb9f98acf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636329, "uuid": "723f9d8b-9231-4db0-bb7d-e0173f632e54", "value": "2e728c9dfbd1d7cae89772ae87ff44b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2725be2e-272a-11ec-843c-42010a9c0014", "comment": "Malware payload (njrat)", "timestamp": 1633582254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633582254, "uuid": "f3e1cbeb-77e0-46ed-adfe-8fcb6dcd3dab", "comment": "Malware payload (njrat)", "value": "6ef5711bfeba4212669fb6de0969b90f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633582254, "uuid": "eeaa9f5e-ad06-49f8-a7c3-391d19c37354", "comment": "Malware payload (njrat)", "value": "db0031942b3f6b1e7558e8754a068be14f4fc11000f2efd1139b985c2438d301", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633582254, "uuid": "d69c7d13-bc62-491d-90a0-89eebaf96a22", "comment": "Malware payload (njrat)", "value": "0b8c52c9fe50ae78bee2b0edab9bbd2c7fea54a8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633582254, "uuid": "5af1c0e4-9934-448a-95b1-0d3f33082cc3", "comment": "Malware payload (njrat)", "value": "bfef5903fb9a4f81fe5dba41e7c4cee5f9cbeb7e7ccb662fef4f547004c0888ff91059c161eeb2cabb01118425776e41", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633582254, "uuid": "706f6dda-1585-4828-a378-96a1589555e9", "value": "T11C13E78CB784E175D5FF8BF1B492B2890B71A017A902D30F99F154D98BB3AC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633582254, "uuid": "7fa6ac21-5b06-4e94-8b03-7ba2adfa18e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633582254, "uuid": "41f80aee-be0b-4cea-9f0b-ae8230bfd3db", "value": "384:JZyUo+5ctOnwtOyW6jlyci8EqnQiMI472IVa9D9O5UE5QzwBlpJNakkjh/TzF7pq:LxqAwt/W6pyci8EqQ6477vQO+LG+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633582254, "uuid": "e827c4cf-c369-4c4c-b0ca-27ceb1b19f9c", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633582254, "uuid": "a6c1d89c-4399-4b52-bbec-a12ee1f360d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633582254, "uuid": "f217c6fc-44e4-4ec6-b12d-a57897d739bf", "value": "DB0031942B3F6B1E7558E8754A068BE14F4FC11000F2E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010e07fd-2731-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633585196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633585196, "uuid": "80819623-cf83-497f-834d-07b7953d969c", "comment": "Malware payload (AgentTesla)", "value": "b929eadeeddcab0fb093d4ff51bda9be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633585196, "uuid": "33aa17fa-9be1-48aa-a07e-5aea0fda00ff", "comment": "Malware payload (AgentTesla)", "value": "db4410f5f10116674cf0a4647359b8a465da4738640f4d57e8818917102a848f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633585196, "uuid": "292e1085-de08-4af8-96f7-227054201cd3", "comment": "Malware payload (AgentTesla)", "value": "404625e532b63c8a57e1c267a856eeb806733425", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633585196, "uuid": "c8317c80-56d4-4fab-98cd-3323c65d8c59", "comment": "Malware payload (AgentTesla)", "value": "c8a8c628f0bd6b4ba70ab81d214b7e6d2d24095db267f3e649d698bf165f5e628ec895abf52c557586ba77b538cddfee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633585196, "uuid": "64e6e46c-3e68-4273-8ffb-51c7b3b21c8d", "value": "T15EA4E07D32A3DD01CE7142B6ED9ED16007ACAC22216BD7792D9EB2AC24537F50D907CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633585196, "uuid": "5504b4a0-f420-4684-b43a-d59c1256e33b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633585196, "uuid": "fa1e7644-ce01-4a02-ad0f-bb9d62353a10", "value": "6144:bv2+WB0Q+3HwOakJVnEcZ+rfTKwHZ8AdXtAwsYdKAOKlSEedz709HHuUCNzOqIEl:bv3+1oaSVZZ1w5V9PKAOKI9dzKHO91", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633585196, "uuid": "f8e46a2c-f690-417b-bd07-4e4ab2ab683f", "value": 469504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633585196, "uuid": "198fcf5c-35d2-48f5-8318-c64b82ecf561", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633585196, "uuid": "97cd289c-cf4f-4a69-9bce-8cacc1dfcb26", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c8fa73-27a2-11ec-843c-42010a9c0014", "comment": "Malware payload (Pony)", "timestamp": 1633633918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633633918, "uuid": "e6b4543d-c0af-408f-9c94-f6d4f3cc3990", "comment": "Malware payload (Pony)", "value": "a9463bceac35badf1b1e9f0e4b1e1a8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633633918, "uuid": "800391af-edcc-4a92-b1a2-ff8abbffd527", "comment": "Malware payload (Pony)", "value": "dbf5fe30142d482d6d4956200896236d623e613956062e432cb9db91547ceeb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633633918, "uuid": "f56382f9-d142-45b6-914d-27ae355d9501", "comment": "Malware payload (Pony)", "value": "e79507782f430cea8fefa2a5f6021b00a0cb377a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633633918, "uuid": "332f3b3b-a19d-4a1b-84ad-99ea2394ef7d", "comment": "Malware payload (Pony)", "value": "677a16bd1f47eef41a2b365bcce21c15b451c1bddd63377264ac93ce8b111191d7df16898097c84e08510f1a450880b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633633918, "uuid": "8854b75d-0343-4302-ae7a-5f5f105cd514", "value": "T15A14E8219354FC54E80112F63BAA2579C5F3DC3459948FAB11B3693A47B2E8B23F076B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633633918, "uuid": "2a73c0f6-0452-41b1-9803-2bb90137c3c0", "value": "559323e46bda48df9108abbfad7a4c54", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633633918, "uuid": "c6007cf1-2ed1-4d7c-a157-35d0039e510e", "value": "3072:jZH5lXNxfeaaEw7un/nH7oFrvolk49JuZpOkg+ccQPLxpOlobqK:NHPXnfzazoHEFrwlk42ZckIcQPNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633633918, "uuid": "f34f0a12-fd07-4b54-a10b-dee23e4c9e45", "value": 208896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633633918, "uuid": "6a13144e-a4bc-44fc-b756-d0ed3e890044", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633633918, "uuid": "d9706370-f808-418a-bf04-f23ccda8c49d", "value": "DBF5FE30142D482D6D4956200896236D623E613956062.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0818e9b6-273e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633590791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590791, "uuid": "186a7e65-c58e-4f7f-9b3d-7263bdf8b7eb", "comment": "Malware payload (AgentTesla)", "value": "71cc3b324e3e6a1068acfc8e8b2424be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590791, "uuid": "facb3a0d-4f4d-4eb7-aae8-8bceb4e11cf0", "comment": "Malware payload (AgentTesla)", "value": "dc4a9150d3e56e2c6d33000afbed26568a10fc3933663af247005dc71e753447", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590791, "uuid": "4d4cc282-9ff8-46e4-a46e-d98248376df1", "comment": "Malware payload (AgentTesla)", "value": "6117bcc5be78e56b363ba0bdcbf90f75aac6814d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590791, "uuid": "e29e712d-a24e-4690-80bf-c881531e45b3", "comment": "Malware payload (AgentTesla)", "value": "1d8fe7cc2bbf01ad80deca15efea46a6643d1b11ac286979d455dddeaf6829be0e4fe5aef403ab3b606d2c2a4cf7a3fa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590791, "uuid": "6bf6f5c4-72e4-4a71-9f6c-faa51a8e04e9", "value": "T148A4025D63BB8B1DDD35C3F62400E6621BF9652B2129D3385EC5A0EE34A2F7419E0D63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590791, "uuid": "2e4140af-7e56-40f6-93fd-f4a3ec88bbc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590791, "uuid": "1fc59616-d28b-4071-bc5e-57211880640f", "value": "6144:Lj2dIQ+3HwOQPkJRn1AA7w3tMj8x9qZyujrSEj6eO3GDVzRmP58bLo6KrTfgsJph:MoVnyIw3tMj8gdN6iBwZrTXpO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633590791, "uuid": "af1c4501-8aa3-4eba-be4b-b32307c521d0", "value": 462848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633590791, "uuid": "f3b5d845-6e23-4986-acec-17eda02f53a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590791, "uuid": "34f240c3-96bb-4fe8-b731-cc38a14c1508", "value": "Policy Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1995f37a-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633597263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597263, "uuid": "abb3d6d8-9c06-4e2b-a429-49eb21d78227", "comment": "Malware payload (TrickBot)", "value": "963792ec63e0f0dfdff62046fc03bfa4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597263, "uuid": "61701ca0-5682-429b-b735-334d9a75deda", "comment": "Malware payload (TrickBot)", "value": "dcb653aeaf898f1a4eb946eec4f03649b50a4bed4258f1dbed96b12e9974c727", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597263, "uuid": "1cfded50-c0f9-4839-a3b4-5c76699fd214", "comment": "Malware payload (TrickBot)", "value": "f8536268a3233bf571422b4e45a18ebbefe02082", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597263, "uuid": "f9f07bea-1faa-474b-8220-3f05cdcfe3a0", "comment": "Malware payload (TrickBot)", "value": "4e329539d36138c64362303c4f2597340a1ecd0b94abc7f6553b23fc124a6efa9110533ad2e10fcdcce398fb4318bb76", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597263, "uuid": "a34b3b0e-661d-411b-87cd-d68928b5070b", "value": "T186B4DF02B3C08836D67B227A49ABD71933B9FC204F65C38726C47E5F6E326D55E26352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597263, "uuid": "01c95531-cd20-40bc-a40c-6f7515fa4d74", "value": "fd98f67a63ecc847a2028c66b8388afb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597263, "uuid": "149866fe-d739-4c1a-b960-0e1cdf4f4f62", "value": "6144:b3oOkxQXFDzaLtFD2aD3mAKit6lltqFpaI28VwPHK6+TDrAo0dThI9eq0NIaP:b3ExQ1DzM187qFp12iwPqvDr2VI9bZa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597263, "uuid": "9e8bdea9-7ec4-4899-a28f-283439fb5267", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597263, "uuid": "d30959ea-aa0c-43b4-b0a3-d887d63f6806", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597263, "uuid": "ab61f11e-2b4a-475c-a740-d443eeeca4d7", "value": "963792ec63e0f0dfdff62046fc03bfa4.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6fb67b-274c-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633597085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597085, "uuid": "419b3317-9c80-4c6f-9f15-b4ca63cc950f", "comment": "Malware payload (ArkeiStealer)", "value": "5066347d4f2c2ae73ca0a07badeb2aa3", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597085, "uuid": "fe00a5dc-e7b0-47d7-a925-643b94369f31", "comment": "Malware payload (ArkeiStealer)", "value": "dcbccc78bc91546c6e988621d16fd27043dce977cc9fb00a67fef3938fc38053", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597085, "uuid": "3424e920-bc57-4a13-a65d-4a9f6cc013ee", "comment": "Malware payload (ArkeiStealer)", "value": "a30b4bd925337d77afd4625c6574438fb10401db", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597085, "uuid": "ce15552f-0409-4f74-9af8-7e689cfc29cc", "comment": "Malware payload (ArkeiStealer)", "value": "02a327ab00dbc8129257c3025e608275d1a65ef1e93cf4d3d940344487026fa2ec5376ee2fdc37b00416a15cff8a67e4", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597085, "uuid": "ca0c9e32-37c9-47b1-8305-474bb78bc1a8", "value": "T1BCE4122938DEC837F33316745D7AC2B0576ABC7649B1518F2AE41A2FDE76280EA54307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597085, "uuid": "437b490d-732f-4940-bc64-3348b076310e", "value": "01c64e8a0bf942eae9e15adaebb52144", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597085, "uuid": "5897f648-6e6d-4390-bbba-79f6b4001fdf", "value": "12288:+cirSdFFVUBOTuvnzQA1X/J7LjWYIj404RRo9T0oLCFPCfqUF/pfvgP0Fmfpp2A:NirSAIKs2/FjWYIjxVLCGqUXhGeA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597085, "uuid": "6011ab69-f541-455a-a2fb-1ee449a0d120", "value": 666112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597085, "uuid": "2e060d8b-2015-43a9-bc4b-259da42a6042", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597085, "uuid": "5fe74db8-0a34-4e19-83c7-da36b732de2c", "value": "5066347d4f2c2ae73ca0a07badeb2aa3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "715bb558-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633597410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597410, "uuid": "6014937c-e6b4-4795-9835-ee4d5c7d7b8a", "comment": "Malware payload (Formbook)", "value": "ca7b5f2ec232fadefa0af01ae3cba9be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597410, "uuid": "929a9a29-e241-4775-bb0f-07b058a8cd9a", "comment": "Malware payload (Formbook)", "value": "dcfd181e8143ae4b31ae3d289b57113fdc67449735acd5d459a358766f401035", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597410, "uuid": "8b421290-5c1f-429e-a9a5-5e4c094b5e9c", "comment": "Malware payload (Formbook)", "value": "9f9b5551877ab792aedb2e6b89a61ce779566ae5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597410, "uuid": "1a3ed359-5203-4ab3-8167-3753ccfa4fec", "comment": "Malware payload (Formbook)", "value": "4176f1f4f9ece2d519f8308922a63537e316da341b9f7478f621071b2eb5e167abf07e14c253e628ed33e671104924a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597410, "uuid": "c1b890fc-6a35-4ef2-b6f4-22b3c8beaac3", "value": "T138D41268037B5B14EE7583F56D3CE2A223B9A422111CC3B84F98B4BD7E277749AD0653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597410, "uuid": "9138a3e0-9050-438c-8d4c-2852bdd266d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597410, "uuid": "594d1269-98f1-404a-a891-0f08ae425732", "value": "12288:nh5koU+5zaPd8993hVaJyWF8XaMEiu5ANqxI9TBr+7X054Jd:h5kd+liaFNWqXMKNqe9drUk5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597410, "uuid": "fd33a8f4-b50b-45a9-8626-0394279412c8", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597410, "uuid": "803ed252-a898-4b77-892c-b3a40b9da0d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597410, "uuid": "ddfe1c8b-95b9-48fb-ac76-6ce67a37c6b2", "value": "ca7b5f2ec232fadefa0af01ae3cba9be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48dec6ff-2728-11ec-843c-42010a9c0014", "comment": "Malware payload (Matiex)", "timestamp": 1633581451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633581451, "uuid": "13014b53-0e4e-4c55-840f-4db386c66639", "comment": "Malware payload (Matiex)", "value": "4107bb08f0c20c1bafd7839f1bf77a8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633581451, "uuid": "68da9044-04bc-4aee-b6c2-8b27e783946e", "comment": "Malware payload (Matiex)", "value": "dd182afe8c89ecfb8d2d449f5e700d7ac09b979315238abf0cee1cdd65d6c27f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633581451, "uuid": "572cbfdf-bd31-47b8-8542-dffe536d8c17", "comment": "Malware payload (Matiex)", "value": "ba4daabff9037990d45c4cfafe4690a7fe2ddbfb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633581451, "uuid": "95218ebf-0848-4972-93e5-22948387db05", "comment": "Malware payload (Matiex)", "value": "0907b32817bd842ddb0188f1b0fda9f391bfcce347d2d8b3e8c1be5e6964372fb282a0de4dd0f58e956abd7077f7deb8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633581451, "uuid": "dd481d4c-0934-4e6d-8899-90cd51189d37", "value": "T16ED412A513778658ED368BF85C30A1D2137A6821205AC7781FD8F0F97B637B98ED0A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633581451, "uuid": "3e6de447-ae76-47e5-b33f-9e2b2949c3a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633581451, "uuid": "0ab8e06d-bf34-4a47-8b50-b780dc87bf5a", "value": "12288:rg3skoToRsOSeKceND8d5ycLnEahIdL1uSmcJ3aaMGZU+:c3skCtOjKc+7TahIdQStJ3aaMGZU+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633581451, "uuid": "b8f7e72e-f701-4b1e-95cb-c604dd6aec1c", "value": 605184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633581451, "uuid": "a962429d-004c-4496-b3d7-5d3f2dc78594", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633581451, "uuid": "d1628ef7-3513-4dd4-a63c-a7b06c002f8e", "value": "Products Details and Order reference.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1989904-273d-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633590646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590646, "uuid": "eeefb213-fd03-4d30-b7ae-65617168d8e5", "comment": "Malware payload (RaccoonStealer)", "value": "66e3827bc3b6728af4c9dac48bc98056", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590646, "uuid": "ff4d5feb-528a-4c9d-9b07-44eacd6de556", "comment": "Malware payload (RaccoonStealer)", "value": "dde7851773f5a3f62b23b919c2403888ae2e876993777a34bc5c74d7d1149fbc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590646, "uuid": "1b31f08c-cca8-4793-a5d5-29f2d96fe42c", "comment": "Malware payload (RaccoonStealer)", "value": "5cd51c6367190939f9b9888fb975aa165951721d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590646, "uuid": "0d168310-8ad2-47f5-9421-018b04b0d65e", "comment": "Malware payload (RaccoonStealer)", "value": "9e1f89b3d45e575e075a24974dd6580103ac934d4383c895748fd5486aeffd1538a414806ebda4a7b5a6dcf10e348203", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590646, "uuid": "f1d8ac10-e0d6-4d04-9ed1-ad75b9514f69", "value": "T101A4E100ABF0C035F4B752B94A7A93B8A42DBAB05B2594CF62D117FA5B346F4AC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590646, "uuid": "c58ca65d-cbcc-4277-a448-a05704c5dbd7", "value": "558186eb4208ff26294240429e60d1ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590646, "uuid": "756fc20a-c567-42cd-8b03-9b41cfe6d17a", "value": "12288:KFBTKulrWpL1r58BNADDYuWk3rLJu558RKFDnG+:KFopLsftA7Fu558Rc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633590646, "uuid": "457cbc3a-d2aa-46a6-af83-c6b7d3decfac", "value": 491008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633590646, "uuid": "a42a84ae-a6a0-4797-a9c7-cce5d246b54c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590646, "uuid": "5134fe3c-7d0f-4f75-ace1-52fc71a03bad", "value": "66e3827bc3b6728af4c9dac48bc98056.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848d1bcc-2761-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633606033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633606033, "uuid": "406b0e47-7022-44c0-865b-5c7eae95aa80", "comment": "Malware payload (AgentTesla)", "value": "b12ca5ab036d191bc537c427645b40f7", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633606033, "uuid": "91228900-e8e1-4201-9b45-608f42f349d5", "comment": "Malware payload (AgentTesla)", "value": "de102ec6695858c05314cf28963613bc874d58bb4c74832be93dbc21bf73131a", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633606033, "uuid": "1f41f150-9af5-4f01-96a0-3082c412045b", "comment": "Malware payload (AgentTesla)", "value": "d5344d2add94f85846b7da4ce9ee3c3ea7efc3fa", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633606033, "uuid": "2bebf5cf-d75f-4afc-94d1-06c82476bea7", "comment": "Malware payload (AgentTesla)", "value": "31056971e5a14b6123b278f0cc87d384f2367e95674dce05cf92ea6694ffe805a16248d9a434c7932689b73f82add544", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633606033, "uuid": "2a1ec25b-b549-4345-8fab-fd83ee86526d", "value": "T116E433E15752ABCBF1E6E7EB54187CC19EC3A4AB45A2222EC391D25CFCAC21453B5C13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633606033, "uuid": "329feafc-e79d-47de-95db-38c22f78cfe5", "value": "12288:i2voeyyPmxv5TJIxfxxdD77f0GiLqi8l+UzXNPCRDqo5wpq7L:JoH5TJIZdD7fNl+UbNP8Qq7L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633606033, "uuid": "89adb263-8c6e-4a0f-98f6-355ad912fab3", "value": 671319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633606033, "uuid": "3b172605-3bcd-42fd-99f9-3f537155fc8b", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633606033, "uuid": "10485f78-6dfe-44ec-bb6a-ed90526500f3", "value": "Shipping docs DHL tracing No is 7682657732.7z.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf93aef-27a4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633634850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633634850, "uuid": "ee6c512e-5a89-43b6-aa6c-5857c24cac73", "comment": "Malware payload", "value": "514bedb49ac9d508f800035c04819bab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633634850, "uuid": "eb793d51-aa9d-47d3-9e20-b20ba1a90a2d", "comment": "Malware payload", "value": "de74006a23319ed5aa596ee8e047df2a6823fecdb9e0f4a5298418e665b56564", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633634850, "uuid": "bf938864-f691-4c12-9741-b36a8f958166", "comment": "Malware payload", "value": "f18e759b34c5aece81fe097b48672a7e51311e22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633634850, "uuid": "ee5179f0-bdfd-4dc3-a728-0cb62c93285b", "comment": "Malware payload", "value": "55c3313c73e18d6e758ae82dbffce1af787318aa593b0645235fdebc44f2dfc61d96f6ccda5cad2942383dbc7c585067", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633634850, "uuid": "2cfefc27-e82b-4484-b1ed-14c5b3064576", "value": "T1119533E145230917F30168B504A2D429B942F6BFBFC994869BCD70A96270DCA1FDDEF8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633634850, "uuid": "57d936ea-a017-41ef-8c07-d1e4fef11607", "value": "27516fd8750f40bdecf52a1420a0296a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633634850, "uuid": "4428880a-1bf3-4951-be32-656c0b2b6b2d", "value": "49152:PMDSmqHWKUTKciQyI8Tlpxru1/u5MJ791qlI:kSmqVUT5idI8TE1/u549CI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633634850, "uuid": "aa9bf942-8be9-483f-9de2-3555177159d7", "value": 2036224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633634850, "uuid": "248ab7ac-8270-41f9-baaf-edec2caacde6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633634850, "uuid": "1305737f-062a-47ab-85e3-e70cb918b82d", "value": "514bedb49ac9d508f800035c04819bab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "899402d6-27a2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633633958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633633958, "uuid": "a3fcdbca-5bb9-4551-a2f8-cd24fc50ca90", "comment": "Malware payload (Formbook)", "value": "5ed8f58873e6537bc9a5bd97d18425b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633633958, "uuid": "7049269d-3370-4fa3-bd4d-db3e916f8773", "comment": "Malware payload (Formbook)", "value": "dfbb8dc13848a4763fddee0be94415ef938755656c54e3f151995e2d50f251dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633633958, "uuid": "2c333fe0-81f4-40f1-8df4-48a9666a1bfc", "comment": "Malware payload (Formbook)", "value": "8e3eefb9a9ee6759ad96325971aaf54d9cf98575", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633633958, "uuid": "1a362138-6300-4a4c-b3a2-88b77dedfb40", "comment": "Malware payload (Formbook)", "value": "25c1f37f021a616b4c430c4a239199f055fde6ff6bea058c9e70749d24ccb998eb60f3249a0721e3164f2562bf0a0f99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633633958, "uuid": "e7f2f31a-931e-470e-9e56-5bf2be8b36b1", "value": "T1D425F7003295C611D1B637F5D861CAF097656C45EA29C28B2DF1BEEB7971B03CE01AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633633958, "uuid": "203a3efa-54c5-453f-99fe-e84bed88e7d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633633958, "uuid": "e231a47a-c91a-4f14-8c9a-d40852ff8126", "value": "12288:T+x0eYDyL9pD3n+0SLVvCoKl9PZYIng4E/xfuduwjszfH:SU+L7D3+1LJCoKPPZYIn7ll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633633958, "uuid": "ef8d6007-1c02-4e19-be0a-031792698b5a", "value": 1043968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633633958, "uuid": "0f37737b-821e-4993-be4e-396a54b3bc80", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633633958, "uuid": "7fbbb7c7-b516-4385-b193-92d14fe80da0", "value": "obizx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c805183-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633597429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597429, "uuid": "4549f279-4bcb-4de8-b04a-2230ba3929e6", "comment": "Malware payload (ArkeiStealer)", "value": "60555f97609c2f8ca30f857267770943", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597429, "uuid": "8cafab58-c24e-4ace-81a8-079cdacc2caa", "comment": "Malware payload (ArkeiStealer)", "value": "e022f6af79d5357e65e442774b8f3a3e86e2d9150f4af7a165e127c321b8780a", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597429, "uuid": "7eae332a-c3cc-4c56-87f7-d94e958d6b40", "comment": "Malware payload (ArkeiStealer)", "value": "78efd0839ad1456d8c572949a728d51c5189dc65", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597429, "uuid": "9db9b621-3627-48db-aa7f-012520f045c0", "comment": "Malware payload (ArkeiStealer)", "value": "955f172c20f4b92cef876c98689515729c9d2f5aa11bce1e0fe4914b402911ee13f50d8ffdba52abf2481f0546232ba0", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597429, "uuid": "ce21de0d-a0f9-45c9-9d92-643533282ef4", "value": "T1DEE4127075D4D47BE7A71632CD708EB10B7B78775A32618F2FA4166ECE392D18A68302", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597429, "uuid": "a55d7192-22d3-43ce-8102-6f8b3015986d", "value": "51f224c09b57224d474ba4b21025bdd0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597429, "uuid": "2c6c5e5d-1bad-429b-ab87-7608807dca7a", "value": "12288:Qn+U8QzbxMSr38ckumk2vz0KyJPUhFeH+zIYOpeOe920Qp:QnjzbG+3tf2vIKyihg/YOpb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597429, "uuid": "2c206a70-6b68-4fa1-b02a-94bdf3242b22", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597429, "uuid": "f43c6816-b570-4890-b634-c40171596c13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597429, "uuid": "3b9bce81-55ef-4db0-8be6-c0f31cfeb3ce", "value": "60555f97609c2f8ca30f857267770943.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7082677a-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (TrickBot)", "timestamp": 1633597409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597409, "uuid": "fb6f0fdb-23ef-4285-a07b-a8b039dde78c", "comment": "Malware payload (TrickBot)", "value": "03e6354bab55c9de22001ac0256fb860", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597409, "uuid": "6f845998-6cb8-49be-b330-1fdc4da700f9", "comment": "Malware payload (TrickBot)", "value": "e02a1d2efa6ec00b15853885b0203006a09100ccafc6e83abe2bd1dd0eaf8dd8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597409, "uuid": "b0080bf1-a9dc-4834-8a6c-a79951eced0f", "comment": "Malware payload (TrickBot)", "value": "9cce08442fdb58b4c96f4627266ce41cf8091237", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597409, "uuid": "9e94dcef-038c-4c36-9c4a-453a9144ff14", "comment": "Malware payload (TrickBot)", "value": "7efc780d4c2a4c103aea22cbb95c0c2f5da19592441a0d3418656d486da25e07f9c96454f210029c6c9a7e9a48181a5d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "TrickBot", "colour": "#5349A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597409, "uuid": "2e11d13e-a1bd-4269-b713-20489223f83f", "value": "T1C5A4DF1232D1C076E1BF02354467876837FABC519FF2D24FAF94BE4E6E306468A25792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597409, "uuid": "380e41c8-41b9-4080-9093-cf87cc4bcf53", "value": "f34a0f23e05f2c2a829565c932b87430", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597409, "uuid": "6bbcb29d-dca4-4846-816f-8f5a31b44e9f", "value": "12288:pZE+MlbUtn38H+bNdPEIaZc661kd+D/fbx+9Kllp:bEKNb/aZl6KdSrs+p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597409, "uuid": "6680d39c-5704-4168-9774-fbf16125a5be", "value": 487551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597409, "uuid": "47eceb48-3c61-4a14-a6a2-7ced7d561d3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597409, "uuid": "15e7985e-a4d4-4f3d-8f4a-747f5b534a7d", "value": "03e6354bab55c9de22001ac0256fb860.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d716b13-2775-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1633614557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614557, "uuid": "69ce4aa3-5641-4c1c-b867-f150b5e2d729", "comment": "Malware payload (Gozi)", "value": "a04cc72f0946720cc875ed228f565c1d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614557, "uuid": "662f81d1-50f4-4182-b963-947a89c4a3a6", "comment": "Malware payload (Gozi)", "value": "e04823c56b627e74c92656340de38aed9804af65040bbed746b206de5a122dc5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614557, "uuid": "33d649fc-cbdf-44b5-9eda-a00e2c811ba1", "comment": "Malware payload (Gozi)", "value": "58b12ddffb7015e8857209c60a06ed4419a23641", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614557, "uuid": "684cbb4b-dfae-4e1b-a550-0b8799043ab2", "comment": "Malware payload (Gozi)", "value": "0b9925ee8f59357a7f8024b5de4f5bd96ba28cdb527f94dee04bbcfce7b264c4320f1b328aab9ddcf2140c9d228fc85f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614557, "uuid": "43ceba61-5f5b-4082-8e18-864ab163e163", "value": "T162849D1172C5A8B8E45324B2597FD930552ABE9E6238C44E378A7B2B46F3381117BF1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614557, "uuid": "6f51304c-d125-435c-be35-4ff0b2972e7f", "value": "a554a8c84a5b556026c60d682c670603", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614557, "uuid": "56cc2dcf-0fe9-45c5-b09a-b56aa4686e6f", "value": "6144:pguK47sx+R4DNoapfo2LnHhKiVbI9hrse5Sa3/02sIYzfThE:pguhxwo2okbihRSI/rsdfThE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633614557, "uuid": "5409d03c-f412-40bd-b79f-c3e994ef6ffb", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633614557, "uuid": "e4bf77c6-89d4-40c8-aa9b-2e27caea4f72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614557, "uuid": "dd7e1030-f406-442b-a3de-8674020eb171", "value": "a04.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910e17e5-2743-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633593169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593169, "uuid": "21d2e929-8862-446f-a436-962ac7b2cf7e", "comment": "Malware payload", "value": "2b04ce9151425d7ada4f69915152a424", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593169, "uuid": "180e044c-9043-4679-95e5-ed7b7a28c6a4", "comment": "Malware payload", "value": "e084fbf33c448ae4e49b8c4d8c2cbe1e03cf0d1149ad765271b89b95ed103895", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593169, "uuid": "61fc4fd4-5eb4-409b-a038-c312afd2eb25", "comment": "Malware payload", "value": "8f9cee3e9db5d32f64105fe4d15c250ab0ba5a67", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593169, "uuid": "07e137c5-d4f6-45fe-90f3-8fab2d380709", "comment": "Malware payload", "value": "1a1c0d3fd4a56f0466b2f9153301612062a5bc1abd0e638c54ffd014f2cc00caa7b910985aa0f0e1d8a52e5d9d0ee5a0", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593169, "uuid": "bcfddb80-6622-436a-b7e0-43a3a4df8666", "value": "T178F0A245D0BDFAB645C371774D9B9852E439028743B4EA852070D515C9293F891AD383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593169, "uuid": "3895d858-6f18-48f1-9d01-349820d7b715", "value": "12:IW/otgKwVz/3EyTFgd3pm9iV5R9Gg2IIxmZ9y5HGD+V6/ABio6R9GgjGBsdJ:IW/uNq3EyZ2EUMg2IIxmZc6h/AkoeMgp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593169, "uuid": "f27f7471-bf28-4b44-b94a-0b42d74d7b45", "value": 637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593169, "uuid": "ad3dab5f-5231-4547-9f2a-35a7abf6ae84", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593169, "uuid": "2e5bc256-6761-45e4-aa3f-364f70801166", "value": "MNGAO-261.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03297fc6-273e-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633590783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590783, "uuid": "4369acae-0f45-4a34-9765-d692066473f5", "comment": "Malware payload (AgentTesla)", "value": "299e57d5d58d0e1f09eb6809b820464e", "object_relation": "md5", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590783, "uuid": "bb8e6719-dba1-4326-a80b-4a8d4cc4fe43", "comment": "Malware payload (AgentTesla)", "value": "e0dfbdaa6d696003eb7c484932b4e5730f981134c6179abbc44aa975278907ae", "object_relation": "sha256", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590783, "uuid": "dcf07083-a2b9-4212-bf39-01cf58af134d", "comment": "Malware payload (AgentTesla)", "value": "68e3d3abb7d84cae03895a32a1191f96f60e57cc", "object_relation": "sha1", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590783, "uuid": "db7d15cc-5006-43a4-8b2a-61461363a62f", "comment": "Malware payload (AgentTesla)", "value": "06b47da5f94e36a13c327777293b858df4481435a5655c4148baf86443925cb59fdbcac2bf0b8832372f7c9ecade01a7", "object_relation": "sha3-384", "Tag": [ { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590783, "uuid": "094dd521-2c10-4446-a134-2d077bfa0e63", "value": "T1CE8423D2DC1C6BAB1008E6B2680B1F43674817949FFBD523CE187668F819F89CDFA152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590783, "uuid": "0cfa7893-1aac-40fa-aae8-eddd39131383", "value": "6144:WbprtBk/+l3ntNXWVi0SS/v5h7HkN97oyLicOu7exxeYYjU6ceuRVr/evxp6E9cl:W1rs/+5tNmVi035lE5icx8x6cw1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633590783, "uuid": "09330bf9-77a7-472a-b9ed-b456c9ffa561", "value": 384955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633590783, "uuid": "032d382c-460e-426d-81f8-19e95eac0a7f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590783, "uuid": "07211093-c8f5-4e10-8135-2774044b6619", "value": "Policy Copy.XZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73354195-2770-11ec-843c-42010a9c0014", "comment": "Malware payload (Gozi)", "timestamp": 1633612446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633612446, "uuid": "8863faa6-32e2-4c75-bc5a-7f54162e710e", "comment": "Malware payload (Gozi)", "value": "03a4adf216161aceabaf8b9cbde58308", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633612446, "uuid": "c8d9c7f5-bb1e-40e0-b8d0-2897d2e59053", "comment": "Malware payload (Gozi)", "value": "e0e9821e1c172ee90b6ea27d96a0e9053269fb48bcbe7ec4fb42e048da9f4e8a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633612446, "uuid": "4def4870-3c00-445b-b0f7-73d723a24ab6", "comment": "Malware payload (Gozi)", "value": "5b37a2bdc58279f1f1e31038fff1f859eec76cf6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633612446, "uuid": "a73aa259-7e9d-42d2-a747-58adb5b7f542", "comment": "Malware payload (Gozi)", "value": "eabcfa1297050435ddce423a4a1ef9abcd9c1df9b31cd916a4c46faee6760b7b08ab15610ee93c4a69fd4d815063e851", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633612446, "uuid": "51610e41-7eed-4aa6-836c-b51975ecea36", "value": "T1A1749D02BAC89034D67A03358D3AEA66027FBD105B35AD9F73DD0E4F0A752D0B636792", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633612446, "uuid": "64fb6d4a-5ec6-4b42-ae97-c452970309b9", "value": "388c18203ba7cd9d5e6bbc1e635bd8d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633612446, "uuid": "fe68c139-2ff1-4085-b77e-4ee1e4f83cdb", "value": "6144:tgx+Fh1vq19DeXOKKGEH6xmID/u2rA5QcGqWtyXaNc:Wx+F6FehKXH6xmIDs5QcDW0Xn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633612446, "uuid": "a621297e-8475-4c42-830c-2cc266993978", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633612446, "uuid": "2f966168-814f-46aa-90ce-999121e3dae0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633612446, "uuid": "5a7a48f9-7aaf-4cd6-af76-919c30f5cd34", "value": "50.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51f5fe51-274f-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633598217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598217, "uuid": "80932c91-757d-4da1-824e-6923e46bc728", "comment": "Malware payload (ArkeiStealer)", "value": "04cac5824cce18341e0eaaa92b4df8e4", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598217, "uuid": "5a5a2f2e-9746-4616-9a07-a2242b0199bc", "comment": "Malware payload (ArkeiStealer)", "value": "e0f882ee034b004232619679b022684ae62e61970b99945b1b01ba65099a1ae1", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598217, "uuid": "30563847-1a53-4cbf-a447-64baae2d2858", "comment": "Malware payload (ArkeiStealer)", "value": "aaf6f06be2ea09e6cad9adc22e364967df5e42ab", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598217, "uuid": "21d69db1-a91d-4e94-92ec-02a6b68fdf38", "comment": "Malware payload (ArkeiStealer)", "value": "096e5f51efd746853a6e165ff5443e25882b4f79ec0f050121d359f24facd9ccaa34b54e60f32f722acca1a2adac49f3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598217, "uuid": "c0e8129d-06f1-4440-b3e0-d1558a2307a3", "value": "T158E4021067E1C035E5B752FA497642E0A63C7AB06B24D1CF63D62BEA1A746F4BC31387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598217, "uuid": "253f4002-4d92-40ea-a535-084606f8136a", "value": "dfddb4935ecfeccd8e67f98d0f98b8e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598217, "uuid": "5554f4c8-e5a8-45ee-afda-8a53f9a80cf8", "value": "12288:lFpdK9m78wLOTnlKNd+QYIXUY4mm7lTwvQShp9iBLALnY+Y4tMuBb2H8THTGM:lFowLo8mLIXF4mm7xwYSH9iV4YI5QcvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598217, "uuid": "4bd9a5ac-d2d0-4acb-89f9-23deb3e3547a", "value": 677888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598217, "uuid": "b79da088-d30c-4754-8c13-25bc7db0b9cd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598217, "uuid": "0f179b20-041f-4234-b3d6-1a8f62b48d5a", "value": "04cac5824cce18341e0eaaa92b4df8e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373810c2-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (DarkComet)", "timestamp": 1633597313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597313, "uuid": "c3c298b6-4baa-4892-acde-2f56ecbbf005", "comment": "Malware payload (DarkComet)", "value": "4b65dd5f5ba00ec1b3e923e04045bd20", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597313, "uuid": "4f7b1760-c7a3-4ad3-8c83-eec7f9f65a99", "comment": "Malware payload (DarkComet)", "value": "e0fbceff5394bb7d6fd37ff2c9a12208145c50bf11702905ec1044d27d0c83d4", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597313, "uuid": "9585f102-be75-45f7-9c71-2c4a06024328", "comment": "Malware payload (DarkComet)", "value": "593cca5864262da209fcfe7cfb91a49a913ca93e", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597313, "uuid": "781c14b4-b027-435b-988f-ca74935f50f4", "comment": "Malware payload (DarkComet)", "value": "8969ddeeee9ad22e676e92a1c601b2abc6a38a386285c219e7d83426c573aaee38c3d6db03c38dd4d2240643828d17c0", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597313, "uuid": "8d84b456-492c-44bc-bbec-a67326ebfe52", "value": "T1D2A423682375E5B0DCDE63B7671AA368325FBE42C26B51AB0851C935BD08FC32353D94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597313, "uuid": "264dc965-b5d2-4e3d-abfc-13883408824e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597313, "uuid": "ae56d9f1-ba5c-4956-9b25-5a36243cc605", "value": "12288:khqP8uJabr9zqgzE3ElDPh9pX1dz89bXU:09s3EBPpl+XU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597313, "uuid": "ce4a1e8f-2885-499f-a519-815dbcd3f18b", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597313, "uuid": "ec4c08e5-cc2b-4412-82fa-0ec60ec86e11", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597313, "uuid": "095685be-f64d-45b1-837a-ca6543d7d6d8", "value": "4b65dd5f5ba00ec1b3e923e04045bd20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67fbe64-274c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633597204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597204, "uuid": "ff65e055-8acb-40ba-9dfd-0a4c97d86bdb", "comment": "Malware payload (Formbook)", "value": "2d22112d700c43db2b3baa6b2e38d625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597204, "uuid": "c032936c-1c7e-45db-8bcb-dcfd3d3c59ea", "comment": "Malware payload (Formbook)", "value": "e1010d989d5412e83aaf07bf794a76257b1a43bcec34dd8c05280cb97c61e3ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597204, "uuid": "deea247d-2f52-4155-9058-2196c1af7906", "comment": "Malware payload (Formbook)", "value": "0add389896d2055e667436a3cdb1c4d4fa4ef02f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597204, "uuid": "f956f918-afb5-44b9-bc24-25dfa7bfd8b1", "comment": "Malware payload (Formbook)", "value": "b6891539907607907ebdb68ab43e3ebbf61b3d51274da7e3b228c553363e7c4fa626d609d769137fe06ab4869c0c250f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597204, "uuid": "1f869247-e4ef-4257-a2c3-ebb6af178d98", "value": "T18094E07D3B7B9F44FF354EB16C88D240763DDCA32086C36C1A48B46CB962BBD5991682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597204, "uuid": "dfb95497-64f4-4453-8f35-ec047d62ad66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597204, "uuid": "34a2e286-6fb1-44c0-9052-198b87e660f4", "value": "12288:N+MNIHnVU8angmqKtRGyY1DRvLHOEnWWDFjcWrt2o:qa8YrqKtRGP3yiWWDFjBI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597204, "uuid": "2dcd8f89-1762-4767-80cc-9198b1167858", "value": 445952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597204, "uuid": "f01e6630-c6c7-4215-8b26-41216803415e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597204, "uuid": "78d90e11-ae46-4b22-9e09-d6ac6af98954", "value": "2d22112d700c43db2b3baa6b2e38d625.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d5cba9-274f-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633598282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598282, "uuid": "36a47a22-3f9e-43c8-bdb5-e4f6975da84a", "comment": "Malware payload (AgentTesla)", "value": "0fc243e11baadda4bb0967eeb5075cc5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598282, "uuid": "c402c021-7bf8-4676-a2d2-53ef558daabd", "comment": "Malware payload (AgentTesla)", "value": "e11cd920c0364d02808dc229c246c68a2275da247cc70d9252a02dd2d141918d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598282, "uuid": "fb8b718a-98a4-48a7-b14a-6755ddc5de75", "comment": "Malware payload (AgentTesla)", "value": "f609fc23f540fd3788d78b7290725b970f98d932", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598282, "uuid": "595c85b8-59b7-4963-93c2-ea7f3ffb7a01", "comment": "Malware payload (AgentTesla)", "value": "d9945831bad7cf2ef0a8b573d0bc2960d7063d32a92479ef68a5f9bdae5780e743e1b1e4e097c8a7d9e165d8c3dbc00d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598282, "uuid": "a15d3543-5d2b-44d9-a8d9-43402db14677", "value": "T1BC9401A8632B9604CE7843F43D29A7911336E015616EC3381EEDA4FC7EA77B49AF0547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598282, "uuid": "48cba4de-ef43-4c3e-a41c-eb22dc32d0df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598282, "uuid": "f82871c7-2bdd-48be-b2c8-bec52ad63d31", "value": "6144:3M08gZXDQ+3HwO2Dtgt14RYbxuJxsT4LFNsofRnfkJGdVcD50mEcsoiYn3IUT9nj:XkoefRE0xsYFNL5sJAcN0mE/Kri", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598282, "uuid": "ca6e8294-2ce3-4803-8e24-060bf04bac51", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598282, "uuid": "0f698f68-48c4-479c-9fa1-97382f60de74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598282, "uuid": "f9ea3689-277e-496b-a45b-d9b6393b35b7", "value": "Reconfirm Remittance Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffadc5e7-27a0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633633297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633633297, "uuid": "831b1a74-a045-40e0-9daf-d6f1f39d5fe8", "comment": "Malware payload", "value": "f246340ac7099b305bc56b03c317e6fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633633297, "uuid": "a5659b7a-086d-4e98-813d-984b787103de", "comment": "Malware payload", "value": "e18efb7cff387e8b7ab7e7882841d21e5d6c3e9bddaa289a30315a54352bc39a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633633297, "uuid": "f9b89a50-cde4-434a-8850-b4f72d89ba3b", "comment": "Malware payload", "value": "6f6223bbfac0b87e03cdbc0eb3e7c71f9ca92c28", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633633297, "uuid": "f7dfd1dc-f0eb-4014-9366-f68dfa4f87a8", "comment": "Malware payload", "value": "653fd3fd8d5a06639c5549ee02db6251aaa5a194480375a5d418bac39bf81eafc3a8a8d28293abde15dcbf4a709879c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633633297, "uuid": "9a8a745f-d0aa-407b-88cc-8516dcfcdb3c", "value": "T13C963314DF115A89E1A0403077740C33C07794FB8F64A8B6A82DE61B52EBEDCA6B5DBC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633633297, "uuid": "350a74cb-0c6b-4c9c-8a32-d6731ca5869d", "value": "bbadd88e560afea1d0dd8f728c4701ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633633297, "uuid": "4c17f0e3-d269-4fc4-9933-a46eef50f1b2", "value": "196608:BXU97Bz21W0x7QICteEroXxtVfEqlbkkwR7VTEJZFWylVoUaQ4bnlw3cil:ZU9lz21W6QInEroXNfEqirRRoJZTlVok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633633297, "uuid": "6aa523ff-28a9-493a-a727-d116621be9b4", "value": 8914398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633633297, "uuid": "00e54f6a-983b-4365-aede-788dab7a3921", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633633297, "uuid": "a0193875-5404-49d5-9deb-6bac5a4cb56d", "value": "f246340ac7099b305bc56b03c317e6fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd624df2-2775-11ec-843c-42010a9c0014", "comment": "Malware payload (a310Logger)", "timestamp": 1633614745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614745, "uuid": "2f588085-f275-4d04-aa62-5e78b9bbb985", "comment": "Malware payload (a310Logger)", "value": "70eeaeae5a9624ca4fbaaef91d2adfdb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614745, "uuid": "e17a37de-a31a-41bb-9022-e93ac191ebbc", "comment": "Malware payload (a310Logger)", "value": "e2974131c2b7d7c62379556b860db19f2dd28dbd77eddf01bd0dba673c5cd6b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614745, "uuid": "47c3c652-29b1-4fd0-af6d-f6c3cd74068d", "comment": "Malware payload (a310Logger)", "value": "138562d0a5a8a6e95e2d8ac4e627b9c4fc4c8382", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614745, "uuid": "56f4abf8-0a41-452e-929c-07cfd8d4e25e", "comment": "Malware payload (a310Logger)", "value": "7c2de843ddcd089f1b5350f24a455ec7a8ad45796ade03395d0a7df1beefa67facc584009a57dea4e8f8930478661e19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "a310logger", "colour": "#64A82D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614745, "uuid": "87a8fa07-73e7-4369-9c7b-9399b5be896f", "value": "T1A8F2D455E548C520C1AF76B688ABD6B402D0BD27B967C72B64DC3F8E3DF23114B02956", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614745, "uuid": "b8924448-ac62-4270-8089-dd888139721e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614745, "uuid": "f014d4f3-f46c-4ce9-abc5-c9b15c7f70e3", "value": "384:/i4USCeTm1uMxjzXK9byEvb9sPESkV/7ijV/tasUW6fFQ+l:/intWm1BxjzXK9hvb9ssSc/OjTJ6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633614745, "uuid": "933789f0-3bf2-4df1-a443-09742fd7716b", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633614745, "uuid": "c75f46a1-8139-459e-8259-ddc3e6d70c00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614745, "uuid": "82a2dc2c-0c1f-406d-b54c-ad7876117e33", "value": "70eeaeae5a9624ca4fbaaef91d2adfdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27704e97-273a-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1633589126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589126, "uuid": "8ae7f89c-6197-4b01-b7e0-0dd12c47012d", "comment": "Malware payload (SnakeKeylogger)", "value": "10808bd39b8950f2518537a6094f24f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589126, "uuid": "bdb0e338-f3c5-48d6-915f-cbf25c280610", "comment": "Malware payload (SnakeKeylogger)", "value": "e2b899baa7500884e7dbe9219f641996f11ed287b17abcce04764815d64895ae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589126, "uuid": "b5913644-f489-459b-82b5-b0e578e85688", "comment": "Malware payload (SnakeKeylogger)", "value": "f95be25353f78dd7ba8acee83011fa8da81deaaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633589126, "uuid": "be29f744-f93b-4775-9901-c21850f4891f", "comment": "Malware payload (SnakeKeylogger)", "value": "a14386d53d5759abb38ae8d6f265b47ff00360506b3ab03a847bffdfd0a4f4105becb55a78bbf2cffb00c4f53cd9b4c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589126, "uuid": "5e5edb89-451a-463f-ba2a-e37a98e42154", "value": "T1E664238566D08EEAD0125DF102BBE678D33BF13AC1B386030FE95D4BBE753964B69106", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589126, "uuid": "13237a63-c127-4e1e-908f-082be3db183e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589126, "uuid": "d990ec15-8d82-47f0-a14d-1b170dbefe23", "value": "6144:b8LxBBXs3KsKjekmHbIDMsfDKt7zk/jS6kbxzhqFOBKKjXXve3ENJa:ys3KiIut7I7OlNKOfJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633589126, "uuid": "74bd2503-319b-4f02-beea-3debf1b098f7", "value": 328220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633589126, "uuid": "d3f9f544-815a-4b98-9034-75971e6fd9fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633589126, "uuid": "094a23d6-51d5-4df0-809e-c80ee497b6a8", "value": "10808bd39b8950f2518537a6094f24f3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2b0359f-278c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633624632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624632, "uuid": "869cc0af-5f57-4ace-90d8-2c6a8e95929f", "comment": "Malware payload (Formbook)", "value": "ddb57c15a6edbd9e2acdab76a2aa6688", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624632, "uuid": "f2e3820d-22e9-41fb-b32a-97d7abc226b8", "comment": "Malware payload (Formbook)", "value": "e2ba9fe3bc223a5862f0e56371f39f207e15427941a07fcf0a1241aaeb2e53a8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624632, "uuid": "b98c7a60-122e-46d6-b7e8-027ce3b9318b", "comment": "Malware payload (Formbook)", "value": "13a6123fdf046374395bb55e4d6b9eb4cbe3b655", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624632, "uuid": "48b7210d-a10a-4ce4-99db-49f63ce6f418", "comment": "Malware payload (Formbook)", "value": "628a0a2cb8dc50c3f1aea7263e656ba9444c559a41b331d13d6a85644da33cbd1d555dcac0c8b9fa5c74ecb3e9cca4e3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624632, "uuid": "cea587de-b95c-46aa-bc5c-f0b63e8ef69e", "value": "T1C56422A9BDAB7BB7C2B1CE75890ACB054858FD557FA08760909837434475F22AC0EBF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624632, "uuid": "c5d3a295-76cd-4038-b330-588370b11786", "value": "6144:RpXVeICBgrBf/YcZUsVsgGhp5Xp5hNr7p4ln36oYEvSaKe1nmXThF+EeAQ:jg3gVf/YOFq5ZV7pqKoYCSRNF0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633624632, "uuid": "791cefb4-5d15-4fbc-b6dc-7b29a7b2982f", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633624632, "uuid": "0588b6a0-bc0d-40ce-80b4-4eac62b285bc", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624632, "uuid": "5c3df6bb-15f2-40c8-94ac-7f9fc7ebe019", "value": "Contract 20123.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac8ea3fe-2757-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633601805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633601805, "uuid": "878739c1-caec-4db4-9fc0-a9d5d420057e", "comment": "Malware payload (AgentTesla)", "value": "1b99840ab092e704958c9b4d6eba5a08", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633601805, "uuid": "93511b48-8663-494b-9cf7-d22702a82530", "comment": "Malware payload (AgentTesla)", "value": "e325cda62d08cdff25ba4af0ca17a11fe2a37d237c43d6e2e01f93ed3ea2086e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633601805, "uuid": "decc3131-4fc3-4a28-8752-a36ddaba34ce", "comment": "Malware payload (AgentTesla)", "value": "68cf1d03d1d381032572b5464f88d0e4b42b13bb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633601805, "uuid": "99a8edc0-c048-41e9-b64d-8e8da1cea3c5", "comment": "Malware payload (AgentTesla)", "value": "13a17297ed7d0807f724ca6ba72de627aa96fee7b36789afa3ee5d59b079210115c18d87dd14ee99da2102032ae692c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633601805, "uuid": "9c027feb-b227-4e6b-9e48-05fa7573a126", "value": "T159A401A81337D308CC3D47F42954A7512735A126246EC77C4ED8F4AD3EA7BB84AE168B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633601805, "uuid": "cb5db9b8-3017-4962-bfb5-95a0e4be1eb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633601805, "uuid": "84b00465-09b5-4919-8484-a9631913022d", "value": "12288:RkofLqXYQtRQsJOj+vm/dxQdEJkIsPaD:RksLqI6RQsJZpdEeIsC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633601805, "uuid": "48495979-45e5-44e7-b05b-e6de8b3e1bf4", "value": 456704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633601805, "uuid": "b25d56e2-135e-49a0-9d91-c362dd2bfd77", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633601805, "uuid": "bc75b51c-215b-4a76-bdbb-bc27668cc3ae", "value": "RFQ 10042100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179b7c86-273d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633590388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590388, "uuid": "4a3559fa-d68b-43d8-9a2b-64ef4e214884", "comment": "Malware payload (AgentTesla)", "value": "503975b2f4cdadcd6cb0000a8abb2458", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590388, "uuid": "a06173fd-055a-46c3-a007-2c7de7504e59", "comment": "Malware payload (AgentTesla)", "value": "e351acf5796a967e5ed9c29ef762eb1669186a7e2ea7d207b1bf966e9bb4b81b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590388, "uuid": "7f433b93-faf4-4203-a331-3b33a3e40c1a", "comment": "Malware payload (AgentTesla)", "value": "310441be942416896c7d23b7fac6e595b64061c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590388, "uuid": "00bcb13d-0085-4823-8e68-b0e3bb38e659", "comment": "Malware payload (AgentTesla)", "value": "153eb6cc95394eccfb0393d02462a3abdfa6a4e2947997d005ca66d7dc3d3add0b846b5882e67821954899f6f921bbd0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590388, "uuid": "b701d625-2522-467b-a813-56d1459fdedc", "value": "T13DA4F13D72A7CD04DE7146B2EC9E849517BCB817316ADB382A8D71AD24227F44DE41CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590388, "uuid": "f72a3dad-2679-4d8d-9069-fb02127efcff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590388, "uuid": "3c7778d6-a40d-4486-984b-5c3cba8c9b08", "value": "12288:STjHoE8NrvnmPICDYgoMD5oc+NkJ5sHYxILv1VuuMime:STjHpxPICDNoc+Nx40M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633590388, "uuid": "fb72b191-0912-4ecb-a35e-a84f01d40364", "value": 460288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633590388, "uuid": "eba3351e-c802-420d-b36b-e88ac12703fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590388, "uuid": "a00bf5da-0a49-42ae-b931-d816ff855699", "value": "SWIFT MT760_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d9ac95-2789-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633623403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623403, "uuid": "927b8f63-f520-4683-b5a6-2a226acddd7e", "comment": "Malware payload (Formbook)", "value": "cbd7a53e96bdac43eab1d17d7cd2f3d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623403, "uuid": "9de71728-c269-4ec5-97c9-9e84e4fbb5c0", "comment": "Malware payload (Formbook)", "value": "e3688d8caa70a496aa55ed70190c2d7fd53487b21f286d14ea6849d78cd375a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623403, "uuid": "923a44ee-8adb-4e20-9726-c9feeda07ab6", "comment": "Malware payload (Formbook)", "value": "6feafa94d202c84d1cf2b5ad5d29678ab3904175", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623403, "uuid": "2512f614-9c4e-4f6d-a355-70491bbb69be", "comment": "Malware payload (Formbook)", "value": "917eb3962955ba4722acf543d929baf2c7a949881f1bf3f076c3cae10841e202c60860ed3c63031796905f16193275eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623403, "uuid": "39bcebad-4531-47ea-b0bd-ec46756b72cc", "value": "T14C548C119682C430F65240B86856C2378FEFED3D2802E76B7F6E16D84FE6961A2553CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623403, "uuid": "6dd81999-005b-4b6f-a11c-8333899e33af", "value": "8a29d5b60fd6ca6491e11ecd8084e737", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623403, "uuid": "3b570aa6-339a-4232-99e3-fdd95e6d339b", "value": "3072:1kc6mNLJkqWsV3m+lhUJUn2hjuoClIxZ009CxykFSc05qOk0J2nvb8jrrJecYAWf:6zmdJiJuoMQF9CxX/tO7JS4PIcJhOh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633623403, "uuid": "dce32c6e-21b6-4746-9b5e-1fcebcdd5ca2", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633623403, "uuid": "815519c8-200e-4915-9ffb-33ed14aa9c0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623403, "uuid": "ba8f3115-b255-4d61-8408-930f49b2adf0", "value": "Proforma invoice Shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35501d3d-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633597310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597310, "uuid": "04e58294-9238-46cd-8315-1f01c5c541c6", "comment": "Malware payload (AgentTesla)", "value": "b38ca91bd9b168b4821cf21305de9c34", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597310, "uuid": "5be70f3b-e0e2-4b28-a6de-b7424c1dd5c5", "comment": "Malware payload (AgentTesla)", "value": "e3f751da881f303c6203c7e88442b0e2c10edaf201a2d27f6cace2cfef05d969", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597310, "uuid": "46a3ab8a-2f39-4f75-a6e6-1e6d719edb4d", "comment": "Malware payload (AgentTesla)", "value": "aa7a319ec042073e91422ab699586406a0204785", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597310, "uuid": "1611485b-6364-4dc3-9857-49ccf5714c38", "comment": "Malware payload (AgentTesla)", "value": "54a41e18973f066d9d0f5c10ce5b3507e05fce5bb64fa945d5eb1776b900bd4a6a61e7cc11d591dd1e386d8b9ef4ccbd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597310, "uuid": "40b247f5-7dbe-423e-b926-c3aff6626a6a", "value": "T1EF84233FF2540A2034ADE408497CE018640B61FB91ADB673BF0C69D7F4AF35BA1665AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597310, "uuid": "7c0ce38b-8c6b-4220-924c-5563dac14722", "value": "6144:x28g5PurXe6H+olBZ4rk58Q8ajcWgaN8qpFQy+hP+fGCnXzpJ+E1HErnT8dA:x28g5PouRgyryEXq+hWOCXzb1C8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597310, "uuid": "29a5bc13-e3ac-42f8-81b4-5c8cdd19c3cb", "value": 386370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597310, "uuid": "e07baf5a-bf17-4d51-8785-8213db4f4953", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597310, "uuid": "d873d056-b7f7-4545-b758-7612acc63b49", "value": "Purchase order.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "804ce24d-278c-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633624494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624494, "uuid": "ae7e5d72-d6d7-4083-a3f4-98a907131448", "comment": "Malware payload (AgentTesla)", "value": "714fead84ff7355475f9eae1e888c18a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624494, "uuid": "0f093aa8-57da-4fd5-988c-1d80fb70964b", "comment": "Malware payload (AgentTesla)", "value": "e423a69c7f235dc0169e41b5be2b61e261fb9a603bd57c03eef272f3932e25ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624494, "uuid": "cf57d1b5-0958-4ded-a2c3-feadadaf4955", "comment": "Malware payload (AgentTesla)", "value": "2985405122ff1fad1d9cb8c00ee06742cd4680fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633624494, "uuid": "500c18fe-f51d-45e0-b071-0fc4ee61df1b", "comment": "Malware payload (AgentTesla)", "value": "ab2897ab2aaa489ce2e76e989e609186bb7cb78a05b3416c4a45448c34c8e8b8459961c6210462e0a7ea840c50ba78b8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624494, "uuid": "200950cb-9f7c-4e4d-ac67-cc949a5d707d", "value": "T1C2357A70C6513DDEC2053F66D11E293D1CC9AA1B47BB6786EB8B58F81C62208FD8D963", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624494, "uuid": "572d116d-af9f-4126-bb71-f359d4625617", "value": "12288:hskYicFtzLMCdZV8Yk/FRILCru6XnhZUu6ok:hsrFtz4oZkt22tnhZUxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633624494, "uuid": "7552f23f-9ecc-4bbc-9806-20fc463d5b82", "value": 1163803, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633624494, "uuid": "0f8d3980-dafb-4b04-a816-2874d37f48b3", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633624494, "uuid": "6110ec3a-c060-4754-bab7-5d695613c7a2", "value": "PURCHASE ORDER.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27cbcb3d-2782-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633620050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620050, "uuid": "b7b98da2-c99e-41a6-9da7-121693cc157e", "comment": "Malware payload (Quakbot)", "value": "c4a9d5acf85fb8b73f99563c30475bdd", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620050, "uuid": "e9dbc71f-0a39-4179-aaa1-7226e4aef608", "comment": "Malware payload (Quakbot)", "value": "e491465f796f2a80be0d7cc944825521b523dc1a351357935ffcf32c13305757", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620050, "uuid": "6d34acb5-473b-4c43-bb83-619c21d82559", "comment": "Malware payload (Quakbot)", "value": "86107b0b930adaee0faa419ee700fae44c7414a7", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633620050, "uuid": "b1431a87-9c4c-4ca1-99ed-75272f88f82a", "comment": "Malware payload (Quakbot)", "value": "05679d5d050074e13912e5b1fafc0686017b70c89510de9c9b8bebe0b5134fc3ab203213cbcdb5bd3c7385b08dc9ac80", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620050, "uuid": "0917598e-179b-4096-8ccb-69d1cb3fd078", "value": "T150D39C463797CA5BE58803398ED3C79B3B72FC21DE72470336463B0E5E7A6A18C16652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620050, "uuid": "f9719c97-d777-48b0-b2b3-8adf2038da8f", "value": "3072:jk3hOdsylKlgxopeiBNhZFGzE+cL2kdAFc6YehWfG0tUHKGDbpmsii342ti+RLCY:jk3hOdsylKlgxopeiBNhZF+E+W2kdAFN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633620050, "uuid": "c3a4a704-393b-449a-b018-7604c077e058", "value": 137216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633620050, "uuid": "31541120-c9d5-4b40-812b-e5f86842f0ed", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633620050, "uuid": "6ea3d2cc-fb1a-4b02-bf4a-98dd2052baaa", "value": "AMLRPT_819011139.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6b903b3-2775-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633614760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614760, "uuid": "8bace5b5-6667-42ed-917d-7140d4442e6e", "comment": "Malware payload", "value": "c82829f407ca969d3553bf5bb86fdb38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614760, "uuid": "867b77cd-c4b2-4b87-b649-5e9e99d34c5a", "comment": "Malware payload", "value": "e5e4040c48a3b61fa0764f33c6d2192745d0529a14f58a95f46bd3db621c5334", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614760, "uuid": "236e2841-cc72-4e0c-91c7-9cd2fca86412", "comment": "Malware payload", "value": "576edc086e903ccecec5ae7cefcec35302f065c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633614760, "uuid": "4f9c7f7e-9e1d-4316-945c-404cd0c38ac9", "comment": "Malware payload", "value": "d310e62a0ad3929c95ed5c63e4e3587f901927c1dc5406d26dd5c62d3f072b9f0ce2e40aa85a4623852e4512f08bab10", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614760, "uuid": "5ff364bb-a2ce-43f1-a81c-9b0975f6439a", "value": "T1C4038F265BB8151AC2C76EF785A7A54CF2F0D2A10717C33A4592071DBD2BFD9DB81780", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614760, "uuid": "98cd8515-35a4-4727-af27-4de6c5de1333", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614760, "uuid": "2953f4b9-5160-4b68-87d9-ef9ad39c1034", "value": "768:Gp77qH7Ct+DdYERbGZdZqKJQYXt1NLEggYiJW3oc5y/mhP:qfMuADdYERbidsYXLxExc2/M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633614760, "uuid": "49ce0c43-7793-4cd0-9a0a-95fab9a57f77", "value": 38400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633614760, "uuid": "ef67ae6d-0346-402c-ab54-5810dc5f353b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633614760, "uuid": "572af922-adbb-4ec9-91bb-fb72091c0101", "value": "c82829f407ca969d3553bf5bb86fdb38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f0ea350-2758-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633602158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602158, "uuid": "14a56469-2ed8-4ff5-a950-5e55e8ac9b5f", "comment": "Malware payload", "value": "c6ac0fdb4df8e466f18b94ae8fe88893", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602158, "uuid": "eea8b8be-39bd-471e-a35c-ad27f53df71f", "comment": "Malware payload", "value": "e6e924797591a025f7777013403c6d38bc5cc4cd58bd0f2a3182184f4b2054d6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602158, "uuid": "d117b85e-958c-4154-8208-9362b1571e34", "comment": "Malware payload", "value": "79469d0e9b28a497d19ab8912cbee645be33255e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602158, "uuid": "0bce7834-3165-4d71-bf7e-7cf49d509a65", "comment": "Malware payload", "value": "d4450a918bec32e8a2012961c2b884f27a8ca0767a96ab073c33ff96516be1bf45322a708bd5230d50b7ea43a3ccdbd6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602158, "uuid": "0c807a98-a6c0-460d-8de2-17a6e983bc5b", "value": "T1F194985B1A0FC6B7B499936BC5A8D0EB3E8280DC00B5C1C77D5DE351CBC152EA62EB52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602158, "uuid": "98254b0b-daf8-441a-860c-a0a6a68c6b51", "value": "6144:rSDne2dq+ZU4NIQzKaHabslPJl9881OOMH3IHaG:wdqKX96glPXO81jMHYHaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633602158, "uuid": "ba73bd9e-06a9-412d-94a0-ff2db8a5241a", "value": 435793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633602158, "uuid": "8d075ea9-32f8-496e-b117-dbcc5cbf4573", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602158, "uuid": "2456ebda-6f05-4cd1-b52d-cc533cfaef8b", "value": "59874.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ae40f3-2797-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633629414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633629414, "uuid": "30ac04fd-1fc8-4430-ad07-853a7d3a0b48", "comment": "Malware payload (Loki)", "value": "58171df905f5248148f44405b4670027", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633629414, "uuid": "6c904735-a905-4a9b-89c5-a8f4ecd43eeb", "comment": "Malware payload (Loki)", "value": "e70dbed2d62531d70e5e53354eeee7dfd41745d5ba04ae01e102b2aed391c10a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633629414, "uuid": "e6f8d47c-73f9-4aa3-896a-6465778bfd71", "comment": "Malware payload (Loki)", "value": "82a9a1f9afcaa030b711a7cd3d1bfac19a2949fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633629414, "uuid": "e8c8ebd7-1fe1-406b-8911-2c76ac3d1783", "comment": "Malware payload (Loki)", "value": "207c81e2dd9ede0c47a870a5602d52153b260add2db17dd6ad3b063a9ffa77f0321cc22283f43e1fdef52543942f7f11", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633629414, "uuid": "8d119402-ca12-42cd-9910-3875cb8b3d16", "value": "T14C15D4002299C711D1B637F5D860CAF093656D15DA29C28B2DF1BEDB79B1B03CE11AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633629414, "uuid": "8ed5dce7-b88c-42ef-a067-218690b04892", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633629414, "uuid": "6be38206-959d-4f55-9518-90476b25d28a", "value": "12288:jJF05DyL9pD3n+0SzMCtsb4+e6kYSfqS32wij6m0OT:18+L7D3+1zMMsWb5SS3Vijff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633629414, "uuid": "ee9e5441-12a6-425c-aebd-a415253dd6cb", "value": 953856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633629414, "uuid": "51819c2a-7d9b-41f3-9795-be7817d957a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633629414, "uuid": "70e91a5e-acad-4247-90f6-d2a10be0fba8", "value": "Detalles del banco.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5c50607-2725-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633580426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580426, "uuid": "a101a749-01dc-4389-8a2a-104a81e39e28", "comment": "Malware payload (Gafgyt)", "value": "da647c7bb1ac751d7e8471f1d160a1f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580426, "uuid": "679e2f16-da91-4188-822a-e26e69af337e", "comment": "Malware payload (Gafgyt)", "value": "e746701fc9094f1f3b543e71922ea4651b3ecfbacb6045c534cbef42da23b439", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580426, "uuid": "52d404a0-e8b4-43f4-af68-fd233e15b2c3", "comment": "Malware payload (Gafgyt)", "value": "187fa49772d011dab0f43a11ff804fd6710017af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580426, "uuid": "6b4e0bff-a094-44af-845d-91453815df9d", "comment": "Malware payload (Gafgyt)", "value": "26e80693584f2f8ad5354db1e247e001d2e250b35cc3798cbde98ffd78260f4eae7e98f48a98ffa5faf2c2dbfaafafac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580426, "uuid": "14b6e754-5cc0-4843-af8a-e38c854d8c76", "value": "T11B931A45F9408B27C2D327BAE79F439D37356A6497DB330169297EB42FC27C92E29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580426, "uuid": "4b2d9e57-c8cf-43e8-b9aa-9750a164ce4d", "value": "1536:MSfNq5P0rPRAn08FOpSPYU9u0BODsvXOPwvfGJ5ryMg6tGXNyYgrEDGoew7Wefvh:c5CAOQuUXOPtyVvcmCVrQAFiOXkYe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633580426, "uuid": "bfdcb231-1557-4843-938f-9de09d397bee", "value": 96946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633580426, "uuid": "7c86e2a5-7aac-47c8-9a7a-546facb1348a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580426, "uuid": "24b0a3c4-64e5-4cbd-801d-70c19b19f10e", "value": "da647c7bb1ac751d7e8471f1d160a1f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b746cdb-2736-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633587495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633587495, "uuid": "97158d65-b0c3-4942-9139-9f87767485ac", "comment": "Malware payload (AgentTesla)", "value": "f185cec9578f82d0e3e03a6b5f8158f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633587495, "uuid": "07a171c9-bbde-4eb2-99f1-bc0a52373aed", "comment": "Malware payload (AgentTesla)", "value": "e7f8dab71084bac2f61fb44bfb0b3b2ae7bc5299b7103751380d3d713de2629b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633587495, "uuid": "e85924b3-e82e-4f1c-8a34-c204f0cb5b71", "comment": "Malware payload (AgentTesla)", "value": "78264a7a69f032be32a9c5d6f2a8bde59b3de379", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633587495, "uuid": "80552cd0-4a3f-4b89-941d-a714db0827dd", "comment": "Malware payload (AgentTesla)", "value": "1adab78d6cc96d7aed917b0e22b5ea4b107b21d80eff8e6cc1a1c1e9f79893b1790594687c46c943627fb06bbb2d1e4a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633587495, "uuid": "4735e320-d136-4356-951b-7b55a14818c1", "value": "T18AA4E07E3263CD00DF7082BAEDDD955007B8BC13316ADB396A8A62AD78127F44D905DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633587495, "uuid": "35111863-5e3c-44f0-807f-fb6a2f02b587", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633587495, "uuid": "1daf0f82-2d45-4af0-bdc4-841ee2607126", "value": "6144:FQyK8Q+3HwOGeIrAuYCmSI9IsOPWtzA8BaaTdAp3sPNCVqQzUVzwVuIiup/ihgKP:XKNoGeONYW8CWtz/au2pQPVLIiu9i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633587495, "uuid": "1ad97441-36bf-4387-9bbf-2f33e1f21053", "value": 455680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633587495, "uuid": "50dd1e4f-e396-4d84-aa93-751f40a2a8aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633587495, "uuid": "5c528f2a-2e57-48fb-b206-2e20f1a78498", "value": "301086.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89bfd994-2759-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633602605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602605, "uuid": "955e7fac-2bcc-4117-bad8-04b006c37089", "comment": "Malware payload (NanoCore)", "value": "904bc1be206422ad6d3cf7542634506d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602605, "uuid": "e0a27a1e-f719-444d-8938-fd971ff7d3f1", "comment": "Malware payload (NanoCore)", "value": "e833e0cadc169f826504773c1fa084b972c4080dc6b4c4a2e562bc24af478b69", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602605, "uuid": "388f44b5-53f1-4665-84a2-f072eb1a171e", "comment": "Malware payload (NanoCore)", "value": "ba959b7919e433be41785aadf5a000785fc3298d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633602605, "uuid": "77abe1df-7d9e-46f5-9f06-9b0b3c4cb0ce", "comment": "Malware payload (NanoCore)", "value": "899e8dcb3dfff3378c40aeb10f9f28984dff27b447b5e00132b7c2f2a8183a4737b420909fd35d197ce75a63f0da4ea9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602605, "uuid": "199b33f3-17a8-458e-90b3-97a62954f40f", "value": "T18A940198137B4B09CE788BF03955AB9113B5E0121669D3385BD8F4BC7D977B88EE0287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602605, "uuid": "cbe7e276-744f-4af1-bba5-eb6041f1542d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602605, "uuid": "7f834df5-64f1-4a99-a020-b11a2e7ee229", "value": "6144:hsWZIcQ+3HwOBoRnaiuag2MRyB/cwVkXa0KNQqg7uwADaCFrJCZvbBISixIXSWD0:hatoBmV1D3+03FdwADaCFubBIGDR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633602605, "uuid": "6630781d-41e9-4d1d-a710-d97f67e40500", "value": 437760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633602605, "uuid": "ea593dc4-6d5c-4eb7-96b5-23614849abc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633602605, "uuid": "837d4ff1-983a-4f62-bf7a-2b9267143c5e", "value": "Balance Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51dd02da-2755-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633600794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600794, "uuid": "813c5d75-88bc-4aba-ba43-d1088c1b3293", "comment": "Malware payload (AgentTesla)", "value": "d88aaac3bb0d123f64b32573a3726590", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600794, "uuid": "81d9c9ba-b2ca-44eb-b2d9-4c81c3b02898", "comment": "Malware payload (AgentTesla)", "value": "e85bb62a37225d46fa4f1202eb6c0453ff5efcb64a5372d951345f72e67a3e59", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600794, "uuid": "ebd87ff7-d861-48aa-ac39-976b8e9297be", "comment": "Malware payload (AgentTesla)", "value": "59baaca57e0e6a52430946844503fa4a81ee1758", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600794, "uuid": "e3743cac-135e-461b-9676-44f467b8d969", "comment": "Malware payload (AgentTesla)", "value": "c67623782a4e4fbd92a3a7c867971cd65be5999beee03d721b17e746734b99491faee204140f12eb67691dbf8f3a56fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600794, "uuid": "83a9a440-4896-43ab-9968-bd221d929b11", "value": "T14DA4022803A39609CE7947F52825ABF01F74B016211DE37C5BE4E1EC3E67BB54AE0697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600794, "uuid": "da449578-3e05-4432-9486-1dab5d6cda05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600794, "uuid": "442e0fdd-c2c6-4af3-afb4-ef06e7a18402", "value": "12288:mK8kouISYGYJPwFv9DbGhuFWiIGWIhr2eLYuOzLMxaZgq4:N8kpIS8JI9+u8JG/aesNOaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633600794, "uuid": "d1732239-76e8-4eca-924e-fe9220411a1c", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633600794, "uuid": "5489a105-ff54-4e3c-ae74-9d0098967e7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600794, "uuid": "17f21ca9-edd0-4698-b46e-f9d5fbb6c19f", "value": "Scan_210715_14_29_19.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d56146c4-27a7-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633636233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636233, "uuid": "b833bf2d-eefd-4702-9b31-4409e1b12579", "comment": "Malware payload (Formbook)", "value": "c49c52f46d724a3065e0f033b7b615da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636233, "uuid": "03c57284-b182-4f09-bdf3-5d0397516a3a", "comment": "Malware payload (Formbook)", "value": "e8d3f12a56c28288654561a8061cf6127bd4c6baa4db19ed35faef1bac454335", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636233, "uuid": "582ee14f-c359-4fbf-ab4a-e7c6805e5d46", "comment": "Malware payload (Formbook)", "value": "46da08a0f4f0002f645486be56d779ae13af33e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636233, "uuid": "65e5a362-5ce2-479e-b774-9bfd0033fb83", "comment": "Malware payload (Formbook)", "value": "e09feb5830e776aa9b71286b9c7ee068f86f42e8d30863d78135dc31ad4b78cfdeec777242b739e37485d7e81de45494", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636233, "uuid": "bd550d90-ec1b-4d11-a7ea-0f49dc13e2b9", "value": "T1DF25E6002695C701D1B637F4D864CAF097656D45DA29C28B2DF1BEEB39B1B03CE11AAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636233, "uuid": "519d4220-8d27-4872-a412-372e18ae5136", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636233, "uuid": "aa81692e-1589-4d75-a058-9913b9e8ea3a", "value": "12288:SHQ0/DyL9pD3n+0S9p2dHmPjal2rrkNyFqkqolI:sl+L7D3+19MVmPuMINyYkdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633636233, "uuid": "acf4ba8f-7bf7-4484-b7f7-acf4a90441da", "value": 1014272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633636233, "uuid": "a636c817-41e4-47c0-94c3-e6cb8b904d0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636233, "uuid": "59ff3699-18e5-4311-8439-ad47959dafb1", "value": "c49c52f46d724a3065e0f033b7b615da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdff901-2752-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633599529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633599529, "uuid": "3eb569c5-5ea5-4c52-83c5-81374d8a2ec9", "comment": "Malware payload", "value": "29372f67c6d65740a4c4e0061f8747a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633599529, "uuid": "41bb125b-0da4-41bd-87c7-e96d3e1487a5", "comment": "Malware payload", "value": "e953da6402f54a2f4a0fd775c82c0dc77ffa7af0ec44d4fd1ce7f42dbfb766f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633599529, "uuid": "bc602611-60f4-4927-9a07-d69fe76d2c73", "comment": "Malware payload", "value": "734b40a7e85b0720caf910e092348986b2806203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633599529, "uuid": "a9927b14-7b35-47be-b114-3de2668eb93a", "comment": "Malware payload", "value": "e140e650ce2e2bccae3824027bf6e1f55ba5fa0345e1fc639fbfa5e90591a13335d2d229f600e5c8c1b6e92abefbc3c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633599529, "uuid": "8e66b32a-6473-4a5d-83ac-afe63ba193e9", "value": "T118778B5773B50184E5B7D1388AAB4213DB73B8668730CBCF215D03592FB7AE59A3A720", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633599529, "uuid": "85395986-ca27-4793-8780-e4525554957c", "value": "338f7e7aeeadc39b5954b959ee859d32", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633599529, "uuid": "582ff3ce-26e7-4e52-89bf-55b3c60d97ff", "value": "393216:CpIMX/BFDRn5kd4eqJbJMKg+DVMr1PJvKXPDaF9W37mzOlBOLfK6mIDwDg:CFYK/hlBOLCpDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633599529, "uuid": "2f7501a8-07dc-4a22-8f38-9d9ac66be4e1", "value": 35204701, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633599529, "uuid": "035b264e-563e-4f3a-8ba6-e4294d8c5466", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633599529, "uuid": "6c64d703-e63a-40c9-b403-f852b468d248", "value": "Pine_Forest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87dee546-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633597448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597448, "uuid": "b39e7df6-4000-4dd7-97b5-5ebbb3bbb4fb", "comment": "Malware payload (RaccoonStealer)", "value": "315a2814329e4da0c14184c6d049899e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597448, "uuid": "2127cae7-8c76-471a-a6e2-8a12837e6fb0", "comment": "Malware payload (RaccoonStealer)", "value": "e9937b021c7034a3099202be72b2027920c919d62976a4a62dc5488d6914b697", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597448, "uuid": "2c46cfff-10a1-43f5-9fdc-bfb7d032cb65", "comment": "Malware payload (RaccoonStealer)", "value": "b3e0ea1c58db90c027516617f3f0ead02f9bd2e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597448, "uuid": "29b1b838-a4fb-4ce9-ac80-b118ae13a187", "comment": "Malware payload (RaccoonStealer)", "value": "f9b99c82f38439a195b1cde104c280e7ba408189591104ed8630b00118f7e45eceb0fe7ed9773ef3686dcac1a8d04add", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597448, "uuid": "f87d048b-75c1-4900-973b-c439237ab5ff", "value": "T1C39533286AFC6A8BCA4C5BFB5E15400571D19CFC0E63E43559293AF8FA355E2378F604", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597448, "uuid": "fff294eb-f7a5-46cf-b650-233fe2149d6e", "value": "94e2b0572ac9e87d08b3c525a2cff4f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597448, "uuid": "85380cd2-da75-489b-bb02-0b1a7acbec82", "value": "49152:79qU20GdyVCh0hS6rn13jeecERVuoFng/poEDGfH/p:79tUdPyB1TLurp7Gv/p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597448, "uuid": "eb52f6cc-6c00-4ea7-b8db-4f68991eca9e", "value": 2041856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597448, "uuid": "9ab03924-187e-4ce1-8cb6-89f13ccd71fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597448, "uuid": "6ea2fb8e-d6d5-49e7-ade9-0b7ca0dcef40", "value": "315a2814329e4da0c14184c6d049899e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180514c4-2750-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1633598549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598549, "uuid": "541c03fa-1e36-4c7e-acf3-5876e883be61", "comment": "Malware payload (ArkeiStealer)", "value": "4d0db60fc5f8c5589340110330341467", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598549, "uuid": "72caf739-3303-470a-99ba-01fbe7089805", "comment": "Malware payload (ArkeiStealer)", "value": "ea516db6800329002e1bf6146faf4bf845be216682ca52381624b3cdaf7fc487", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598549, "uuid": "509d18ee-5076-4474-95d5-c550e071fb59", "comment": "Malware payload (ArkeiStealer)", "value": "ddf63c2b290e0a7ba40bac6849132292025224b7", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598549, "uuid": "9b9226d9-9c21-4a81-9377-9ba026d74fc9", "comment": "Malware payload (ArkeiStealer)", "value": "fedca451808fb9b11036f9dd531bec9f10449820ca3d18ba3273a2fbcefaaafb7aae9095a8a3a318934b1deac4484bc1", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598549, "uuid": "3546c983-3f6c-4195-9c99-1872582cc118", "value": "T1E9E40201A6F0C030F4B722BA5976C3B4992D79F06B7484CB62851BEA6FB56E4ED30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598549, "uuid": "0fca65bc-8cf2-40aa-9f70-91307d537c1b", "value": "dfddb4935ecfeccd8e67f98d0f98b8e1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598549, "uuid": "1f2d851a-9609-4929-a7b3-d43eb543a3ba", "value": "12288:wFrPGQyO4nLWM9q6y+1PJvkSMSsVETkJZZsYih5orJ9L85/hmQnx:wF4nL1q6y2vktSsskvZsYc5orJ9LY/Xx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598549, "uuid": "37d45475-4974-462d-be04-1cd1c260c168", "value": 676864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598549, "uuid": "c4fd0c59-8638-4740-9662-873384854045", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598549, "uuid": "233c60e7-a1f2-4811-9d33-d2afb0a19442", "value": "4d0db60fc5f8c5589340110330341467.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "659de479-274d-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633597391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597391, "uuid": "dc5c2411-eda8-419d-9786-4acacf2de449", "comment": "Malware payload (RaccoonStealer)", "value": "7eac71f9ef5bc51039c85c3caf7940d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597391, "uuid": "3ec8e6d2-d00c-4947-b842-ece17964ae66", "comment": "Malware payload (RaccoonStealer)", "value": "eb33bd628ebeb2de4091f36ab518e658bfa7764822fea208e951e0364d711844", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597391, "uuid": "91025c51-89dc-4928-89a3-cf211b552f6c", "comment": "Malware payload (RaccoonStealer)", "value": "bee66b52915cde72ee125e5a7cc9705cbbf1a5e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597391, "uuid": "66c69fc9-fc90-4d0d-bcce-e90aaae00863", "comment": "Malware payload (RaccoonStealer)", "value": "9f14ca6c9d70106666e163acd1f1b0e37cb0b8389cf68bc1b6a763f000228b867dbcb45edef7c0199abb5d2b1b046b69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597391, "uuid": "e3249711-119c-4c1c-98e7-6d0265e5f6d2", "value": "T1A2B4F10075B39AF5E6774672FA71CAA1CB2B7D5D6932718F37A1611E2E3C2E18722301", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597391, "uuid": "320e1b30-a44e-448e-9a64-bd69a2fa52fd", "value": "e7a97aff935fd5f902aa97ce23e1da74", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597391, "uuid": "4d81d0e2-ff37-4ba3-abc7-dde70b2fa846", "value": "12288:iiHbg9m1BCKD/LKjzX6ec54mGzojLAyDBdEn0B19b:iiAKRDLKjL6ecCmGzcLAyDH9XV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597391, "uuid": "9b18e15d-d83b-4dcd-85db-34ad2be56296", "value": 534016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597391, "uuid": "be481e0b-a607-4469-aa0e-fff60a22edc8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597391, "uuid": "f12a5a00-8ffc-47ba-8b3c-6d003346f2cd", "value": "7eac71f9ef5bc51039c85c3caf7940d8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc814686-2740-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633591980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591980, "uuid": "679ad114-a4bc-4c7a-9667-0d95a64f9fe3", "comment": "Malware payload (Formbook)", "value": "c72a6ef7f38dffd50a0447ee1cd2ba94", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591980, "uuid": "83199479-748b-4b17-93e7-0840510ac132", "comment": "Malware payload (Formbook)", "value": "eb6e9a570d6a5305184f25b35abdcc4a76846f0d263872e07cdbbccb3587589e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591980, "uuid": "ba05a36e-2d36-4466-8e0b-0feb25124f48", "comment": "Malware payload (Formbook)", "value": "8d09ca3d281a65d9e3bbeccffc6b25b46b9b831a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633591980, "uuid": "cebe91de-9525-4dd7-9095-4fe3f4dc865a", "comment": "Malware payload (Formbook)", "value": "0c4b7b668d97dfad3e08aef678c350d9345eb10b3493b1f4a135b9eb8d3828bf5350977dcc1ff9a51c0c4c030cc900ee", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591980, "uuid": "66cb0a88-d0b5-43c9-b309-e879e85e4b18", "value": "T17E84122AFBEEF753F29F71F149AB00A681269EB9236EE4759D35340684B1F1D9401F20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591980, "uuid": "1da3fe53-9e7e-4795-86fa-95af30bf97f7", "value": "6144:6EsRG3bpHgoZF3qC/u/orqNqH5T90I9Edk9NnBZof3R0fMqmv7LUR+/4wz0LVkvr:6TMLRLv3qCGjNqZB0I9EE7ZofS+PUR+V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633591980, "uuid": "26e5b130-5795-4b80-bc81-fb5e2b5258a7", "value": 375296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633591980, "uuid": "c3bdfef5-af6d-4128-b762-ffa2eb2b8446", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633591980, "uuid": "00b5f6fe-c790-4270-9cfa-fbefbe1d4415", "value": "CV 10-06-2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d7c1fd6-277c-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633617429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633617429, "uuid": "b26382c6-e83a-4843-b025-7764a2f7124e", "comment": "Malware payload (Quakbot)", "value": "90da0c2ab6fd1b12eeeaafbce0693dba", "object_relation": "md5", "Tag": [ { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama111", "colour": "#5A8007", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633617429, "uuid": "84173ef6-0a0e-4dc5-bd83-edb429e99a74", "comment": "Malware payload (Quakbot)", "value": "ecb5ecfc5b28264383e2fb771c167bb5dc5fce19d9239b9cdf509b1921ccecd7", "object_relation": "sha256", "Tag": [ { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama111", "colour": "#5A8007", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633617429, "uuid": "5f456a65-4748-44f8-98db-43d60349cb45", "comment": "Malware payload (Quakbot)", "value": "f1562363f37b19f5957742763c8e242c8fcac27f", "object_relation": "sha1", "Tag": [ { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama111", "colour": "#5A8007", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633617429, "uuid": "1ef5e561-2794-410e-8e2e-53c747d33b29", "comment": "Malware payload (Quakbot)", "value": "8cf4360cb0daef89f8aa93cba4ca805d47aedd886b84a7edb1eb8e10d63a19551b48385afce950f4ad880f3aff5d0b71", "object_relation": "sha3-384", "Tag": [ { "name": "obama", "colour": "#D3F433", "exportable": true, "hide_tag": false }, { "name": "obama111", "colour": "#5A8007", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633617429, "uuid": "a413b67e-eae6-4ef6-b16f-8a172af3d703", "value": "T120D39C463797CA5BE58803398ED3C79B3B72FC21DE72470336463B0E5E7A6A18C16652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633617429, "uuid": "1b163cdf-f562-4c1c-997a-f924cf5c8a14", "value": "3072:jk3hOdsylKlgxopeiBNhZFGzE+cL2kdAFc6YehWfG0tUHKGDbpmsiiL42ti+RLCY:jk3hOdsylKlgxopeiBNhZF+E+W2kdAFR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633617429, "uuid": "2742f385-491a-46c2-9cbc-8677805e27bc", "value": 137216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633617429, "uuid": "9e90154a-c333-4145-96c5-c0396dec88be", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633617429, "uuid": "e026f6a4-e212-4e8a-a531-8bb1810ee00a", "value": "AMLRPT_383069693.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0595007-277a-11ec-843c-42010a9c0014", "comment": "Malware payload (Hancitor)", "timestamp": 1633616817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616817, "uuid": "09394076-ad22-40b5-a611-7c2d4149d26e", "comment": "Malware payload (Hancitor)", "value": "bbd29e739b97fe15d72d58471019e7eb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616817, "uuid": "6913b695-0f49-4d7e-97bc-82bdc2d3086e", "comment": "Malware payload (Hancitor)", "value": "ede4c71a7d7a09d4da1860cbfec4a0a02104b510eb359883e3276a018f39ead8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616817, "uuid": "8882d7a8-c07a-4591-a51e-79719e125563", "comment": "Malware payload (Hancitor)", "value": "d0557e06b22ee0706ece4cc7559136da70267006", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633616817, "uuid": "1de584a6-603b-4b0f-9a91-d2ec9e2412f9", "comment": "Malware payload (Hancitor)", "value": "52ec50523b5b788f68fba6ae393982930541d0c775a83d6300544a473946d3229eb49a6ed0700ae1137d2518c4337199", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Hancitor", "colour": "#1A394C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616817, "uuid": "82eaeb9a-1a11-4177-8b67-0ecbbd41bd91", "value": "T1D3849E107580C032D5BB29354934D6F20A6D7C609E78AA8FF7D82E7F1F746D29225B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616817, "uuid": "10c1e429-a2d0-43d3-a5f1-35eabd0815fb", "value": "5ddb76f59a01d9c25d928bda7d1aa803", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616817, "uuid": "f526a44a-e751-46d6-956a-edb13e136cf4", "value": "6144:98XDY8z71J3t75fPzSeLqwBNZTilj8u4rR/QkAVV36wLuFi3t2oG0e:98k8z7L3t75fPzSkqwbZTilj81/Qkc5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633616817, "uuid": "d25dc805-2468-4cb3-9a6a-c965ece64287", "value": 388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633616817, "uuid": "28d5276c-96db-4cda-b98b-4dda39059ea5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633616817, "uuid": "fbb04c3f-fc7b-4bf6-8d00-0c9810500238", "value": "gelfor.dap.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0788439-273d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633590671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590671, "uuid": "9e39e328-8ffe-410e-9ddb-945d2bac50c5", "comment": "Malware payload (AgentTesla)", "value": "ae3f3964f9b59eb1db752498a60a73b3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590671, "uuid": "e994f9fb-1ea2-4f83-8a7e-b3f1b7885c06", "comment": "Malware payload (AgentTesla)", "value": "ef148cf45c46e623030cbba756e15232e38e025e074f6f7a00253783634b1f54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590671, "uuid": "91ce3e63-e298-485d-ac1f-e6138408067c", "comment": "Malware payload (AgentTesla)", "value": "ef27a8b5286104f0c87092ee9430340f297d23c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633590671, "uuid": "aaf05ff1-cd4c-41df-8906-c164727d1cee", "comment": "Malware payload (AgentTesla)", "value": "c24a5344c17aaa812241fd264f35a388f0f57140df8fc3a5bc9fb388eec44f5ae746e4d0127ea674c8b5cf4008137b0b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590671, "uuid": "3354d4ca-423f-4439-810c-119faba4c9b2", "value": "T194A4E07A32A3CD04DF3193B6ED9ED5A007B9A912312ACB793A4D626D78127F44DD01CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590671, "uuid": "e48a84f8-132c-4bce-9f71-61d96d8fa4e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590671, "uuid": "77c0bbd7-32b1-4d94-bc2f-345aba53bd1d", "value": "12288:digXc2AoXxNpSY44N8nguQHEazdjmZjEgw:digXc2ASH8nguQHEaxiZY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633590671, "uuid": "180f70b3-62e9-4c9a-9044-3b27c057e402", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633590671, "uuid": "b1482626-439b-49ab-b44f-ac65a8758c2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633590671, "uuid": "48d53068-67c5-4973-93d4-deb9aa8aaa2d", "value": "Request_0002_119-002-9902393.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7695a865-2743-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633593124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593124, "uuid": "dfc34b20-8810-4c4a-a434-94b781f3da94", "comment": "Malware payload", "value": "71787d73028dc946c42279979110b5cd", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593124, "uuid": "0ada7217-ade0-4da6-b097-b116cae08d96", "comment": "Malware payload", "value": "ef16246fe61b95908f82b2c759f9f2aa0614c38452f7cfdcfa7e928a8b487787", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593124, "uuid": "8308ea4c-747e-4b56-a809-f07dc42a8523", "comment": "Malware payload", "value": "12f15468f1bd02cf0e0691432971690d4a0b5a23", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593124, "uuid": "ee60f6b6-a31f-4bfe-b87e-07ad5ced22f0", "comment": "Malware payload", "value": "03af3bb6ba40b28699cc1773ff9e746ddc712f1bebe41d58eb9555e23926f0dbe106da80a872f40c1d2e3c5030bb49fa", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593124, "uuid": "5c881cbd-eeca-4052-b7ab-dd2f20efc1c6", "value": "T18DB412857F84C536E10B5933D408E0E3E16D34DC942EB06B46F9A4A65D65DBA0B03FEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593124, "uuid": "e71e701c-d479-49a6-87da-fa0faad17f58", "value": "12288:kdqzX15d1t4TdvBVYRIjITnxNI/cw/e1xHTW00r4QvG:KqvmPCTnx+Ze11N0r4qG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593124, "uuid": "67722eae-af2e-46cd-92e9-2416475cae60", "value": 507791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593124, "uuid": "2a249c29-6a42-4de1-9de9-d8d71d07b3db", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593124, "uuid": "07d71739-12de-4fc3-9cbc-17bc2569e685", "value": "PO_2196.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd322c52-274c-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633597135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597135, "uuid": "c2f10fd1-3af8-4c4b-abdf-930ba9b70de2", "comment": "Malware payload (Formbook)", "value": "a6dc10d7c082142c47aea5e53463af8b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597135, "uuid": "b5b82edb-e9c1-4143-9951-e5ff4523d6e0", "comment": "Malware payload (Formbook)", "value": "f0537b93c3ac221e4efe9d5835845b4930529890472272b0b0f8db2bf1d4ca5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597135, "uuid": "2fd39940-09e1-41ee-b4b9-105e493c55a2", "comment": "Malware payload (Formbook)", "value": "a0aa396c2a1e4f855793a7ce9d0dfc765f0345fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597135, "uuid": "c0e1b0bc-7363-428b-a300-f025dda893a0", "comment": "Malware payload (Formbook)", "value": "4201b8257baf033311d21c8355dae09c1a3f0dea0220042c37470f43474990c643a9ed687960e143886d1c8a54a8b712", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597135, "uuid": "496637cd-ea2c-4e22-b333-74cdc2ba0c12", "value": "T1E494E17A36A3CD00DE7046BAEDDDC15243BDB8423169C77A2A8D727D69223F44DD06CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597135, "uuid": "19e5c046-7b5c-437d-a6a0-3189e4793100", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597135, "uuid": "f2e70895-9ccb-4cd0-b33f-93e261fe5f3f", "value": "6144:oqcdYptHeQ+3HwOasz51QAoa4YA5tf/H1QRc6YAuww4PNKgtp27Yd0iJuBStqvi1:ozYpFnodz51QXa16GRKWP7Dd4BStqK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597135, "uuid": "be2abbcc-5729-41b7-bbed-ad6de9f17ef6", "value": 423936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597135, "uuid": "198d3a31-6970-43f9-882b-a9a067e6bb99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597135, "uuid": "a99750dc-974a-44e0-aa7a-d06efe290bf1", "value": "a6dc10d7c082142c47aea5e53463af8b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b633a54-2743-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1633592971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592971, "uuid": "08cd2acd-8138-4f34-a1b1-d526715fdf47", "comment": "Malware payload (GuLoader)", "value": "bf89b12b78252b53528b70c11cfd5e7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592971, "uuid": "ce16fef0-27af-4990-ba1c-9e334497f6cb", "comment": "Malware payload (GuLoader)", "value": "f06dbe989a1b6b962b5690b0f6b7b7c22a443c3607b97a5815cfcaf773d57e46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592971, "uuid": "3eb28030-18b8-41cb-956e-635490b27d50", "comment": "Malware payload (GuLoader)", "value": "2d0df882dea665197c631957033563a3d3b34ece", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592971, "uuid": "a9f8aacf-4052-4161-9cec-9912d708aeaf", "comment": "Malware payload (GuLoader)", "value": "45649abb40e58da755a5fd558939d0ef7dab7232473fcb686e032a2e287d9c222e7f2f84548a9832f2973259846a497a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "ROU", "colour": "#27ED5D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592971, "uuid": "19d43d24-17f5-4c8e-8594-b3f84e6f9597", "value": "T1D9445B8167948023DC635B705EA747CB1B29FCD2AB7471972361F76E0E76AC26C38326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592971, "uuid": "069cf3fa-ec77-410b-9337-f0befb4b6ecb", "value": "bc70c4fa605f17c85050b7c7b6d42e44", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592971, "uuid": "90595a65-5053-431d-88b8-1e345a0cefce", "value": "3072:0wdK6g8IT9xi5GWp1icKAArDZz4N9GhbkrNEk1jv9qbmFWE7ZZrwY70q5Cm5zFS+:1K6g8ITMp0yN90QEcvOmgE9Zrw854+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633592971, "uuid": "0ed0c039-9703-435d-aec1-4e5a9cf5ddfb", "value": 265216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633592971, "uuid": "563ac956-98ce-43d5-b444-4c5db66c5b7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592971, "uuid": "3af40f15-609d-4f17-96e9-9871a45e2251", "value": "Confirmare de plata 06-10-2021\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eca6c3ce-2725-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633580437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580437, "uuid": "dee6577a-497f-47da-8c3e-b65d620597e9", "comment": "Malware payload (Gafgyt)", "value": "96cf2404086f0491b2106d97181b259d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580437, "uuid": "aaf813dd-7132-4e5f-922f-afb11b0bab50", "comment": "Malware payload (Gafgyt)", "value": "f1686b467a99fda093b5cb0552b9f884c561cc50297689b600fefafe053542c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580437, "uuid": "b48ae833-0258-46f3-aa6b-8c392e97b0a3", "comment": "Malware payload (Gafgyt)", "value": "2955844c196afe33d9d25d51c13bebad33b55818", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633580437, "uuid": "08ec12e5-5c69-4dc0-82d2-92d367ea75df", "comment": "Malware payload (Gafgyt)", "value": "4858cb7687ad09d259c481a8c1400e7615074f0070011a92feb57b032b881149d2ee5e8217ef8e4451758f70d62d4298", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580437, "uuid": "5e118a5d-ddfa-4e14-b38e-423bfd7aa3c1", "value": "T1FE832943B71D0B43C09B6AF12DFB27F0836AF96116A76580A11EFFC45772AB02512FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580437, "uuid": "97895cd8-3ca4-45bb-bf9f-3ab2e4cb5bfb", "value": "1536:SQelrqw2N7qyynucFM3sjFRwVWjA6PxBQ8EmQ9VqXjtWf2Xe:S9CH3cFM38l1BQ8EmQ9VqXBWf2Xe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633580437, "uuid": "75af218b-661d-42bb-87c1-e057c679e5d4", "value": 84692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633580437, "uuid": "52273aea-5a3d-46cc-aade-8f0b8109f5e9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633580437, "uuid": "b4b5e850-b24e-4cee-b35c-a4e4a33ad396", "value": "96cf2404086f0491b2106d97181b259d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810584d8-2788-11ec-843c-42010a9c0014", "comment": "Malware payload (Lu0Bot)", "timestamp": 1633622777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622777, "uuid": "9e864d67-a858-4350-b9ae-b7ad7ee257fc", "comment": "Malware payload (Lu0Bot)", "value": "adb4950d6faf2fdeec92aad604a2e7b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622777, "uuid": "1092436b-0236-42d1-a444-4fc28e1eb503", "comment": "Malware payload (Lu0Bot)", "value": "f186c2ac1ba8c2b9ab9b99c61ad3c831a6676728948ba6a7ab8345121baeaa92", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622777, "uuid": "7565de36-bd95-4789-a1d0-0b8991234292", "comment": "Malware payload (Lu0Bot)", "value": "7e45ff3388c793e4e625c11950b6e2c19a900b1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622777, "uuid": "e0414180-2445-443e-9d6e-5b8e947b1cbb", "comment": "Malware payload (Lu0Bot)", "value": "a90f1420b979e6dd9b50910f62764e7aa21b83e5145712d069ba347c40e5c199d363a97d22ff225bedf51547b2a322ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622777, "uuid": "d7a8c607-4caa-4ef4-91a6-35772994b156", "value": "T11051C67FFC261DE2D89D823D158F8A417718C12182A2607913C5A2DDEFD0F3128DC169", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622777, "uuid": "b62e050f-e361-48f7-aeb3-9251026f44fe", "value": "78d381e690e6d03e804177630e461896", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622777, "uuid": "77783bbf-ed37-427b-adb6-a8704b367dad", "value": "48:6pk6h3hLSqRM+XLDi8S9XsDFh3hLScKFEZSCaGdyNrBS:p6hxLSqJ9SOhxLScgEZZNyFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633622777, "uuid": "ed0cd8de-0a37-475f-b94e-0759e9a913c6", "value": 2560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633622777, "uuid": "dbc69ebe-35b3-4265-a200-ded092a6356b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622777, "uuid": "da6572c2-ed5f-41fa-b642-0ec4bbf2ed16", "value": "adb4950d6faf2fdeec92aad604a2e7b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a822de6-278a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633623545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623545, "uuid": "a9afb4f1-6c15-46ad-bb7c-8a60c5c45e35", "comment": "Malware payload (Mirai)", "value": "775ebf6faa95fc282098840494b88046", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623545, "uuid": "2fbf32ff-8940-422c-9c4f-98cdaf2052d0", "comment": "Malware payload (Mirai)", "value": "f19c643a3e743298cab586f5779f3aed22f9654733914ae9b9e8731564a3e8fe", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623545, "uuid": "7e7a09fa-3135-49c5-8789-687f9eac1b17", "comment": "Malware payload (Mirai)", "value": "8d6539d8378e65f7f51141bbdfc8300ea3918aec", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633623545, "uuid": "5341801f-511d-43fc-ac5e-13486748034e", "comment": "Malware payload (Mirai)", "value": "b4631ebe22f6e6597d8fca006c9e5110869f8538376222818602a6191625149a3ee32a91a9e4f40ca9e2ccc5ec49d45e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623545, "uuid": "15404df2-6b16-47ee-9ed0-805cef0ef194", "value": "T1A7830706B9C088FEC44AD1300B7BB53AC521F1AD133DB2EB7785FF161D8DE605A5A899", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623545, "uuid": "24f26b9b-954e-4dc6-83e2-9effc4933476", "value": "1536:8BhVVzbTPlhuVl4IOgz5w0kpaKPfJyIr7QTzKSRACVoWVUR3Aof32S:8BvVzbTNhWlV19NBKJ/fQTzKSRdeNR3R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633623545, "uuid": "00fe83ec-f01d-46a5-b70e-348ec4a38280", "value": 83776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633623545, "uuid": "d8239b46-ed86-4e06-a728-4eb452a08901", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633623545, "uuid": "5ef1dc7c-0667-41ec-9dc1-f71a78f9a057", "value": "x86_64-20211007-1619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa36a05-274c-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1633597112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597112, "uuid": "cb829117-d959-4dd9-a8a3-7a909d19f6a1", "comment": "Malware payload (Smoke Loader)", "value": "8b5aa38304cd7d90451c4dc04da6fb5c", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597112, "uuid": "3d313810-9572-4cd4-a4a3-b5b11b3f21ef", "comment": "Malware payload (Smoke Loader)", "value": "f1e06a14a57aeb1785f82a4e105355c8abb0a6b81d07e5ef5d1ccad70b786313", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597112, "uuid": "60b54b37-b9ba-4560-986f-8633638d9bf9", "comment": "Malware payload (Smoke Loader)", "value": "19ddc0fb71b88d2ebeb00aa4328f585b1f7b77c8", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597112, "uuid": "fe83cb0d-a702-46a0-a165-1727af64b3ed", "comment": "Malware payload (Smoke Loader)", "value": "e82d803b140cb6df64ca51c9bb812b2ca1f498db7317f0a228331552b39539b8b408d5dd379953da6fea703230c53c72", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597112, "uuid": "d1c6a1a0-b81d-41f8-8751-fb638dd69ed5", "value": "T141D3AD2534C4C473E36629344DA1C6B14B27BCB68D71998B2FD50A7EDF6A2D0CB28387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597112, "uuid": "77632205-e820-4c7e-8058-ace0405bdead", "value": "01c64e8a0bf942eae9e15adaebb52144", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597112, "uuid": "a318a96d-fea1-40df-a7cf-334c265379a1", "value": "3072:B6FlRK6BWmr2hdNWFpFNqERsNW2vAogFV8135WCH:0FZ5rydNWTqEaU2iVW5WCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597112, "uuid": "6508f92c-0360-432c-8a92-bef59f61800e", "value": 141590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597112, "uuid": "46b0e20f-6ab7-45e5-aa19-9e32bac0415a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597112, "uuid": "fb762312-8126-4056-affa-32f48482a3cb", "value": "8b5aa38304cd7d90451c4dc04da6fb5c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c05120a-2755-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633600837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600837, "uuid": "f7022471-ae33-478a-9be4-f73c0bd20a0c", "comment": "Malware payload (AgentTesla)", "value": "e98e7d3508ed921f4ebef2ead60bce4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600837, "uuid": "0c6a7bc7-4b10-4b84-a969-19d44ea5f660", "comment": "Malware payload (AgentTesla)", "value": "f28ab5d1c3e9e6e4b38e4c2ffc2a724544ee06d0616db88d4f836902f8a27012", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600837, "uuid": "05d5d813-2ec7-4061-ab7a-4e084cffee0e", "comment": "Malware payload (AgentTesla)", "value": "919993f5ff3ba4e97face57c56b528662f173d28", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633600837, "uuid": "5671cdd0-2743-4a0d-9716-03456f18fa39", "comment": "Malware payload (AgentTesla)", "value": "4554178d1856711ad29b85d5ae1324c4161d75e43fd28bf9ee415cf7ec00b66de60bb909159cf3159048c9f69a7628ee", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600837, "uuid": "1a282b28-cdc9-4d03-bff3-2114d2beb76e", "value": "T148A4016903378249CD7887F5290A67A06775E026150DD3782FE4F0FC7EA7BB84AE0297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600837, "uuid": "9c05061c-1bc8-42ac-bad5-11a5711b2e53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600837, "uuid": "18dbaa1d-f337-4057-b916-3cc451f97e71", "value": "6144:7mjRhZJDQ+3HwOLyh8F4yhGu+0zG5Bt4w8Q0NOj8EDMLfbdUZCLPCyceBWcacHJ:EkoWh8eRH0atF0fEQLf2cHRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633600837, "uuid": "644fbee8-c9b4-472f-8f82-29302a2c65f3", "value": 453120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633600837, "uuid": "1ec63275-583e-4e6c-93cf-50c2964ccd6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633600837, "uuid": "e76c96e3-585c-488d-aa4d-69420676d388", "value": "CGK HAWB 01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aee8b4e-2765-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633607681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607681, "uuid": "208b29f6-5754-4774-81a0-668733e46a28", "comment": "Malware payload (NanoCore)", "value": "424471c08b36379794b6883c023da1a9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607681, "uuid": "1dd5506a-4132-476f-a201-87f00ff5b67b", "comment": "Malware payload (NanoCore)", "value": "f48727e4bed76fbba8aed9036c36e0f82641cd6b0f72bb53e8004a10b71141bb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607681, "uuid": "65375495-14ae-4707-9a17-03f2f3806220", "comment": "Malware payload (NanoCore)", "value": "4b0b270c08248b7625c3c39c65398782cfc138f6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607681, "uuid": "00d88ad0-1b0f-4d63-8947-37d1524730a0", "comment": "Malware payload (NanoCore)", "value": "fcf81709da6c3da5a3e46a9729d8aa713f8c3f90cd9777736cad258ea5c429ace24068451d6edd48a9e32ad66636a1a5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607681, "uuid": "40355ca3-4621-42c4-b221-6d43199654f2", "value": "T1B0B4B541912E7D6FF62FE8181693E0C8386E957AE4F0056C93AEF014DE259EAED4C17C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607681, "uuid": "ca80f36c-690b-426f-882f-285123eb766c", "value": "3072:iNDDDDDDDHDDDDDDD55PpdzFtr5RDAw5wf3:6PpdzFt1RDAUwP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633607681, "uuid": "12515034-f9e1-4556-93f7-be4bfc123f2b", "value": 512842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633607681, "uuid": "89b6c7a1-a319-44e1-9265-cd0ff806482c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607681, "uuid": "75d8875f-4f97-4d8a-87e3-860bafe7eb16", "value": "img_Especificaci\u00f3n_07102021.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5270d8e-274e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633598034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598034, "uuid": "4ea2920d-32b5-460a-b59d-5303d92bef2e", "comment": "Malware payload (Formbook)", "value": "1e600b33bd5e1420472158c1b2e145a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598034, "uuid": "80eb8996-45ac-4da0-8dac-c9d6f701d878", "comment": "Malware payload (Formbook)", "value": "f5447c22561c0692e385ef3c0ef0ed84d4ce35042f0839bddd7de9aeaa1f777a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598034, "uuid": "734af46e-bbea-49e3-bd20-5642567eeef2", "comment": "Malware payload (Formbook)", "value": "9c7e3b79da95c8c1159c3d0758c78118f89b0a7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598034, "uuid": "b99218fb-6aa3-416d-8f4e-f5eaa7f5caef", "comment": "Malware payload (Formbook)", "value": "8d5899e541837f3686100f02405aa027fc2a36c0415f1df25595a4726943413afaf942e3ba9e05ac34a9e765e691b76a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598034, "uuid": "2e4a63bb-f102-4e95-aca6-31f4a8cc0c91", "value": "T1DAF45B51E7A1C821D1332FBC8C63A2B48C1E2E115F549A8F31E4BF99EE35953391619F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598034, "uuid": "38af5ca2-850e-4560-8f42-c8f208783ee4", "value": "a85da29f7c79b749e46738d8b965ea53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598034, "uuid": "d1eb8358-9235-4bc1-81ca-f3acbcae4a37", "value": "12288:5siTtPf0MEakNE3XqKkjY2N04kY7CE5L0S4rrMGdMpGyS:KaF0MEakNMrkE2hkY7CE5L0S4PMGdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598034, "uuid": "a07b50a9-f361-4248-b6b6-a86b249b2ad9", "value": 792576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598034, "uuid": "0a2b5893-ad53-429b-85f8-e7a020447060", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598034, "uuid": "3fe550a6-9205-489a-8eb5-7499e0f01c89", "value": "1e600b33bd5e1420472158c1b2e145a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e5dd261-271d-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633576870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576870, "uuid": "ce8245dd-ba60-4e38-84cc-598a8a2a0881", "comment": "Malware payload (Mirai)", "value": "3898091b7fbf8b20f380e12cc8aa2d1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576870, "uuid": "77c99e3b-fd5b-4702-b553-74104065244d", "comment": "Malware payload (Mirai)", "value": "f610ccfc47d31399702978f2bdd78ad46273f738a98dba386ed33f7c1c060c78", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576870, "uuid": "80f85d16-cacd-4263-bd70-1b17d36bb554", "comment": "Malware payload (Mirai)", "value": "7ed67a2c0b7a40f98ffd8d36a1a5f01b96ce6b27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576870, "uuid": "d1e92dcc-3a0e-44c5-9a66-b856e0c61312", "comment": "Malware payload (Mirai)", "value": "d3721ad0d5da813f446ad913ebc80e110a12eb3a6d087e510545b2913cb275777bf824eb4c9c37ef69116385563815fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576870, "uuid": "bb7b3b16-8122-4872-9c8a-034cc9b0e155", "value": "T166A3B62B6B230F23C0D6107112E31632A8B9DF9934BC97D769E07C9D5F399883456AED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576870, "uuid": "99194175-d1c5-4257-9912-d87c4df4e37f", "value": "1536:8EjcPRg3ppMuhBYyYE1Zk1hN95l/1tprtYcw:WMpyjETMhNPl/t/w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633576870, "uuid": "b785aa98-2b93-486b-833f-d568b300fccc", "value": 99728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633576870, "uuid": "d0214dd9-e76e-43c1-8d8a-38a77226344b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576870, "uuid": "27aef406-d020-4cdc-ba3b-68aac2f3e513", "value": "3898091b7fbf8b20f380e12cc8aa2d1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "192febd3-279d-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633631622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633631622, "uuid": "fc395720-65b5-4ce8-b80e-110c7e8e5682", "comment": "Malware payload (Formbook)", "value": "04dc6bc2a3d74405fb5b8e25dbab22f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633631622, "uuid": "572ea90a-d12e-4ba6-a437-377706167b6b", "comment": "Malware payload (Formbook)", "value": "f654159c930801bae3fda6c11cb0b97e26267114943e9e074bd8c4d8330a3ea6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633631622, "uuid": "85886070-7690-42bb-8231-db6f7bd3db1a", "comment": "Malware payload (Formbook)", "value": "74a6344dae1b25e7038cda0d65941bfa5f639364", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633631622, "uuid": "137c10c7-a310-47ae-a038-1137dccfb0bd", "comment": "Malware payload (Formbook)", "value": "82ee1d7d6b2aeea9405a8ef065a52d2d6d34e7280db3af7de81c086b8e164044e182d00ebf4f0e2b1cc0bcb70de31f51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633631622, "uuid": "df881fff-1744-425b-b8ca-a98644a67cae", "value": "T148058EE2F5E3C336C227363C48271229142A38577A29F66B31F86E8CEF35706275A557", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633631622, "uuid": "7518abbe-374d-4ae3-93c3-9a9abe744e28", "value": "63d793c7bfed8139488cc1a5c45be64f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633631622, "uuid": "66ff429f-80c0-41fe-b9fe-487be4ce94c8", "value": "24576:lawOWWJ7S8YsUXkY7CE5L0S4PMGdMWEjI:llcJ1gj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633631622, "uuid": "d5f05f08-2143-455a-a703-6802af3dd089", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633631622, "uuid": "6849b273-aa24-4812-8d4a-3d01e9f11caf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633631622, "uuid": "53605684-0ad4-43e7-937a-514a48076daa", "value": "IMG100897 TWI-SHA 202102 SHEETS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19918c6b-274e-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633597693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597693, "uuid": "b0cf2175-348c-4658-ac6e-a260eb488a1f", "comment": "Malware payload (Formbook)", "value": "6d76b11c350623bb258c91e084915ede", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597693, "uuid": "2c5091c8-ef32-4410-9a74-cb5cdb0487fa", "comment": "Malware payload (Formbook)", "value": "f66cc04ceebc1bc6084983064372bbfb7f0c5c80f36a911cbc78ff2250cf9667", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597693, "uuid": "ceb1c066-58e6-4b39-be42-406a64abfff7", "comment": "Malware payload (Formbook)", "value": "b5ffe2e8674a6be0f4c345ffbc045ae7a2acbc30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633597693, "uuid": "6645b0e5-c7c7-4992-82ce-c84deaecd22b", "comment": "Malware payload (Formbook)", "value": "167f51de3a7c9beb4cf01a0fd197717c6ed8d7254a116dbdcbc0a7513cb1f318f9652854809fb0c1c573e655d215b64b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597693, "uuid": "5b240f64-bb9b-4873-aef2-19842c8330b5", "value": "T106356AD453CB99C0B57B2539B0122CFBF47D620DF2AECF1155A33A938CBA750562DA88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597693, "uuid": "99258bcb-8f05-4d65-a5f7-b3c72f691dac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597693, "uuid": "436ee9af-ff57-42a6-be73-3f103c91dcc4", "value": "24576:XcbhXZw6yA9XUFA3VIO3PHgXZw6yA9XU:Mbvw09XE2z/Hqw09X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633597693, "uuid": "4cbd9943-e3ce-4115-bf5e-5a1f8ce42a60", "value": 1125376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633597693, "uuid": "75a32bbd-b909-4d84-9adc-b3e2b7e250b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633597693, "uuid": "8d5235fd-da45-4c41-a524-a3eeae7e61a7", "value": "6d76b11c350623bb258c91e084915ede", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae61b9da-2752-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1633599660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633599660, "uuid": "ad8c1031-9dfa-4ba2-a9e4-4ab9c6dcc336", "comment": "Malware payload (AsyncRAT)", "value": "5780a2f86ca9e87be144f333effc3609", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633599660, "uuid": "79f27b3c-df90-494a-aba8-0e15f6ecf4ac", "comment": "Malware payload (AsyncRAT)", "value": "f7b1316e99b777272503bb42f03b9ecdb371635b9d0dcca76ac37b3f5616013c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633599660, "uuid": "03d340b5-e6ca-402c-a502-410954005728", "comment": "Malware payload (AsyncRAT)", "value": "cd46eb5c9033bddb621533805551b631cb330d5a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633599660, "uuid": "590fe23b-3331-40c0-a972-50995b928a47", "comment": "Malware payload (AsyncRAT)", "value": "3af2b858dee86efab0363668fb6b9439f4adea7cba68a3184506017e5d1a2c812e602a26c828b9a23d4c7c3415fbcadf", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633599660, "uuid": "6b9a6c11-2b02-49c3-ae4b-a4fc8796ab31", "value": "T1C644E06823375708CE7847F02C15A7A11775E516205AC3785BD8F0FC7EABBB98AE0297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633599660, "uuid": "32ec876b-cf8d-484d-ba4a-f0706f78fc5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633599660, "uuid": "b84c6202-beed-4154-8a32-fd767c6b11bb", "value": "6144:xs2lZHDQ+3HwOJ53YGIUjrKDtcqxkKEXiLxiVR51/UJWLCHsI:pkoJ5DjrAttDEXk2fyjHsI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633599660, "uuid": "d44b1394-4ef3-46d8-bbd8-e9726bfdf78b", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633599660, "uuid": "9db1a781-43cf-4945-b22a-8199034ac5d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633599660, "uuid": "03cef066-5c58-44dc-8bfa-aac9b0cd1210", "value": "PROFO......08102021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8aead2-2742-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633592869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592869, "uuid": "2f9027d5-0770-4c2b-9a30-9654b070e77c", "comment": "Malware payload (AgentTesla)", "value": "53ec99e1ad3f4bf4c26469052dc42508", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592869, "uuid": "5e4861c0-317d-4516-bfa7-06b3d1e95789", "comment": "Malware payload (AgentTesla)", "value": "f80ffcc732ad0c9e604709a86783d68d126a5e639926c62ebc63928aecb38ce3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592869, "uuid": "3facf890-c72f-456c-8a2f-ca28d2135b8c", "comment": "Malware payload (AgentTesla)", "value": "49583707c3ff3608280b8574ca8f75bf6cff3e11", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592869, "uuid": "168871ef-1095-4f11-a611-18b99324060a", "comment": "Malware payload (AgentTesla)", "value": "b5d083955bedaa1d7ad687052be3a341456844b5e6f412b267d8436346043334e966252c474dd044e2cc55ab936a68cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "PRT", "colour": "#27EC70", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592869, "uuid": "c87971db-84a4-4cf7-a339-ed666480ee56", "value": "T18594016913778618DE34C7F46868D24217B8A55A614DC37D5FE8A0BE7F23B380AE0B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592869, "uuid": "1ff13579-1740-4960-9abb-732dcfa709d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592869, "uuid": "747c6ba9-2b6d-4a74-b598-6880199ccda1", "value": "6144:Cspp4jIDQ+3HwO+w1YyXzX2Ikge9wKoc+9+ybVX0EtdxP0MDSgPPQEfht:Bs0koj3kge9wKM9/nnxFoEZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633592869, "uuid": "99da6e3f-4f4d-444e-80b4-396489202f80", "value": 441856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633592869, "uuid": "0aabd553-89c9-4f5d-831c-a4dafd06c2e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592869, "uuid": "0b0a30ff-8e99-4797-98a6-6035286ea418", "value": "Compra Direta - Material Odontol\u00f3gico.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f37cb9-2702-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1633565093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633565093, "uuid": "956976e9-c0f2-4845-8afd-ebbc6d43c6cd", "comment": "Malware payload (RedLineStealer)", "value": "b76c8a24bb597ad0d10352f0170bf37e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633565093, "uuid": "4687ea0b-495c-401b-a0aa-2851a37a6ecc", "comment": "Malware payload (RedLineStealer)", "value": "f880f1bdad4b6022e1ec7de81fdd9276f023dee04c56068698e88db70038886a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633565093, "uuid": "282bb1d6-7274-41ef-bc8b-a16e5048b17f", "comment": "Malware payload (RedLineStealer)", "value": "5391a49d2490ad588e69faaac0cb592ebbca0623", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633565093, "uuid": "ab0daf47-8247-432d-b6d3-2d34b8103da8", "comment": "Malware payload (RedLineStealer)", "value": "ab56c9a5bdf1c2bb6706248f8063cf37de75c2192d0b040a8c913e6e41ef329db172b6ffa84a11c954ba066e7810233a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633565093, "uuid": "3202ecf4-be58-4e1d-8475-6a962bd34011", "value": "T172344B1C27481F21E77C463AC4D15101E7F2C9D7A0ABE30AADD035E65E92BE9E6076CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633565093, "uuid": "e8134e69-4349-4646-a06f-033ced3f0d71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633565093, "uuid": "e38c8fed-eaf1-45c4-99a5-c28a9ebcc3ac", "value": "6144:4e0Mi4rPOvQ/niwQJIZ6laI+KXO6TCZwcyGb:J0Mi4rGvQ/niOw6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633565093, "uuid": "5efc987b-f4aa-4edf-88c3-e268ead76ce4", "value": 230632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633565093, "uuid": "3fae77e2-d1e2-40b3-b09f-0ffec5fa190b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633565093, "uuid": "290dae74-d985-4366-a9ba-11dc8db185c8", "value": "SecuriteInfo.com.Suspicious.Win32.Save.a.11515.11861", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2b3c51-2743-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633593164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593164, "uuid": "0320f993-67d5-46bd-90b8-31e69b4af0e8", "comment": "Malware payload", "value": "809acc5d08181d4e2b3183011213b8f6", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593164, "uuid": "d77a737d-c89d-4700-aa2f-556ddcdbf76a", "comment": "Malware payload", "value": "f88624c0b5358bb46a9badfdeb838a9faee6e084cd299720aa651dd3d6c07c92", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593164, "uuid": "f4f7ccd8-c86f-4232-abd9-24185069324e", "comment": "Malware payload", "value": "0e9f58178c5121ef103f86bc2da1ef3acd9997ab", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593164, "uuid": "d8e09a5b-64ba-4239-82f4-bb14fd45aa8c", "comment": "Malware payload", "value": "e478d3fe21816c50a6e456f8ab356d5c6bc2779a6c972c9bcbb7ab57d2f7360ec19f39c9bf7e85a26408f136c125721e", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593164, "uuid": "50c17a64-9787-4c95-b385-265a0975ce88", "value": "T1AFB58E23B3C28537D0772A3C8D6BA799A529BE111D3C584B3FE41E4C1F396417E2929B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593164, "uuid": "26b1724c-fb46-4d1b-94d6-c605c8d18da2", "value": "49152:3zOqVntn6W0jUzH+aULGxqKOqzi1Koj+kd+TPk7OYLEA:Kqb6W0EH+BXKOqH8OYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593164, "uuid": "1b2e3c20-2f87-4086-a307-3f2c6ee57ccc", "value": 2335232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593164, "uuid": "d716d663-d385-4180-9ad7-0175e47cda4a", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593164, "uuid": "b3779052-56f3-4a6e-93fe-19a0e1429d1a", "value": "factura - wqdqeincsqrwnbrwcvrp.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e018c8-2791-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633626490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626490, "uuid": "01f105e4-1725-47d7-ac2e-419ede8f15d8", "comment": "Malware payload (Gafgyt)", "value": "71ab753b6c7eed2ef902fba7182e69bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626490, "uuid": "177ae63c-1be3-41ae-bdf1-83aceb1ab875", "comment": "Malware payload (Gafgyt)", "value": "f911d4f894d0bce86aeef242dd49e4ac1b78ea06c972d621dade3fc725754e22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626490, "uuid": "8d8979cf-8f1a-4f6e-81e2-bdf4af5a1df1", "comment": "Malware payload (Gafgyt)", "value": "d1a58514c42c0bae320cbd751f4de0d2b3038e29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633626490, "uuid": "3da3b90c-1f2c-4d8a-b4a5-4ee987e49b12", "comment": "Malware payload (Gafgyt)", "value": "77d48ac1342bc130dd87710896b04a03d250831a882cd8503067c550fac79790089bd804934a77564af4db47432dc2fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626490, "uuid": "5ad8e397-dab5-44fc-a0a6-6dd2288172e2", "value": "T16B733A02E652CAB3C8930BB602AB9B664631FD2A1E2B9F55F31C7DF49F124C87117355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626490, "uuid": "38107bfe-e642-450f-9c64-144871f70cf4", "value": "1536:nm+c5osQWiKLoxKFn6pD+OTxzMUMmLI2VOCjXUfJRk:45omr0xKFn6J+OLMmU2VOCbUfJRk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633626490, "uuid": "af5f9108-c0d9-499c-b6f1-b631922f40d1", "value": 74024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633626490, "uuid": "9db8c112-a0c9-4420-9397-d6171c19bb84", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633626490, "uuid": "18689b91-df34-4d73-9dd8-19ea70ed9baf", "value": "71ab753b6c7eed2ef902fba7182e69bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32d2c24f-2787-11ec-843c-42010a9c0014", "comment": "Malware payload (AZORult)", "timestamp": 1633622216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622216, "uuid": "b1e5e218-f565-44df-b37f-8da1f5e9f314", "comment": "Malware payload (AZORult)", "value": "3b383cec6e449a3a89b384425389cd12", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622216, "uuid": "987e0e8a-059b-445f-a008-13b19216eeac", "comment": "Malware payload (AZORult)", "value": "fa7607fe08f0cc262ff4500613d08fdfabe6a0b072cf7d9fcc886a204164fac1", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622216, "uuid": "20a5ab4c-fe9d-4b66-871a-de9af9ca8cfc", "comment": "Malware payload (AZORult)", "value": "a4273c99be23d20e15182a3e9899bc764ab6f205", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622216, "uuid": "92f985a9-2398-474c-9548-b7e220e16130", "comment": "Malware payload (AZORult)", "value": "414fa1c4e9e26d2f1e1fdedf4a301bf20c1748e838273201099cdeb871459f290a520a7fd45212e4c8352155ec4d61b4", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622216, "uuid": "ad9b1cef-287c-467e-88d5-c41c381c0b55", "value": "T17B05EC5363AC8ED4C06792B4DFC1C4B96C09D9EE421A53B4AB12AB64F75FC031E6A473", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622216, "uuid": "fb4b2f0a-f6d7-4261-9b81-4a2db9ca01c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622216, "uuid": "025144c2-b9f0-4b78-b5e1-5cf27edf1580", "value": "6144:cZsW6Uq+gwLKsbsQ9dz5hcFzf2nyPHCk2cAc868tG9:cGUq8sq8qFW8C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633622216, "uuid": "e1fce404-82e2-4c63-a425-e9957c51b965", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633622216, "uuid": "234f42af-5cd5-4e00-8d3b-4c17180e836e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622216, "uuid": "dc5d1825-781a-4042-b569-438ba7c0c836", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "967da57e-27b4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633641711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633641711, "uuid": "60f3c32e-0018-4ab5-a825-cbf43ab41799", "comment": "Malware payload", "value": "2db0b5a09292133e794322cb14639b2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633641711, "uuid": "d7036bc5-6c55-474d-b94b-6c15729f333c", "comment": "Malware payload", "value": "fb4e1ee6f7fb1b22dd7b4f011ffadab81337cfe2d8171219b49df67e814ce5ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633641711, "uuid": "421bca45-4618-42df-81ea-81cc1119005e", "comment": "Malware payload", "value": "4aaf5438a6e765af5e7bc370d4245ee5678dee65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633641711, "uuid": "60447c5c-ac07-421f-85a9-61f3de7a70df", "comment": "Malware payload", "value": "cdd51c6e0d176a19cfc68418eef71e2078f81dbc13335af88aad04c94003ed585c01259331d9b4f9102a89a7d173eef2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633641711, "uuid": "51dd25d9-d91a-4b99-b762-83d59f69727d", "value": "T113E40102FDC185B2D5610C36156AAB51697DBD201F24CEEBB3D86E2DE9311D0BB30BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633641711, "uuid": "6c1c1249-12e3-4f03-b038-7301d513ef93", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633641711, "uuid": "8edd3c0d-4d0f-44ab-a0bf-569ddcc9ba15", "value": "12288:8zxzTDWikLSb4NS7ET+tG1XbHaawAphVGc+rxanaDN7OjeQ1:6DWHSb4Nhh6iVGc+rxanSOyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633641711, "uuid": "aa8cc6bd-938b-4ce8-a0f5-1c11002b37fd", "value": 682440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633641711, "uuid": "166d9d16-79e1-4163-b09c-3645045c5fdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633641711, "uuid": "a47faed6-82a9-417f-9799-934d2a299eb1", "value": "2db0b5a09292133e794322cb14639b2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49c15554-2743-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1633593049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593049, "uuid": "2808de4b-6aa7-482c-b5be-d8f1eae886e0", "comment": "Malware payload (NanoCore)", "value": "6a76346e78194e2d4c0a8495214d0ade", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593049, "uuid": "7fa45d1e-36cd-40d1-bd61-b639c39c4458", "comment": "Malware payload (NanoCore)", "value": "fb7082ae28a26f373e846efa9077d2b5a35f71f09f8273b66288d1cf04afc913", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593049, "uuid": "b93acc4f-21c2-4968-bdea-9e78e6ad6ba6", "comment": "Malware payload (NanoCore)", "value": "c281dafe0505d2f547e760483057dc97b6259b20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633593049, "uuid": "4ec892d8-ab9e-48de-a9f5-e0be80675b77", "comment": "Malware payload (NanoCore)", "value": "937b5048bff46aa167e185c0db76b2fb924a6771db1a855d9210563dc60deb069948dd8526c6656834c804dfb3860b1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593049, "uuid": "589d6030-a31f-450a-be9d-96c228aa88a2", "value": "T1D835975363AC8DC4C06792B4DFC1C4B96D19D9EE811A53B4AB02AB60F79FC031E6A573", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593049, "uuid": "b6548e96-e7a0-48f0-bb16-30891468f2c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593049, "uuid": "d6159abd-a887-4c8e-b611-a707c87db7af", "value": "12288:H4UfC+9Z0FD8uOb5gRcMQGQD21Cov6nnjqKoe:YUfC+9Z0Byb5w6v6M06nnjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633593049, "uuid": "3773d86a-a98c-48c3-b92b-56b162d4bbbb", "value": 1141760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633593049, "uuid": "5c4549bd-fe65-46ab-82a7-fff98ea192dd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633593049, "uuid": "57b74034-cdea-4cd7-a208-522b483f5f1a", "value": "Memorandum from the Saudi Embassy.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04618b1f-2735-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1633586920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586920, "uuid": "575ee2ee-359d-48d2-a29e-923cd135b426", "comment": "Malware payload (Loki)", "value": "025795251b2214859fcd3d4076e3afc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586920, "uuid": "ac2703b4-7db6-40cc-a455-148612f3bf30", "comment": "Malware payload (Loki)", "value": "fb77862bdebea6dcdac59aabad070d8b550dfddcedc45d7a54864386f95b5157", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586920, "uuid": "2d900938-1410-421a-a7a3-1a0825731820", "comment": "Malware payload (Loki)", "value": "6b1434f195d3afdf67412d7213b4cfe9a045ec5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633586920, "uuid": "8710ec26-b408-4258-bcaa-8c0af9b9f5c2", "comment": "Malware payload (Loki)", "value": "96385cc1ae77a7604fbc94da7a17ccf281530812baff1bd2a854d6c6b1cd7695ec4bbea2a7a965402c2c70dfc4290e37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586920, "uuid": "75fae940-8c9f-4c66-9c9b-e97ae52afcb8", "value": "T195541203B2C059EFC5E71FF22B77E76AE6BAC80A25861D0787705D71289A583C14739B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586920, "uuid": "c78a5a7b-0d8b-4a3c-9247-9ce41b132207", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586920, "uuid": "47e8d3da-ebf9-4d61-aef5-af9bc70e1521", "value": "6144:F8LxBsMfBWSi4UqAqmD41oUKt0C0Odt+C8zG2AfGKowALJS2NSxleSJhEmb:/MfEJYopt0/OfDe8owALJBSGSDEmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633586920, "uuid": "2443c5c7-f463-455d-a380-14b9159728a7", "value": 297336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633586920, "uuid": "b590bda7-1ce6-489b-b469-e5afa11e257f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633586920, "uuid": "c5fc1bbf-b562-45e5-bb92-6f3b3376ed6c", "value": "swift-copyUSD 47,667.75_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9a12e2-2786-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633621719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621719, "uuid": "6d6d37d7-3605-4651-8919-684251479f5f", "comment": "Malware payload (Metamorfo)", "value": "7cb2f5dfe212d86d76e4ab1aed7c0575", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621719, "uuid": "fc6a53cf-dad7-4347-9ca3-57d7f5cf2985", "comment": "Malware payload (Metamorfo)", "value": "fcbb09becad97e605f873dadd5e5c417eb15ce8f2cf4b5d2200958788993aa2a", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621719, "uuid": "aa0d9e0e-9a1a-4f44-9dbf-939523b57504", "comment": "Malware payload (Metamorfo)", "value": "9c70422f4297fc03c480d7c0f354d080f8958229", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633621719, "uuid": "988a9cc0-2897-4828-9a35-7dde91620c37", "comment": "Malware payload (Metamorfo)", "value": "ce4bfb9e4541fc0567ca8bb49bc28a1405a09ae7df52ff86ba6fbe9bb13707f98a5b17ae8064d7a7b0c3c7f2907d75c1", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621719, "uuid": "e5e04452-ca40-4e87-8045-837a89f1f9bc", "value": "T18131BE051EDA1329C3B7CF7A1077A2464A76FC51EE934F9D80C497DA2891154FC34E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621719, "uuid": "5b1c1e5d-246d-46f8-9d7e-c819f12a1cf8", "value": "24:8+JUHRlVo5kcbA+PLDjr+/P+Plwz41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+Pj0qb1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633621719, "uuid": "7c648b02-234b-4d56-9282-a65c2de3f3c7", "value": 1552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633621719, "uuid": "5f56bf9d-c053-4040-ae43-9b123eeffce0", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633621719, "uuid": "3dd4b6dd-c7e3-45fc-8242-4cbd04b6d857", "value": "foto.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "626f7199-2765-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633607693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607693, "uuid": "2733d532-e9ab-4c87-92ea-9b1f1cc7027f", "comment": "Malware payload (Formbook)", "value": "83b3f7ce5ae3de58ee0ddad2dfa55866", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607693, "uuid": "b515e53e-9abf-4a31-9d8a-639db048e682", "comment": "Malware payload (Formbook)", "value": "fcc1a23e41277db988497071faffe4f0b7d52a38ad58a505ecc23947768a265f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607693, "uuid": "7ae60915-4dc9-4ae6-9132-ebccab917f2a", "comment": "Malware payload (Formbook)", "value": "59485a657980ed5bfff1b00b559bc0818a673d11", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633607693, "uuid": "c1d721b9-4f41-4abd-9ae3-03e9f3fee6b3", "comment": "Malware payload (Formbook)", "value": "d283b3a560064575725d1e9942ffa23a0f18df007f29ef6f85eacccfc92e5146dda67fcce3024f52ad395ffb6a4d03e5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607693, "uuid": "1bb0cea1-b0f3-4681-b50e-668c8c1e87a3", "value": "T1EA842349BB14DF3BF2C3B8766E251726672D5C0197CB891678E072BF0079B05E5F822A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607693, "uuid": "bfbecdd9-736c-466b-ab56-4c58a6f6329e", "value": "6144:dct8unJ8H62w37IwI2HcJsKGG1MgsPzspwp0lKu4M4QGULm1e3XhFjnMTwCv6JaT:ut7nJT2w37IwI24X2Xzcwp04Q9zwGXhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633607693, "uuid": "58f503e3-9ed3-4a24-b5ae-386a6d0cc0ab", "value": 386560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633607693, "uuid": "99f49b10-55e7-4d8a-a2b3-c969c0d42936", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633607693, "uuid": "cda64af6-e7a4-4208-9497-e24081f175f3", "value": "PO no 275.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8399cd41-2788-11ec-843c-42010a9c0014", "comment": "Malware payload (Lu0Bot)", "timestamp": 1633622781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622781, "uuid": "799e6178-b136-4429-827c-5944bcaac67d", "comment": "Malware payload (Lu0Bot)", "value": "0fd2355a4674cd4a70f9b1f422ab984c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622781, "uuid": "d7370ee6-9e9e-4d32-8395-de96204b0b00", "comment": "Malware payload (Lu0Bot)", "value": "fce3d69b9c65945dcfbb74155f2186626f2ab404e38117f2222762361d7af6e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622781, "uuid": "a80e64db-e8cf-43bc-846e-b3c154dfac4c", "comment": "Malware payload (Lu0Bot)", "value": "d41bdbf1a226c4c9be075ae02f138de257a89d5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633622781, "uuid": "c2ccde08-88a8-477c-b905-ef3e44b1ded9", "comment": "Malware payload (Lu0Bot)", "value": "837e1c2299447decac524a71cf01172178828b9b61731c1d7ec219f345a2307170db4168746424b1210b0f7eb429ba61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lu0Bot", "colour": "#3E1A2A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622781, "uuid": "47a09d5d-58d1-4896-b2bc-d57dad04e156", "value": "T10A51BB98D35C3C01C51ECDB3658A5881AF398115B1B950391F8911A79ED1BF4DE2DD88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622781, "uuid": "fa0d9197-cecd-47ee-99c7-e76d658ee2c9", "value": "78d381e690e6d03e804177630e461896", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622781, "uuid": "90a94209-4222-4580-b9a4-2bc27a7bb01c", "value": "24:etGSBPN7o8n71vt8/g8Hj/TB2EZ3NIicn71vt8fP0YKRoYS7uY6SCaGTMWRiRNru:69+4vt8/HqiYvt8IR1sCaGdyNrBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633622781, "uuid": "3a27a658-39dc-4539-8332-5b7111327b8f", "value": 2560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633622781, "uuid": "428c9878-117d-44f4-adf7-1be2e47a919d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633622781, "uuid": "a0271bc3-8db6-4a56-841f-11689b417fd1", "value": "0fd2355a4674cd4a70f9b1f422ab984c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20fbbf5c-2743-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633592981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592981, "uuid": "ed74c059-42bd-4b81-96f5-bab337e96d90", "comment": "Malware payload (Formbook)", "value": "b560f3b4c51574f5111a4ab5f15c7a8d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592981, "uuid": "77452b3b-ad2f-4ce9-a45b-d0c77c304dd2", "comment": "Malware payload (Formbook)", "value": "fd137acb0bda1d576079078b74fe610d16031da47a801440c7ba955f4504a6e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592981, "uuid": "52347ee7-7fcd-4cd3-ae17-e3395e3863f3", "comment": "Malware payload (Formbook)", "value": "dd5cc1bb495385080f8e5ba20caefd6746598f0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633592981, "uuid": "afd5086e-f4eb-4a55-9ba6-6e921446cf7d", "comment": "Malware payload (Formbook)", "value": "402ce04362bff523d8fe04a3566a986af24df5eabbee4299cbd58b1eb4280273452bae4d7560718f1c22e006978ed220", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592981, "uuid": "432554a2-8a19-4688-9a89-dd82ed467595", "value": "T198821901FBF85FF3EB5789392C37E3600E74B6454D69CB0E2CAB541A5C36250205ABBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592981, "uuid": "c75f96c9-6682-4124-8a5e-6f18f02f77b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592981, "uuid": "b1de2129-20f2-4967-98a5-3d94eef9a116", "value": "384:OEB6gfTsv98S1FBgyxwJtsNA4DZh2UjOlSaOOVP63Wd4eVW:O6W/x5N/h2EOJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633592981, "uuid": "1ad8e49a-c2f6-4e7a-b829-91226546a9d0", "value": 17920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633592981, "uuid": "bd7cb681-ce9a-4426-b0d0-d10607523752", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633592981, "uuid": "5ac351f0-b9e3-49bc-8d07-40681596d91d", "value": "Prezzo del prodotto italiano.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0aed66c-2795-11ec-843c-42010a9c0014", "comment": "Malware payload (Quakbot)", "timestamp": 1633628414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633628414, "uuid": "a1b34712-6ffb-433b-ae47-23cdc9ae521b", "comment": "Malware payload (Quakbot)", "value": "1eb64d44a2d45b7dced1269365133aa6", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633628414, "uuid": "81607109-b20e-4ba1-ad01-ae883bf4b8b5", "comment": "Malware payload (Quakbot)", "value": "fd9b99c4358e80ce84f27b2a0d7af0d7ede5a2364e1c7b54eed8ad76fb9b166b", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633628414, "uuid": "62a091de-b44c-4b80-9ad7-0c294c65497b", "comment": "Malware payload (Quakbot)", "value": "b4cb678874568f14594d3dd31770b6a320604541", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633628414, "uuid": "c394e480-b654-4294-90e0-c15326726682", "comment": "Malware payload (Quakbot)", "value": "63b52b45d677ef0b80ae1845a6095ee479b26a61143dc0eb12d53c7cb6d3f88a68823da931a326ad864f249d23c0a501", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633628414, "uuid": "5915902b-5588-4539-aaa0-dc325ed8fb8c", "value": "T10BD39C463797CA5BE58803398ED3C79B3B72FC21DE72470336463B0E5E7A6A18C16652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633628414, "uuid": "4b36b6c8-8958-4cc7-8131-2f5e6ee9bd57", "value": "3072:jk3hOdsylKlgxopeiBNhZFGzE+cL2kdAFc6YehWfG0tUHKGDbpmsiiN42ti+RLCY:jk3hOdsylKlgxopeiBNhZF+E+W2kdAFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633628414, "uuid": "32242b82-ea61-4026-9408-a0ede53463d0", "value": 137216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633628414, "uuid": "3a64cd6e-5a8d-4fb9-bac4-dd576805c9a3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633628414, "uuid": "f6b289e2-e906-468e-afd8-be30dad9587c", "value": "AMLRPT_257035367.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20e8ff9-2767-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1633608659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608659, "uuid": "5d85be99-6f17-48f1-848a-1461032d1432", "comment": "Malware payload (RaccoonStealer)", "value": "cb3f847ae3b0e57d90631bc615527ef9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608659, "uuid": "6de5dfc3-6c8e-4879-8b32-cd2cfb01807a", "comment": "Malware payload (RaccoonStealer)", "value": "fd9cceca8b8a195da00f864f7d8642a6b4c4c8c9bdae8620d846d81335ef9130", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608659, "uuid": "0a89fbd2-99aa-4ea2-a576-b6ec0f06a3e8", "comment": "Malware payload (RaccoonStealer)", "value": "78e73c71279de61c1b9343fce21905f8b6aaef10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608659, "uuid": "33c9aae1-7515-4306-8274-dba4047e5392", "comment": "Malware payload (RaccoonStealer)", "value": "68ad61323b21c0e30974b678d11c8bfb034a773d944ca10e070dc56c4875e647daebedfb2e48c0474232b3cd0931e3e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608659, "uuid": "1522a1b7-772b-43d1-8674-d3a944ce72b3", "value": "T1A9B4F111ABE0C035F1F713F91AB983A4A939BDB1AB3490CF62D426E956742F4AC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608659, "uuid": "cdc060f8-a777-401f-93be-6f8bae69dc6c", "value": "104d9977f4378bb867ddadb6d1eb3d6c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608659, "uuid": "6eb51cb9-5a49-4d6c-9403-a0469bf606a1", "value": "12288:1BF0Wcmno3F3PO6lQZlxTKFuAygq6jIDzCDY8p9CsvT1:1Bzo34FheFuAyjuIDGTppvT1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633608659, "uuid": "e26be740-71db-4975-908e-c7183bb06a1c", "value": 495104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633608659, "uuid": "869a2b40-46c9-42ff-967f-5ccda019afb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608659, "uuid": "f4732f6c-dd59-4c34-a22d-4ca5551c3574", "value": "cb3f847ae3b0e57d90631bc615527ef9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a66824-27bf-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1633646540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633646540, "uuid": "746e1f89-6223-40b1-b610-41509821f0ab", "comment": "Malware payload", "value": "764987da4271d3dd9d7d9f8f78c897e5", "object_relation": "md5", "Tag": [ { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633646540, "uuid": "3c2772e8-fb4c-4b89-8744-d32cc8542c56", "comment": "Malware payload", "value": "fe73fd3955380212aaecb045e92353f9684af4e89e4d1c183dd84a0b7271230b", "object_relation": "sha256", "Tag": [ { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633646540, "uuid": "8304f054-7144-4497-bac8-a3b92bdd33d3", "comment": "Malware payload", "value": "8df3093cfe00a49a1f86db5a4d6263a29ff30980", "object_relation": "sha1", "Tag": [ { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633646540, "uuid": "d576bbe6-c7e9-47b5-b3e8-487219c42023", "comment": "Malware payload", "value": "b418c453cee94cb6fb6154161bf6908ae3b723d5b2c42d00664d005b0b3bf96751cd67390aa1b2fcc1b0170bd04be392", "object_relation": "sha3-384", "Tag": [ { "name": "SQUIRRELWAFFLE", "colour": "#9B3171", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633646540, "uuid": "f5dc7f25-54e2-4fb4-9b26-dfb4715901ad", "value": "T18A44D02636A5A41DEC2D2B76A8BB53D02337FC504FD38BC73AA772263F726914D26405", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633646540, "uuid": "16b818f4-6944-450f-9c2c-569d24d9c10a", "value": "6144:mKpb8rGYrMPe3q7Q0XV5xtuE8vG8UM+Onfb7I6+tqDWcwnoRZzlj+oSGpGvhmmmk:Gj7CqScwoRZ9bSXkh/nLKH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633646540, "uuid": "87bbb3e8-ae26-4d9a-91ca-55858dd8a42c", "value": 269312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633646540, "uuid": "8f28d7c0-aaca-47db-9539-25d79f333c93", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633646540, "uuid": "428274ea-63d8-423a-899a-87f8ed774f2a", "value": "diagram_1318555547.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a777ed0-2797-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1633629074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633629074, "uuid": "2bc104a3-eb7b-4e14-8a50-c4564b3dd4db", "comment": "Malware payload (RemcosRAT)", "value": "2f34b9019d27655bed75f111aceb6cbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633629074, "uuid": "a843d9cc-2661-42a9-9048-8ebb747a95c0", "comment": "Malware payload (RemcosRAT)", "value": "feef665217cb68de1a40cc4026e614dc4a692ab3d56ee3119cf46c56beb3725b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633629074, "uuid": "b470b8fb-8c40-48b0-bba7-ac256bcd122f", "comment": "Malware payload (RemcosRAT)", "value": "70497c0be653788f4841957d69da1575a2371b13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633629074, "uuid": "b04ae48c-979c-4e82-ae3e-6c35f70701e3", "comment": "Malware payload (RemcosRAT)", "value": "de7d4dd9afd265171846a34bd272e2d3cc82ee2ea6699625bb9665ffdea8f83d80f0ab3c14c8fbe7cb1bfc5c2a80a8dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633629074, "uuid": "b5925060-1570-49b1-8149-87e38cb7985a", "value": "T1FF058D94F7B64877C8335ABC48172675982B3D20AA6A2C0A3CED7F1DDE371C259061B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633629074, "uuid": "78616215-4e77-40c9-94f7-1ecd908f8dfd", "value": "63d793c7bfed8139488cc1a5c45be64f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633629074, "uuid": "83430a96-7dab-4c8d-9660-370d50ccf726", "value": "24576:lawOWWJ7S8YsUEkY7CE5L0S4PMGdMWEjI:llcJ1nj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633629074, "uuid": "2342a20b-4ef6-4582-a057-25d831f125f1", "value": 861184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633629074, "uuid": "99b9598b-b95c-4716-b62c-d1287778f943", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633629074, "uuid": "572f8ed5-97eb-4e7e-8791-bad86496fb42", "value": "Waybill.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9acdeeee-271d-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1633576864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576864, "uuid": "8b003846-b349-484f-a25e-430550df2c26", "comment": "Malware payload (Gafgyt)", "value": "45141a18467c7196adfaaf4038b7d084", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576864, "uuid": "64bc1445-6402-45cc-83f6-c6ab74f8035c", "comment": "Malware payload (Gafgyt)", "value": "ff2a6378039128f403821a1621336464aa1308ecee5b3568e544e7f424d2aa1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576864, "uuid": "861d0cec-3e0d-4349-9063-cc8872b88d88", "comment": "Malware payload (Gafgyt)", "value": "58c177d9502e55799b1f09f7349081ac25f16712", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576864, "uuid": "4b5d41f3-86f3-4812-a964-6e01ed9ab47f", "comment": "Malware payload (Gafgyt)", "value": "ca22ab0a8cf52f285a443f9099520c134983b0210c15a9e5cc0d70f5227d3fba588bd99ee3383b9d0e694d5321120fe0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576864, "uuid": "5c303f96-43f8-428b-8682-653f50ad9fc9", "value": "T11583E784FD559B1FC3E372FAE759028D763A1FA8A7EB30259934BE9023F5BD02525120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576864, "uuid": "1857359f-97e5-44aa-9641-c425f5b18cee", "value": "1536:sC2ruOIXs+NGmd4fIVDJZPJmoSRBv8+B52u5OOF4nb:5Ot+NGm8oDJOocvh2lnb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633576864, "uuid": "bcb89fdd-dd05-4077-a367-ad4034fd5afa", "value": 86616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633576864, "uuid": "dd711ff0-f747-4b6e-9336-1507275b6721", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576864, "uuid": "d083e4ce-bbdf-4dc1-9901-fb93eaf537e6", "value": "45141a18467c7196adfaaf4038b7d084", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "348ccad4-2767-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1633608475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608475, "uuid": "1776410b-d10e-49f6-b190-73ff48be749a", "comment": "Malware payload (Formbook)", "value": "efdf9216547065c84074cf72173c8474", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608475, "uuid": "c07c8243-539e-402a-9fb1-14509af82144", "comment": "Malware payload (Formbook)", "value": "ff64ff314c7947e5faae8181ac818b124a6d17d0fc3a66e8777a78a613d6093c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608475, "uuid": "db6f4fe3-9e89-413a-b31f-05e2152bf297", "comment": "Malware payload (Formbook)", "value": "f32cc61e2f9ba8185fc9223614d75bb048d255f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633608475, "uuid": "04df051e-54a1-4244-b722-ea2f2b0f72f5", "comment": "Malware payload (Formbook)", "value": "ffd606190da054356de5544e73154bbb7adba6873a253d2c8cb05b767c15c597d7025bccd981dd528f7dd9db30e124b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608475, "uuid": "721ef42e-b1d5-41c4-b521-821ce0f19d19", "value": "T10094F2A803674608CC7847F5282AA7916339E1262419D73C0BD4F0FD7EA7BFD8AD5297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608475, "uuid": "8f313382-bf85-4ffc-9026-ce29e395ea88", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608475, "uuid": "144cf85a-3ec3-4647-a82a-766353554d04", "value": "6144:7xi1ZUDQ+3HwOPslNXSTpjh4iFPhNTAzHhwhB1R4bMefnh7+gnLY1QAMex37E:/kokfSTVh4iJ8Hh2R4bVnh7BLYZfxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633608475, "uuid": "b98ba174-b5aa-4eaf-9a83-0e816c29b3b4", "value": 430592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633608475, "uuid": "f1b4657d-a40c-423d-a9d4-911cf5c3905c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633608475, "uuid": "ad779116-fa5f-474a-a93d-8aeeee8375f9", "value": "efdf9216547065c84074cf72173c8474.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721f6d3b-2750-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1633598700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598700, "uuid": "ef2a3218-bf20-470d-9c54-388b034534cd", "comment": "Malware payload (AgentTesla)", "value": "d40a49b7a43b0e4a79a2693d541dbae1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598700, "uuid": "66bb5236-e203-48cc-aca2-56b2884a22dd", "comment": "Malware payload (AgentTesla)", "value": "ff89ced611d4ad5167bec7392316bd7a75c45cfdde67d26f248178aa728b263c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598700, "uuid": "d3effd07-c471-498f-bf87-01a06391c2bb", "comment": "Malware payload (AgentTesla)", "value": "40c5bf235ce0f0f5c113386737bf888a25f4e1cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633598700, "uuid": "9bcd809a-695d-4931-941b-6de9561652a6", "comment": "Malware payload (AgentTesla)", "value": "4ac67e07b81a8453b523f9aa230184aeee98beb44bc011850b068dfe368e18437049ffd3c2ab1096e7e153a910a0cbec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598700, "uuid": "0882e898-0080-4b7f-b41e-be929f4e9331", "value": "T1C2A4E07932A7C904CE7083B2DC9ED451037ABC2A2569CB7D6A8E716C68737F10D906DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598700, "uuid": "0dfd608e-53d0-4213-8eaa-f226101cf7bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598700, "uuid": "69bea0d2-dbaf-4246-aa4c-090f9dd4042d", "value": "6144:bqcdJCZQ+3HwOA1kkQI4VDTcFiOtPMlzOceoBth8Y6QbTj6eRNNlRgmI0KGnU/aD:/KqoAt4VDTcFnMMceYth9X3lLUf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633598700, "uuid": "937e1dc7-69b6-4b9c-affe-e5ec5f8a41f8", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633598700, "uuid": "438ad271-4fa4-42bd-9fb2-83956c1829df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633598700, "uuid": "7b5b1c1f-7b1e-47fc-9aa0-746902bade2b", "value": "d40a49b7a43b0e4a79a2693d541dbae1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd75f4b2-27a7-11ec-843c-42010a9c0014", "comment": "Malware payload (Metamorfo)", "timestamp": 1633636300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636300, "uuid": "faace82f-a058-4356-a8fb-e7f442ddf4de", "comment": "Malware payload (Metamorfo)", "value": "0d47413ffab166421a058923c9a69af2", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636300, "uuid": "d3411f5a-b4fc-4278-b8a7-712d8519dfe0", "comment": "Malware payload (Metamorfo)", "value": "ffda5112132860bc206f02bbf697504f0f4c129ea8bc09960014413b3049cf22", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636300, "uuid": "84bdf366-e3a6-469b-b117-8274840f4c40", "comment": "Malware payload (Metamorfo)", "value": "422316cb63ad5ff3f2f7d42f435d2903aab202a3", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633636300, "uuid": "34ebad51-99d7-4614-a7e3-430ea0269a06", "comment": "Malware payload (Metamorfo)", "value": "84c1f5cae937cf637b7fc596e72280b90497913bd63c13bad3c2a78f9d115240c04838f911dc8bed68a82962338e1afd", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false }, { "name": "MetaMorfo", "colour": "#925F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636300, "uuid": "aa04f2f5-72da-4731-b855-575b22e805fb", "value": "T13931BE091ADA1329C3B7CF7A1077A2464A76FD51AE934F9D80C497DE28A1150FC34E6B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636300, "uuid": "744e453c-2f68-4861-8ed1-349be62f53ff", "value": "24:8+JUHRlVo5kcbA+P/+/P+PsW9z41cV3ZUXQaR3+habMq1UHktoiB6N+/xmt:8+uH+M+oxX1cIXv3KaIqiHkb6NS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633636300, "uuid": "25b5e01e-2676-42bf-8420-3acc7f25972b", "value": 1550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633636300, "uuid": "f72bd8e1-6ac4-459f-8f7d-9a067174b12f", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633636300, "uuid": "553cc3f6-a199-4ba9-85a4-213bf1d51e9a", "value": "Anexo - 045071021.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad1591f-271c-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1633576220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576220, "uuid": "9ea3c1cc-323b-4dd0-a5db-a38c3a8a754e", "comment": "Malware payload (Mirai)", "value": "e62aba61e15d4526abd8ac333801454b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576220, "uuid": "a951392c-3244-40a3-88e7-4fd372cfb6fd", "comment": "Malware payload (Mirai)", "value": "ffeaf2b669b9849f36ff43bb0262fe4ab34409f036489b6d805bd98a384caf17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576220, "uuid": "dbb04a4c-6c0b-404b-bde0-eda286668c41", "comment": "Malware payload (Mirai)", "value": "b4c224b1cb8a99aaf60292ebb696b916368ce1d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1633576220, "uuid": "c36a46e3-e9a8-421f-bc39-c1f6f0e2cc46", "comment": "Malware payload (Mirai)", "value": "37a557a6416b46e595c82d19f2bd5519d3fe9f259aa07e140015b0ad74f060c4d267516a00e41399c758e9163bef46d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576220, "uuid": "9050549c-2f1f-4da7-b2ee-0097c80ff8f5", "value": "T1C3732B52B781DA73D10310F212E2EF260532FE7F2866E95AE3A57DB4DA390C09611F6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576220, "uuid": "258f4d33-f2a6-4bee-882d-5963cd0f183a", "value": "1536:LJCaWbNSwUdctHB2QvoBlSdcLKx7ya5/tEmZ+:LJCa4SwUdSHBCBlic2x7yIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1633576220, "uuid": "7bc22899-3243-4d92-93a8-04f63478b206", "value": 74104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1633576220, "uuid": "541319df-c44c-445a-a96c-b31d55874b0b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1633576220, "uuid": "89364a40-a0f9-4822-acb8-bf379f337bb0", "value": "e62aba61e15d4526abd8ac333801454b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }